From e3f87382a34dd469a14c5c5a80abaa0f52b60c36 Mon Sep 17 00:00:00 2001
From: Maidul Islam <maidul98@gmail.com>
Date: Mon, 10 Jun 2024 21:16:31 -0400
Subject: [PATCH] rephrase comment and error message

---
 backend/src/services/auth/auth-login-service.ts | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/backend/src/services/auth/auth-login-service.ts b/backend/src/services/auth/auth-login-service.ts
index 8778e0a6c..27cec06ff 100644
--- a/backend/src/services/auth/auth-login-service.ts
+++ b/backend/src/services/auth/auth-login-service.ts
@@ -554,11 +554,16 @@ export const authLoginServiceFactory = ({
     return { isUserCompleted, providerAuthToken };
   };
 
-  // to login users with oauth2 token used for private key handoff
-  // The provider token will be given back to client to send back infisical access token
-  // why not directly sending access token?
-  // 1. To keep the logic change easier from SRP oauth to simple oauth
-  // 2. I don't want to attach access token to url as it may get logged the provider token has very short life span
+  /**
+   * Handles OAuth2 token exchange for user login with private key handoff.
+   *
+   * The process involves exchanging a provider's authorization token for an Infisical access token.
+   * The provider token is returned to the client, who then sends it back to obtain the Infisical access token.
+   *
+   * This approach is used instead of directly sending the access token for the following reasons:
+   * 1. To facilitate easier logic changes from SRP OAuth to simple OAuth.
+   * 2. To avoid attaching the access token to the URL, which could be logged. The provider token has a very short lifespan, reducing security risks.
+   */
   const oauth2TokenExchange = async ({ userAgent, ip, providerAuthToken, email }: TOauthTokenExchangeDTO) => {
     const decodedProviderToken = validateProviderAuthToken(providerAuthToken, email);
 
@@ -575,7 +580,7 @@ export const authLoginServiceFactory = ({
     });
     if (!userEnc) throw new BadRequestError({ message: "Invalid token" });
     if (!userEnc.serverEncryptedPrivateKey)
-      throw new BadRequestError({ message: "Private key handoff needs to be done" });
+      throw new BadRequestError({ message: "Key handoff incomplete. Please try logging in again." });
     // send multi factor auth token if they it enabled
     if (userEnc.isMfaEnabled && userEnc.email) {
       enforceUserLockStatus(Boolean(userEnc.isLocked), userEnc.temporaryLockDateEnd);