From 6abcf79dd71b7cd631e8b539a345ca002654f4e3 Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Fri, 10 Oct 2025 14:51:01 +0800
Subject: [PATCH] Refactor MFA handling in login process

- Updated LoginResponse structure to replace MFAToken and MFATokenExpiresIn with AccessToken and ExpiresIn for improved clarity.
- Adjusted LoginByUserID and SendLoginCookies functions to utilize the new access token fields.
- Modified authback function to respond with the updated login response structure, enhancing the MFA flow.
---
 openapi/user/login.go | 17 +++++++++--------
 openapi/user/oauth.go | 10 +++++-----
 openapi/user/types.go |  4 ----
 3 files changed, 14 insertions(+), 17 deletions(-)

diff --git a/openapi/user/login.go b/openapi/user/login.go
index 2c612786..27acfc6b 100644
--- a/openapi/user/login.go
+++ b/openapi/user/login.go
@@ -164,17 +164,17 @@ func LoginByUserID(userid string, ip string) (*LoginResponse, error) {
 
 		// Sign temporary access token for MFA
 		var mfaExpire int = 10 * 60 // 10 minutes
-		mfaToken, err := oauth.OAuth.MakeAccessToken(yaoClientConfig.ClientID, ScopeMFAVerification, userid, mfaExpire)
+		accessToken, err := oauth.OAuth.MakeAccessToken(yaoClientConfig.ClientID, ScopeMFAVerification, userid, mfaExpire)
 		if err != nil {
 			return nil, err
 		}
 
 		return &LoginResponse{
-			UserID:            userid,
-			MFAToken:          mfaToken,
-			MFATokenExpiresIn: mfaExpire,
-			MFAEnabled:        mfaEnabled,
-			Status:            LoginStatusMFA,
+			UserID:      userid,
+			AccessToken: accessToken,
+			ExpiresIn:   mfaExpire,
+			MFAEnabled:  mfaEnabled,
+			Status:      LoginStatusMFA,
 		}, nil
 	}
 
@@ -259,7 +259,8 @@ func SendLoginCookies(c *gin.Context, loginResponse *LoginResponse, sessionID st
 
 	// MFA Temporary Access Token
 	if loginResponse.Status == LoginStatusMFA {
-		mfaToken := fmt.Sprintf("Bearer %s", loginResponse.MFAToken)
+		mfaToken := fmt.Sprintf("Bearer %s", loginResponse.AccessToken)
+		expires := time.Now().Add(time.Duration(loginResponse.ExpiresIn) * time.Second)
 		response.SendAccessTokenCookieWithExpiry(c, mfaToken, expires)
 		return
 	}
@@ -272,7 +273,7 @@ func SendLoginCookies(c *gin.Context, loginResponse *LoginResponse, sessionID st
 	refreshExpires := time.Now().Add(time.Duration(loginResponse.RefreshTokenExpiresIn) * time.Second)
 
 	// Send access token cookie
-	response.SendAccessTokenCookieWithExpiry(c, accessToken, expires)
+	response.SendAccessTokenCookieWithExpiry(c, accessToken, time.Now().Add(time.Duration(loginResponse.ExpiresIn)*time.Second))
 
 	// Send refresh token cookie
 	response.SendRefreshTokenCookieWithExpiry(c, refreshToken, refreshExpires)
diff --git a/openapi/user/oauth.go b/openapi/user/oauth.go
index 9b08553c..3d62740e 100644
--- a/openapi/user/oauth.go
+++ b/openapi/user/oauth.go
@@ -192,11 +192,11 @@ func authback(c *gin.Context) {
 	// MFA Response
 	if loginResponse.Status == LoginStatusMFA {
 		response.RespondWithSuccess(c, response.StatusOK, LoginSuccessResponse{
-			SessionID:         sid,
-			MFAEnabled:        loginResponse.MFAEnabled,
-			Status:            loginResponse.Status,
-			MFAToken:          loginResponse.MFAToken,
-			MFATokenExpiresIn: loginResponse.MFATokenExpiresIn,
+			SessionID:   sid,
+			MFAEnabled:  loginResponse.MFAEnabled,
+			Status:      loginResponse.Status,
+			AccessToken: loginResponse.AccessToken,
+			ExpiresIn:   loginResponse.ExpiresIn,
 		})
 		return
 	}
diff --git a/openapi/user/types.go b/openapi/user/types.go
index 05272322..d2c7e1b3 100644
--- a/openapi/user/types.go
+++ b/openapi/user/types.go
@@ -188,8 +188,6 @@ type LoginResponse struct {
 	ExpiresIn             int         `json:"expires_in,omitempty"`
 	RefreshTokenExpiresIn int         `json:"refresh_token_expires_in,omitempty"`
 	TokenType             string      `json:"token_type,omitempty"`
-	MFAToken              string      `json:"mfa_token,omitempty"`            // MFA token verification code
-	MFATokenExpiresIn     int         `json:"mfa_token_expires_in,omitempty"` // MFA token verification code expires in
 	MFAEnabled            bool        `json:"mfa_enabled,omitempty"`
 	Scope                 string      `json:"scope,omitempty"`
 	Status                LoginStatus `json:"status,omitempty"`
@@ -199,8 +197,6 @@ type LoginResponse struct {
 type LoginSuccessResponse struct {
 	IDToken               string      `json:"id_token,omitempty"`
 	AccessToken           string      `json:"access_token,omitempty"`
-	MFAToken              string      `json:"mfa_token,omitempty"`            // MFA token verification code
-	MFATokenExpiresIn     int         `json:"mfa_token_expires_in,omitempty"` // MFA token verification code expires in
 	SessionID             string      `json:"session_id,omitempty"`
 	RefreshToken          string      `json:"refresh_token,omitempty"`
 	ExpiresIn             int         `json:"expires_in,omitempty"`