Require a second factor for elevation, not for holding admin

1 files changed, 1 insertions, 0 deletions

diff --git a/app/models/user.rb b/app/models/user.rb
index c3035a02..4b70ebe5 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -242,6 +242,7 @@ class User < ApplicationRecord
     def admin_needs_second_factor
       return unless roles.include?("admin")
       return if otp_secret.present?
+      return if persisted? && roles_in_database.to_a.include?("admin")
       errors.add(:roles, :admin_needs_otp)
     end
 end