cccms/app/controllers/otp_challenges_controller.rb, branch master[no description]http://erdgeist.org/gitweb/cccms/atom?h=master2026-08-02T21:55:38ZLog user logins and reconstruct last activity from logs2026-08-02T21:55:38Zerdgeisterdgeist@erdgeist.org2026-08-02T21:55:38Zurn:sha1:c63c4620d1c659712cec93e354e84f5017bd6254Show and extend the elevation window2026-08-01T00:39:59Zerdgeisterdgeist@erdgeist.org2026-08-01T00:39:59Zurn:sha1:6df48c1413a14516e7ee8919f33fbc13f0141966
A banner appears while elevated, counting down in minutes and carrying
extend and drop controls. Three extensions of 30 minutes are allowed, so
the window is at most two hours without a fresh code; a code resets the
budget. The countdown is advisory, the server-side check authoritative, so
it says "expired" rather than vanishing.
The post-login flash tells an admin the timer has started.
Require a fresh second factor for user management2026-07-31T23:10:35Zerdgeisterdgeist@erdgeist.org2026-07-31T23:10:35Zurn:sha1:f6c1f0f08f031778a491465d35ac694bfcdc12b0
Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.
elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.
users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.
Extract flashes to i18n and stop dispatching on submit labels2026-07-25T01:51:44Zerdgeisterdgeist@erdgeist.org2026-07-25T01:51:44Zurn:sha1:baace1fa5df46694ddd515dc3bbca59b22df8692Give all sessions a uniform absolute lifetime of one week2026-07-24T15:20:41Zerdgeisterdgeist@erdgeist.org2026-07-24T15:20:41Zurn:sha1:d5883869e97244335370d54e21ef46b3f1885899
Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.
Complete the login only after the second factor2026-07-24T11:53:13Zerdgeisterdgeist@erdgeist.org2026-07-24T11:53:13Zurn:sha1:dcb576618b868b888a5b1b31e35491f300ce4050
Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.