summaryrefslogtreecommitdiff
path: root/test/controllers/otp_challenges_controller_test.rb
AgeCommit message (Collapse)Author
2026-07-24Complete the login only after the second factorerdgeist
Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery.