fix and update

apps/sso-core/src/domain/auth.service.ts

@@ -200,30 +200,23 @@ export class AuthService {
   async identify(login: string) {
     const user = await this.findUserByRecipient(login);
     const methods: Array<{ kind: string; channel: string; masked: string }> = [];
+    // Основные каналы (телефон/почта) — приоритетная доставка OTP по умолчанию.
     const otpChannels = user ? this.buildOtpChannels(user) : [];
+    // Резервные каналы — отдельный список, чтобы пользователь мог явно
+    // запросить код на резервный телефон/почту, но не получал его туда по умолчанию.
+    const otpBackupChannels = user ? this.buildOtpBackupChannels(user) : [];
 
     if (user?.passwordHash) {
       methods.push({ kind: 'password', channel: 'password', masked: 'Пароль' });
     }
 
-    if (user) {
-      const backupChannels: Array<{ channel: string; value: string | null }> = [
-        { channel: 'backupEmail', value: user.backupEmail },
-        { channel: 'backupPhone', value: user.backupPhone }
-      ];
-      for (const item of backupChannels) {
-        if (item.value) {
-          methods.push({ kind: 'otp', channel: item.channel, masked: this.maskTarget(item.value) });
-        }
-      }
-    }
-
     return {
       exists: Boolean(user),
       hasPassword: Boolean(user?.passwordHash),
       isPinEnabled: Boolean(user?.pinCode?.isEnabled),
       isTotpEnabled: user ? await this.totp.isEnabledForUser(user.id) : false,
       otpChannels,
+      otpBackupChannels,
       methods
     };
   }
@@ -357,6 +350,17 @@ export class AuthService {
     return channels;
   }
 
+  private buildOtpBackupChannels(user: { backupEmail: string | null; backupPhone: string | null }) {
+    const channels: Array<{ channel: string; masked: string }> = [];
+    if (user.backupEmail) {
+      channels.push({ channel: 'backupEmail', masked: this.maskTarget(user.backupEmail) });
+    }
+    if (user.backupPhone) {
+      channels.push({ channel: 'backupPhone', masked: this.maskTarget(user.backupPhone) });
+    }
+    return channels;
+  }
+
   private resolveOtpTarget(recipient: string, channel: string | undefined, user: { email: string | null; phone: string | null; backupEmail: string | null; backupPhone: string | null } | null) {
     if (!channel || channel === 'primary' || !user) return recipient;
     const map: Record<string, string | null> = {