2 files changed, 9 insertions, 4 deletions

diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb
index 04d8051f..668436b5 100644
--- a/lib/authenticated_system.rb
+++ b/lib/authenticated_system.rb
@@ -25,9 +25,10 @@ module AuthenticatedSystem
     # Tied to is_admin? so losing the role closes the window at once, rather
     # than leaving a timestamp that would count again if the role returned.
     def elevated?
-      return false unless current_user&.is_admin?
-      session[:elevated_at].to_i > ELEVATION_MAX_AGE.ago.to_i
-    end
+    return false unless current_user&.is_admin?
+    return false unless current_user.otp_enrolled?
+    session[:elevated_at].to_i > ELEVATION_MAX_AGE.ago.to_i
+  end
 
     def elevation_expires_at
       return nil unless elevated?
diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb
index 065a5f7d..483e6c88 100644
--- a/lib/authenticated_test_helper.rb
+++ b/lib/authenticated_test_helper.rb
@@ -6,6 +6,10 @@ module AuthenticatedTestHelper
   end
 
   def elevate_session!
-    session[:elevated_at] = Time.now.to_i
+    user = User.find_by(:id => @request.session[:user_id])
+    if user && !user.otp_enrolled?
+      user.update_column(:otp_secret, ROTP::Base32.random)
+    end
+    @request.session[:elevated_at] = Time.now.to_i
   end
 end