title OAuth 2 flow with 2-Factor Authentication

participant User
participant MIS
participant Auth
participant IL

User->MIS: Request login
MIS->Auth: <<Redirect to login page using {client_id}>>
Auth->Auth: Check whether MSP is not blocked 

alt MSP is active
    Auth-->User: <<Login page>>
else MSP is blocked
    Auth-->User: <<Respond with `Authentication failed`>>
end

User->+Auth: Username/Password
alt Authentication {Username/Password} successful
    Auth->Auth: Authenticate user {Username/Password}
    alt 2FA enable
         Auth-->MIS: <<Callback with {2fa_access_token}>>
         Auth-->User: <<Sens OTP via SMS>>
         Auth-->-User: <<Verifying OTP page>>
         User->Auth: OTP
         Auth->Auth: Authenticate user {OTP}
         alt  Authentication successful
            Auth->Auth: Change {2fa_access_token} on {access_token} 
            Auth-->MIS: <<Callback with {access_token}>>
         else OTP Invalid
             opt 
                Auth->Auth: Block user
            end opt
            Auth-->User: <<Respond with `Authentication failed`>>
         end
    else 2FA reset
         Auth-->User: <<Request factor page>>
         User->+Auth: Factor
         Auth-->User: <<Sens OTP via SMS>>
         Auth-->-User: <<Approve factor page>>
         User->Auth: OTP
         Auth->Auth: Authenticate user {OTP}
         alt  Authentication successful
            Auth->Auth: Change {2fa_access_token} on {access_token} 
            Auth-->MIS: <<Callback with {access_token}>>
         else OTP Invalid
             opt 
                Auth->Auth: Block user
            end opt
            Auth-->User: <<Respond with `Authentication failed`>>
         end
    else 2FA disable
        Auth-->MIS: <<Callback with {acess_token}>>
    end
else Password invalid
    Auth-->User: <<Respond with `Authentication failed`>>
    opt 
        Auth->Auth: Block user
    end opt
end

alt Authentication successful
    Auth-->MIS: <<Callback with {code_grant}>>
    MIS->Auth: <<Exchange {code_grant} to {acess_token} using client_secret>>
    Auth-->MIS: <<Respond with {access_token}>>
    MIS->IL: <<Request contexts>>
    IL-->MIS: <<Respond with [contexts]>>
    opt Select context
        MIS->User: Show contexts
        User->MIS: Context
    end opt
    MIS->Auth: <<Exchange {acess_token} and {context} to {access_token}>>
    Auth->Auth: Authenticate and refresh token
    Auth-->MIS: <<Respond with {access_token}>>
    opt Change factor proccess
        User->Auth: Request for change factor
    end opt
else Authentication failed
    Auth-->MIS: <<Unathorized>>