From aecc051fcbfffbb53c03c1def79bcf291947d19f Mon Sep 17 00:00:00 2001
From: maliming <malimings@gmail.com>
Date: Tue, 15 Jul 2025 16:30:08 +0800
Subject: [PATCH] Add custom error codes for account lock and inactivity

---
 .../Volo/Abp/OpenIddict/AbpOpenIddictErrors.cs         |  8 ++++++++
 .../OpenIddict/Controllers/TokenController.Password.cs | 10 ++++------
 2 files changed, 12 insertions(+), 6 deletions(-)
 create mode 100644 modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictErrors.cs

diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictErrors.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictErrors.cs
new file mode 100644
index 0000000000..45422ad210
--- /dev/null
+++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/AbpOpenIddictErrors.cs
@@ -0,0 +1,8 @@
+namespace Volo.Abp.OpenIddict;
+
+public static class AbpOpenIddictErrors
+{
+    public const string AccountLocked = "account_locked";
+
+    public const string AccountInactive = "account_inactive";
+}
diff --git a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
index 91cb57cdb4..5059c7c5ca 100644
--- a/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
+++ b/modules/openiddict/src/Volo.Abp.OpenIddict.AspNetCore/Volo/Abp/OpenIddict/Controllers/TokenController.Password.cs
@@ -107,14 +107,14 @@ public partial class TokenController
                         ClientId = request.ClientId
                     });
 
+                    var errorCode = OpenIddictConstants.Errors.InvalidGrant;
                     string errorDescription;
-                    string errorCode;
-                    
+
                     if (result.IsLockedOut)
                     {
                         Logger.LogInformation("Authentication failed for username: {username}, reason: locked out", request.Username);
+                        errorCode = AbpOpenIddictErrors.AccountLocked;
                         errorDescription = "The user account has been locked out due to invalid login attempts. Please wait a while and try again.";
-                        errorCode = "account_locked";
                     }
                     else if (result.IsNotAllowed)
                     {
@@ -127,7 +127,6 @@ public partial class TokenController
                         {
                             Logger.LogInformation("Authentication failed for username: {username}, reason: not allowed", request.Username);
 
-
                             if (user.ShouldChangePasswordOnNextLogin)
                             {
                                 return await HandleShouldChangePasswordOnNextLoginAsync(request, user, request.Password);
@@ -143,15 +142,14 @@ public partial class TokenController
                                 return await HandleConfirmUserAsync(request, user);
                             }
 
+                            errorCode = AbpOpenIddictErrors.AccountInactive;
                             errorDescription = "You are not allowed to login! Your account is inactive or needs to confirm your email/phone number.";
-                            errorCode = "account_inactive";
                         }
                     }
                     else
                     {
                         Logger.LogInformation("Authentication failed for username: {username}, reason: invalid credentials", request.Username);
                         errorDescription = "Invalid username or password!";
-                        errorCode = OpenIddictConstants.Errors.InvalidGrant;
                     }
 
                     var properties = new AuthenticationProperties(new Dictionary<string, string>