blob: 6d46d522be69888279c3d25a6b420d4f2b2bb73a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
|
class ApplicationController < ActionController::Base
include AuthenticatedSystem
protect_from_forgery
before_action :set_locale
before_action :enforce_otp_enrollment
helper_method :safe_return_to
protected
def set_locale
if params[:locale] && I18n.available_locales.include?(params[:locale].to_sym)
I18n.locale = params[:locale].to_sym
else
I18n.locale = I18n.default_locale
end
end
def default_url_options
{ locale: I18n.locale == I18n.default_locale ? nil : I18n.locale }
end
def safe_return_to(url, default: events_path)
return default if url.blank?
uri = URI.parse(url)
return default if uri.host.present?
return default unless url.start_with?('/')
url
rescue URI::InvalidURIError
default
end
# The hard gate for the slow transition: a user flagged otp_required
# who has not enrolled can reach only enrollment, their own user page,
# the login machinery, and the challenge -- everything else funnels
# into setup. Anonymous visitors are untouched (not logged_in?).
def enforce_otp_enrollment
return unless logged_in?
return unless current_user.otp_required? && !current_user.otp_enrolled?
return if %w[otp_enrollments otp_challenges sessions users].include?(controller_name)
flash[:error] = "Your account requires a second factor -- set it up to continue."
redirect_to edit_user_path(current_user)
end
end
|
