1 files changed, 17 insertions, 3 deletions

diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 64bf951a..f0d5cf9b 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -20,9 +20,23 @@ class SessionsController < ApplicationController
       # button. Uncomment if you understand the tradeoffs.
       reset_session
       
-      self.current_user = user
-      redirect_to safe_return_to(return_to, :default => admin_path)
-      flash[:notice] = "Logged in successfully"
+      if user.otp_enrolled?
+        # Half-completed login: no user_id yet, only the pending marker.
+        session[:pending_otp_user_id] = user.id
+        session[:otp_deadline]        = 2.minutes.from_now.to_i
+        session[:otp_attempts]        = 0
+        session[:return_to]           = return_to
+        redirect_to new_otp_challenge_path
+      else
+        self.current_user = user
+        if user.otp_required?
+          flash[:error] = "Your account requires a second factor -- set it up now."
+          redirect_to edit_user_path(user)
+        else
+          flash[:notice] = "Logged in successfully"
+          redirect_to safe_return_to(return_to, :default => admin_path)
+        end
+      end
     else
       note_failed_signin
       @login = params[:login]