title: Problem structuring two factor authentication
body: <pre><code>const login = (req, res) =&gt; {
    // console.log(req.body);
    // let email = req.body.email.toLowerCase();
    sequelize.models.User.findOne({
      where: {
        email: req.body.email,
      },
    })
      .then(async (user) =&gt; {
        if (!user) {
          // console.log(&quot; email not found  is true&quot;);
          return res.status(401).json({
            success: false,
            message: &quot; Authentication failed, Wrong Credentials&quot;,
          });
        }
        if (user.isActive == false) {
          // console.log(&quot;user is not activated&quot;, user.isActive);
          return res.status(400).json({
            success: false,
            message: &quot;account is not activated&quot;,
          });
        }
  
        console.log(&quot;test entry&quot;);
        await user.comparePassword(req.body.password, async (err, isMatch) =&gt; {
          console.log(req.body.password);
          if (isMatch &amp;&amp; !err) {
            console.log(&quot;user crap&quot;);
            //  role_id: user.role_id,
            const payload = {
              user_id: user.user_id,
            };
            const options = {
              expiresIn: &quot;10day&quot;,
            };
            const token = await jwt.sign(payload, process.env.SECRET, options);
            console.log(&quot;sssssss&quot;, payload);
            if (user.twoFactorAuth == false) {
              return res.json({
                success: true,
                token,
              });
            } else {
              // let mobile = user.phone;
              await twoFactorAuth(user); // we call the 2fa that will send a otp to the users cellphone
              // console.log(&quot;after cb&quot;);
            }
          } else {
            return res.json({
              success: false,
              msg: &quot;Authentication failed.&quot;,
            });
          }
        });
  
        // console.log(&quot;user crap&quot;, user.user_id);
      })
      .catch((error) =&gt; {
        return res.status(400).send(error);
      });
  };
  </code></pre>
  <pre><code>const twoFactorAuth = async (user) =&gt; {
    var data = qs.stringify({
      sender: &quot;hehe&quot;,
      mobile: user.phone,
      channel: &quot;sms&quot;,
    });
    var config = {
      method: &quot;POST&quot;,
      url: &quot;https://blablabla&quot;,
      headers: {
        Authorization: &quot;Bearer xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&quot;,
      },
      data: data,
    };
  
    axios(config)
      .then( async function (response) {
        console.log(JSON.stringify(response.data));
      //  await verifyTwoFactorAuth (realToken)
      })
      .catch(function (error) {
        console.log(error);
      });
  };
  </code></pre>
  <pre><code>const verifyTwoFactorAuth = async(req, res) =&gt; {
    //console.log(&quot;tet&quot;,req);
    
  
    let otpcode = req.body.otpcode;
    let mobile = req.body.mobile;
    var data = qs.stringify({ mobile: mobile, code: otpcode });
    var config = {
      method: &quot;POST&quot;,
      url: &quot;https://blablabla&quot;,
      headers: {
        Authorization: &quot;Bearer xxxxxxxxxxxxxxxxxxxxxxxx&quot;,
      },
      data: data,
    };
  
    axios(config)
      .then(async function (response) {
        console.log(JSON.stringify(response.data));
        if (response.data.code == 63 || response.data.status == 200) {
          return res.json({
            success: true,
            token,
          });
        } else if (response.data.code == 21 || response.data.status == 422) {
          return res.status(400).json({
            success: false,
            message: &quot;wrong code, check your sms again&quot;,
          });
        }
      })
      .catch(function (error) {
        console.log(error);
      });
  };
  </code></pre>
  <p>Hello, I am looking for a structure solution to how I should implement what I want.
  Scenario: user try to login, system checks for username and passoword and generates the TOKEN, system finds that 2fa is active in users settings, system sends OTP to users cellphone.</p>
  <p>Now my struggle begins, I am not sure what to do next, I thought about storing the token in users fields as tempToken then i look for the user via users mobile and extract the token that way, but I dont believe that this is best practice.</p>
  <p>Any ideas of how to tackle this would be appreciated ! thank you</p>