Show and extend the elevation window

A banner appears while elevated, counting down in minutes and carrying
extend and drop controls. Three extensions of 30 minutes are allowed, so
the window is at most two hours without a fresh code; a code resets the
budget. The countdown is advisory, the server-side check authoritative, so
it says "expired" rather than vanishing.

The post-login flash tells an admin the timer has started.

1 files changed, 6 insertions, 1 deletions

diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index 87586241..2526d1fb 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -31,7 +31,12 @@ class OtpChallengesController < ApplicationController
       # an admin who logs in and goes straight to user management
       # is already elevated
       elevate! if user.is_admin?
-      flash[:notice] = t("flash.common.logged_in")
+      flash[:notice] = if user.is_admin?
+        t("flash.elevation.granted_at_login",
+          :minutes => AuthenticatedSystem::ELEVATION_MAX_AGE.in_minutes.to_i)
+      else
+        t("flash.common.logged_in")
+      end
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
       flash.now[:error] = t("flash.otp.code_mismatch")