classDiagram
    class MFAVerifyRequest {
        +str otp_code
    }

    class MFAVerifyResponse {
        +bool verified
        +int expires_in
    }

    class MFAVerifyBindResponse {
        +bool verified
        +int expires_in
        +str token
        +str user_id
        +str name
        +str role
    }

    class MFABindStartResponse {
        +str secret
        +str otpauth_url
        +str qr_code_base64
    }

    class MFAStatusResponse {
        +bool bound
        +bool enabled
        +datetime last_verified_at
    }

    MFAVerifyRequest --> MFAVerifyResponse : "mfa_enabled=True → 仅验证"
    MFAVerifyRequest --> MFAVerifyBindResponse : "mfa_enabled=False → 绑定+签发token"