From fefec929c59c72dc93e4be30e8f23cd8c5258b0a Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 24 Jul 2026 13:52:56 +0200
Subject: Add self-service TOTP enrollment UI and witnessed admin reset

---
 app/views/otp_enrollments/show.html.erb | 23 +++++++++++++++++++++++
 app/views/users/edit.html.erb           | 30 ++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+)
 create mode 100644 app/views/otp_enrollments/show.html.erb

(limited to 'app/views')

diff --git a/app/views/otp_enrollments/show.html.erb b/app/views/otp_enrollments/show.html.erb
new file mode 100644
index 00000000..9dfa3422
--- /dev/null
+++ b/app/views/otp_enrollments/show.html.erb
@@ -0,0 +1,23 @@
+<h1>Enable second factor</h1>
+
+<div id="page_editor">
+  <div class="node_description">Scan</div>
+  <div class="node_content">
+    <%= raw RQRCode::QRCode.new(current_user.pending_otp_provisioning_uri)
+              .as_svg(:module_size => 4, :viewbox => true,
+                      :color => "000", :fill => "fff") %>
+    <span class="field_hint">Or enter the secret manually:
+      <code><%= current_user.otp_pending_secret %></code></span>
+  </div>
+
+  <div class="node_description">Confirm</div>
+  <div class="node_content">
+    <%= form_tag otp_enrollment_path, :method => :put do %>
+      <%= text_field_tag :code, nil, :autofocus => true,
+            :autocomplete => "one-time-code", :inputmode => "numeric" %>
+      <%= submit_tag "Confirm" %>
+    <% end %>
+    <span class="field_hint">Enter the six-digit code your app shows
+      for “<%= OTP_ISSUER %>”.</span>
+  </div>
+</div>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
index 77b33c6a..8d14a058 100644
--- a/app/views/users/edit.html.erb
+++ b/app/views/users/edit.html.erb
@@ -30,4 +30,34 @@
     <div class="node_content"><%= f.submit "Update" %></div>
   <% end %>
   </div>
+
+  <% if @user == current_user %>
+    <div class="node_description">Second factor</div>
+    <div class="node_content">
+      <% if current_user.otp_enrolled? %>
+        <p>Enabled.</p>
+        <%= form_tag otp_enrollment_path, :method => :delete do %>
+          <%= password_field_tag :current_password, nil, :placeholder => "Current password" %>
+          <%= text_field_tag :code, nil, :placeholder => "Current code",
+                :autocomplete => "one-time-code", :inputmode => "numeric" %>
+          <%= submit_tag "Disable second factor" %>
+        <% end %>
+      <% else %>
+        <p>Not enrolled.</p>
+        <%= form_tag otp_enrollment_path, :method => :post do %>
+          <%= password_field_tag :current_password, nil, :placeholder => "Current password" %>
+          <%= submit_tag "Enable second factor" %>
+        <% end %>
+      <% end %>
+    </div>
+  <% elsif current_user.admin? && @user.otp_enrolled? %>
+    <div class="node_description">Second factor</div>
+    <div class="node_content">
+      Enabled.
+      <%= button_to "Reset second factor", reset_otp_user_path(@user), :method => :put,
+            :form_class => "button_to destructive",
+            :form => { :data => { :confirm =>
+              "Reset #{@user.login}'s second factor? They will log in with password only afterwards." } } %>
+    </div>
+  <% end %>
 </div>
-- 
cgit v1.3