From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 13:53:13 +0200 Subject: Complete the login only after the second factor Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. --- app/controllers/sessions_controller.rb | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) (limited to 'app/controllers/sessions_controller.rb') diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb index 64bf951a..f0d5cf9b 100644 --- a/app/controllers/sessions_controller.rb +++ b/app/controllers/sessions_controller.rb @@ -20,9 +20,23 @@ class SessionsController < ApplicationController # button. Uncomment if you understand the tradeoffs. reset_session - self.current_user = user - redirect_to safe_return_to(return_to, :default => admin_path) - flash[:notice] = "Logged in successfully" + if user.otp_enrolled? + # Half-completed login: no user_id yet, only the pending marker. + session[:pending_otp_user_id] = user.id + session[:otp_deadline] = 2.minutes.from_now.to_i + session[:otp_attempts] = 0 + session[:return_to] = return_to + redirect_to new_otp_challenge_path + else + self.current_user = user + if user.otp_required? + flash[:error] = "Your account requires a second factor -- set it up now." + redirect_to edit_user_path(user) + else + flash[:notice] = "Logged in successfully" + redirect_to safe_return_to(return_to, :default => admin_path) + end + end else note_failed_signin @login = params[:login] -- cgit v1.3