Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.

1 files changed, 7 insertions, 0 deletions

diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb
index cba4a59b..a177851f 100644
--- a/test/controllers/admin_controller_test.rb
+++ b/test/controllers/admin_controller_test.rb
@@ -38,4 +38,11 @@ class AdminControllerTest < ActionController::TestCase
     assert_equal [], json["tags"]
     assert_equal [], json["nodes"]
   end
+
+  test "otp_required users without enrollment are funneled to setup" do
+    users(:quentin).update!(:otp_required => true)
+    login_as :quentin
+    get :index
+    assert_redirected_to edit_user_path(users(:quentin))
+  end
 end