From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Fri, 24 Jul 2026 13:53:13 +0200 Subject: Complete the login only after the second factor Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery. --- test/controllers/sessions_controller_test.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'test/controllers/sessions_controller_test.rb') diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb index a5f511f5..62acd28a 100644 --- a/test/controllers/sessions_controller_test.rb +++ b/test/controllers/sessions_controller_test.rb @@ -23,4 +23,19 @@ class SessionsControllerTest < ActionController::TestCase assert_nil session[:user_id] assert_response :redirect end + + test "login with password only is withheld for enrolled users" do + users(:quentin).update!(:otp_secret => ROTP::Base32.random) + post :create, params: { login: 'quentin', password: 'monkey' } + assert_nil session[:user_id] + assert_equal users(:quentin).id, session[:pending_otp_user_id] + assert_redirected_to new_otp_challenge_path + end + + test "otp_required without enrollment logs in but funnels into setup" do + users(:quentin).update!(:otp_required => true) + post :create, params: { login: 'quentin', password: 'monkey' } + assert session[:user_id] + assert_redirected_to edit_user_path(users(:quentin)) + end end -- cgit v1.3