Add MFA status to all token responses

- Add MFA field to ExternalToken base class with UNKNOWN default
- Remove duplicate MFA handling from APIToken (now inherited)
- Ensures all token endpoints return MFA status for UI compatibility
- Non-ORCID providers default to MFA status UNKNOWN

Author: dauglyon

src/main/java/us/kbase/auth2/service/api/APIToken.java

@@ -1,41 +1,28 @@
 package us.kbase.auth2.service.api;
 
 import us.kbase.auth2.lib.token.StoredToken;
-import us.kbase.auth2.lib.identity.MfaStatus;
 import us.kbase.auth2.service.common.ExternalToken;
 
 public class APIToken extends ExternalToken {
 
 	//TODO JAVADOC or swagger
 
 	private final long cachefor;
-	private final MfaStatus mfa;
 
 	public APIToken(final StoredToken token, final long tokenCacheTimeMillis) {
 		super(token);
 		cachefor = tokenCacheTimeMillis;
-		mfa = token.getMfa();
 	}
 
 	public long getCachefor() {
 		return cachefor;
 	}
-	
-	/**
-	 * Gets the MFA authentication status for this token.
-	 * 
-	 * @return the MFA authentication status.
-	 */
-	public MfaStatus getMfa() {
-		return mfa;
-	}
 
 	@Override
 	public int hashCode() {
 		final int prime = 31;
 		int result = super.hashCode();
 		result = prime * result + (int) (cachefor ^ (cachefor >>> 32));
-		result = prime * result + ((mfa == null) ? 0 : mfa.name().hashCode());
 		return result;
 	}
 
@@ -51,13 +38,6 @@ public boolean equals(Object obj) {
 		if (cachefor != other.cachefor) {
 			return false;
 		}
-		if (mfa == null) {
-			if (other.mfa != null) {
-				return false;
-			}
-		} else if (!mfa.equals(other.mfa)) {
-			return false;
-		}
 		return true;
 	}
 

src/main/java/us/kbase/auth2/service/common/ExternalToken.java

@@ -4,6 +4,7 @@
 
 import java.util.Map;
 
+import us.kbase.auth2.lib.identity.MfaStatus;
 import us.kbase.auth2.lib.token.StoredToken;
 
 public class ExternalToken {
@@ -17,6 +18,7 @@ public class ExternalToken {
 	private final String name;
 	private final String user;
 	private final Map<String, String> custom;
+	private final MfaStatus mfa;
 
 	public ExternalToken(final StoredToken storedToken) {
 		requireNonNull(storedToken, "storedToken");
@@ -28,6 +30,8 @@ public ExternalToken(final StoredToken storedToken) {
 		expires = storedToken.getExpirationDate().toEpochMilli();
 		created = storedToken.getCreationDate().toEpochMilli();
 		custom = storedToken.getContext().getCustomContext();
+		// For tokens from non-ORCID providers, MFA status defaults to UNKNOWN
+		mfa = storedToken.getMfa() != null ? storedToken.getMfa() : MfaStatus.UNKNOWN;
 	}
 
 	public String getType() {
@@ -58,6 +62,16 @@ public Map<String, String> getCustom() {
 		return custom;
 	}
 
+	/**
+	 * Gets the MFA authentication status for this token.
+	 * Returns UNKNOWN for tokens from identity providers that don't support MFA.
+	 * 
+	 * @return the MFA authentication status.
+	 */
+	public MfaStatus getMfa() {
+		return mfa;
+	}
+
 	@Override
 	public int hashCode() {
 		final int prime = 31;
@@ -66,6 +80,7 @@ public int hashCode() {
 		result = prime * result + ((custom == null) ? 0 : custom.hashCode());
 		result = prime * result + (int) (expires ^ (expires >>> 32));
 		result = prime * result + ((id == null) ? 0 : id.hashCode());
+		result = prime * result + ((mfa == null) ? 0 : mfa.name().hashCode());
 		result = prime * result + ((name == null) ? 0 : name.hashCode());
 		result = prime * result + ((type == null) ? 0 : type.hashCode());
 		result = prime * result + ((user == null) ? 0 : user.hashCode());
@@ -125,6 +140,13 @@ public boolean equals(Object obj) {
 		} else if (!user.equals(other.user)) {
 			return false;
 		}
+		if (mfa == null) {
+			if (other.mfa != null) {
+				return false;
+			}
+		} else if (!mfa.equals(other.mfa)) {
+			return false;
+		}
 		return true;
 	}
 }