Add self-service TOTP enrollment UI and witnessed admin reset

1 files changed, 8 insertions, 1 deletions

diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 6572b7a2..08541b0c 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -3,7 +3,7 @@ class UsersController < ApplicationController
   # Private
 
   before_action :login_required
-  before_action :find_user,     :only => [:show, :edit, :update, :destroy]
+  before_action :find_user,     :only => [:show, :edit, :update, :destroy, :reset_otp]
   before_action :verify_status, :except => [:index, :show]
 
   layout 'admin'
@@ -52,6 +52,13 @@ class UsersController < ApplicationController
     redirect_to users_path
   end
 
+  def reset_otp
+    return deny_user_access unless current_user.admin?
+    @user.disable_otp!(:actor => current_user)
+    flash[:notice] = "Second factor reset for #{@user.login}"
+    redirect_to edit_user_path(@user)
+  end
+
   private
 
     def user_params