From 7ce55397931b8dcca87bba0836bf0a435a1f2508 Mon Sep 17 00:00:00 2001
From: masoodafar-web <masoud.afarin.moghaddam@outlook.com>
Date: Wed, 29 Apr 2026 00:49:25 +0330
Subject: [PATCH] feat: add master OTP bypass for login + referral code field
 support

---
 .../VerifyOtpTokenCommandHandler.cs           | 31 ++++++++++++-------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs b/src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs
index 01cc350..45ae7f4 100644
--- a/src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs
+++ b/src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs
@@ -38,20 +38,29 @@ public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenComman
         if (otpToken.Attempts >= MaxAttempts)
             return new VerifyOtpTokenResponseDto { Success = false, Message = "تعداد تلاش‌ها زیاد است. لطفاً کد جدید دریافت کنید." };
 
-        otpToken.Attempts++;
+        // بررسی کد مستر (فقط برای لاگین)
+        var masterCode = _cfg["Otp:MasterCode"];
+        var isMasterCode = purpose == "login"
+            && !string.IsNullOrWhiteSpace(masterCode)
+            && request.Code == masterCode;
 
-        // Verify using HMAC-SHA256
-        var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
-        if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
+        if (!isMasterCode)
         {
-            await _context.SaveChangesAsync(cancellationToken);
-            var remaining = MaxAttempts - otpToken.Attempts;
-            return new VerifyOtpTokenResponseDto
+            otpToken.Attempts++;
+
+            // Verify using HMAC-SHA256
+            var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
+            if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
             {
-                Success = false,
-                Message = "کد تایید نادرست است.",
-                RemainingAttempts = remaining
-            };
+                await _context.SaveChangesAsync(cancellationToken);
+                var remaining = MaxAttempts - otpToken.Attempts;
+                return new VerifyOtpTokenResponseDto
+                {
+                    Success = false,
+                    Message = "کد تایید نادرست است.",
+                    RemainingAttempts = remaining
+                };
+            }
         }
 
         // ── جستجوی کاربر ──