Request parameters

• token
• client_id
• redirect_uri
• scope

Logic WS

• Validate $.token
• Get token by $.token
• Extract token_type, user_id
• Get user by user_id
• Validate user id & user status
• Validate user `is_blocked` flag
  • if is_blocked = TRUE
  • return 4xx - "User blocked"  (!!! TBD)

• Get active 2FA item for non-blocked user by $.user_id

  SELECT *
  FROM authentication_factors AS 2FA
  	INNER JOIN user AS U
  		ON 2FA.user_id = U.id
  WHERE 
  	U.id = $.user_id
  		AND U.is_active = TRUE
  		AND U.is_blocked = FALSE
  		AND 2FA.is_active = TRUE

  • If  not exist 2FA active item for user
    • If token_type = access_token - go to standard process create Approvals & return changed token (existing logic)
    • At any token_type - return 4xx error "" !!! TBD
  • If exist active 2FA
    • if token_type = access_token  - go to standard process create Approvals & return changed token (existing logic)
    • If token_type = 2fa_access_token - return 401 error

Response

• 201 if token is correct & user grants approvals successful 
• 4xx in other case