cccms/test/controllers/otp_challenges_controller_test.rb, branch master[no description]http://erdgeist.org/gitweb/cccms/atom?h=master2026-07-24T11:53:13ZComplete the login only after the second factor2026-07-24T11:53:13Zerdgeisterdgeist@erdgeist.org2026-07-24T11:53:13Zurn:sha1:dcb576618b868b888a5b1b31e35491f300ce4050
Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.