Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.

1 files changed, 13 insertions, 0 deletions

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index d8de9750..6d46d522 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -4,6 +4,7 @@ class ApplicationController < ActionController::Base
   protect_from_forgery
 
   before_action :set_locale
+  before_action :enforce_otp_enrollment
 
   helper_method :safe_return_to
 
@@ -30,4 +31,16 @@ class ApplicationController < ActionController::Base
   rescue URI::InvalidURIError
     default
   end
+
+  # The hard gate for the slow transition: a user flagged otp_required
+  # who has not enrolled can reach only enrollment, their own user page,
+  # the login machinery, and the challenge -- everything else funnels
+  # into setup. Anonymous visitors are untouched (not logged_in?).
+  def enforce_otp_enrollment
+    return unless logged_in?
+    return unless current_user.otp_required? && !current_user.otp_enrolled?
+    return if %w[otp_enrollments otp_challenges sessions users].include?(controller_name)
+    flash[:error] = "Your account requires a second factor -- set it up to continue."
+    redirect_to edit_user_path(current_user)
+  end
 end