Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.

1 files changed, 13 insertions, 0 deletions

diff --git a/app/views/otp_challenges/new.html.erb b/app/views/otp_challenges/new.html.erb
new file mode 100644
index 00000000..a9c7a15c
--- /dev/null
+++ b/app/views/otp_challenges/new.html.erb
@@ -0,0 +1,13 @@
+<h1>Second factor</h1>
+
+<div id="page_editor">
+  <div class="node_description">Code</div>
+  <div class="node_content">
+    <%= form_tag otp_challenge_path, :method => :post do %>
+      <%= text_field_tag :code, nil, :autofocus => true,
+            :autocomplete => "one-time-code", :inputmode => "numeric" %>
+      <%= submit_tag "Log in" %>
+    <% end %>
+    <span class="field_hint">Enter the six-digit code from your authenticator app.</span>
+  </div>
+</div>