From f6c1f0f08f031778a491465d35ac694bfcdc12b0 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 1 Aug 2026 01:10:35 +0200
Subject: Require a fresh second factor for user management

Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.

elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.

users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.
---
 test/controllers/users_controller_test.rb | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

(limited to 'test/controllers/users_controller_test.rb')

diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index fe099928..b6f0970d 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -19,6 +19,7 @@ class UsersControllerTest < ActionController::TestCase
  
   test "get new when logged in as admin" do
     login_as :aaron
+    elevate_session!
     get :new
     assert_response :success
   end
@@ -36,6 +37,7 @@ class UsersControllerTest < ActionController::TestCase
   
   test "creating new users being logged in as admin" do
     login_as :aaron
+    elevate_session!
     assert_difference "User.count", +1 do
       post :create, params: {
         :user => {
@@ -53,6 +55,7 @@ class UsersControllerTest < ActionController::TestCase
   
   test "creating new admin users being logged in as admin" do
     login_as :aaron
+    elevate_session!
     assert_difference "User.count", +1 do
       post :create, params: {
         :user => {
@@ -154,6 +157,7 @@ class UsersControllerTest < ActionController::TestCase
   
   test "an admin deactivates another user, who can no longer sign in" do
     login_as :aaron
+    elevate_session!
     user = users(:quentin)
 
     put :deactivate, params: { :id => user.id }
@@ -165,6 +169,7 @@ class UsersControllerTest < ActionController::TestCase
 
   test "reactivation restores the other roles untouched" do
     login_as :aaron
+    elevate_session!
     user = users(:quentin)
     user.update_column(:roles, ["alumni", "redaktion"])
 
@@ -189,6 +194,7 @@ class UsersControllerTest < ActionController::TestCase
   
   test "admin user can promote regular users to admins" do
     login_as :aaron
+    elevate_session!
     user = users(:quentin)
     put :update, params: { :id => user.id, :user => {:roles => ["admin", "redaktion"]} }
     
@@ -212,6 +218,7 @@ class UsersControllerTest < ActionController::TestCase
     assert user.reload.otp_enrolled?, "non-admin must be refused"
 
     login_as :aaron
+    elevate_session!
     put :reset_otp, params: { :id => user.id }
     assert_not user.reload.otp_enrolled?
     assert_equal "otp_reset", NodeAction.last.action
@@ -239,4 +246,19 @@ class UsersControllerTest < ActionController::TestCase
     get :show, params: { :id => users(:aaron).id }
     assert_redirected_to admin_path
   end
+
+  test "an admin without an open window is sent to elevation" do
+    login_as :aaron
+    get :new
+    assert_redirected_to new_elevation_path
+  end
+
+  test "an unelevated admin cannot change roles" do
+    login_as :aaron
+    user = users(:quentin)
+
+    put :update, params: { :id => user.id, :user => { :roles => ["admin"] } }
+
+    assert_not user.reload.is_admin?
+  end
 end
-- 
cgit v1.3