From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 13:53:13 +0200 Subject: Complete the login only after the second factor Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. --- test/controllers/admin_controller_test.rb | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'test/controllers/admin_controller_test.rb') diff --git a/test/controllers/admin_controller_test.rb b/test/controllers/admin_controller_test.rb index cba4a59b..a177851f 100644 --- a/test/controllers/admin_controller_test.rb +++ b/test/controllers/admin_controller_test.rb @@ -38,4 +38,11 @@ class AdminControllerTest < ActionController::TestCase assert_equal [], json["tags"] assert_equal [], json["nodes"] end + + test "otp_required users without enrollment are funneled to setup" do + users(:quentin).update!(:otp_required => true) + login_as :quentin + get :index + assert_redirected_to edit_user_path(users(:quentin)) + end end -- cgit v1.3