Problem structuring two factor authentication

Question

const login = (req, res) => {
  // console.log(req.body);
  // let email = req.body.email.toLowerCase();
  sequelize.models.User.findOne({
    where: {
      email: req.body.email,
    },
  })
    .then(async (user) => {
      if (!user) {
        // console.log(" email not found  is true");
        return res.status(401).json({
          success: false,
          message: " Authentication failed, Wrong Credentials",
        });
      }
      if (user.isActive == false) {
        // console.log("user is not activated", user.isActive);
        return res.status(400).json({
          success: false,
          message: "account is not activated",
        });
      }

      console.log("test entry");
      await user.comparePassword(req.body.password, async (err, isMatch) => {
        console.log(req.body.password);
        if (isMatch && !err) {
          console.log("user crap");
          //  role_id: user.role_id,
          const payload = {
            user_id: user.user_id,
          };
          const options = {
            expiresIn: "10day",
          };
          const token = await jwt.sign(payload, process.env.SECRET, options);
          console.log("sssssss", payload);
          if (user.twoFactorAuth == false) {
            return res.json({
              success: true,
              token,
            });
          } else {
            // let mobile = user.phone;
            await twoFactorAuth(user); // we call the 2fa that will send a otp to the users cellphone
            // console.log("after cb");
          }
        } else {
          return res.json({
            success: false,
            msg: "Authentication failed.",
          });
        }
      });

      // console.log("user crap", user.user_id);
    })
    .catch((error) => {
      return res.status(400).send(error);
    });
};

const twoFactorAuth = async (user) => {
  var data = qs.stringify({
    sender: "hehe",
    mobile: user.phone,
    channel: "sms",
  });
  var config = {
    method: "POST",
    url: "https://blablabla",
    headers: {
      Authorization: "Bearer xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
    },
    data: data,
  };

  axios(config)
    .then( async function (response) {
      console.log(JSON.stringify(response.data));
    //  await verifyTwoFactorAuth (realToken)
    })
    .catch(function (error) {
      console.log(error);
    });
};

const verifyTwoFactorAuth = async(req, res) => {
  //console.log("tet",req);
  

  let otpcode = req.body.otpcode;
  let mobile = req.body.mobile;
  var data = qs.stringify({ mobile: mobile, code: otpcode });
  var config = {
    method: "POST",
    url: "https://blablabla",
    headers: {
      Authorization: "Bearer xxxxxxxxxxxxxxxxxxxxxxxx",
    },
    data: data,
  };

  axios(config)
    .then(async function (response) {
      console.log(JSON.stringify(response.data));
      if (response.data.code == 63 || response.data.status == 200) {
        return res.json({
          success: true,
          token,
        });
      } else if (response.data.code == 21 || response.data.status == 422) {
        return res.status(400).json({
          success: false,
          message: "wrong code, check your sms again",
        });
      }
    })
    .catch(function (error) {
      console.log(error);
    });
};

Hello, I am looking for a structure solution to how I should implement what I want. Scenario: user try to login, system checks for username and passoword and generates the TOKEN, system finds that 2fa is active in users settings, system sends OTP to users cellphone.

Now my struggle begins, I am not sure what to do next, I thought about storing the token in users fields as tempToken then i look for the user via users mobile and extract the token that way, but I dont believe that this is best practice.

Any ideas of how to tackle this would be appreciated ! thank you