From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 13:53:13 +0200 Subject: Complete the login only after the second factor Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. --- app/controllers/application_controller.rb | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'app/controllers/application_controller.rb') diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index d8de9750..6d46d522 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -4,6 +4,7 @@ class ApplicationController < ActionController::Base protect_from_forgery before_action :set_locale + before_action :enforce_otp_enrollment helper_method :safe_return_to @@ -30,4 +31,16 @@ class ApplicationController < ActionController::Base rescue URI::InvalidURIError default end + + # The hard gate for the slow transition: a user flagged otp_required + # who has not enrolled can reach only enrollment, their own user page, + # the login machinery, and the challenge -- everything else funnels + # into setup. Anonymous visitors are untouched (not logged_in?). + def enforce_otp_enrollment + return unless logged_in? + return unless current_user.otp_required? && !current_user.otp_enrolled? + return if %w[otp_enrollments otp_challenges sessions users].include?(controller_name) + flash[:error] = "Your account requires a second factor -- set it up to continue." + redirect_to edit_user_path(current_user) + end end -- cgit v1.3