Require a fresh second factor for user management

Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.

elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.

users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.

5 files changed, 81 insertions, 1 deletions

diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb
index b841b8cc..22ce625e 100644
--- a/app/controllers/concerns/role_required.rb
+++ b/app/controllers/concerns/role_required.rb
@@ -20,4 +20,13 @@ module RoleRequired
       flash[:error] = t("flash.common.#{key}")
       redirect_to admin_path
     end
+
+    # require_admin must precede this in the filter chain, so a non-admin is
+    # denied by role before elevation is ever considered.
+    def require_elevation
+      return if elevated?
+
+      session[:elevation_return_to] = request.fullpath
+      redirect_to new_elevation_path
+    end
 end
diff --git a/app/controllers/elevations_controller.rb b/app/controllers/elevations_controller.rb
new file mode 100644
index 00000000..804b8f95
--- /dev/null
+++ b/app/controllers/elevations_controller.rb
@@ -0,0 +1,44 @@
+# Step-up authentication for janitorial work. Mirrors the two-step login's
+# attempt cap: verify_otp! guards replay but not rate, and an attacker with a
+# stolen cookie would otherwise have unlimited tries at a six-digit code.
+class ElevationsController < ApplicationController
+  include RoleRequired
+
+  layout 'admin'
+
+  before_action :login_required
+  before_action :require_admin
+
+  MAX_ATTEMPTS = 5
+
+  def new
+    redirect_to admin_path if elevated?
+  end
+
+  def create
+    return render(:new) unless current_user.otp_enrolled?
+
+    session[:elevation_attempts] = session[:elevation_attempts].to_i + 1
+    if session[:elevation_attempts] > MAX_ATTEMPTS
+      logout_killing_session!
+      flash[:error] = t("flash.otp.too_many_attempts")
+      return redirect_to(login_path)
+    end
+
+    if current_user.verify_otp!(params[:code])
+      session.delete(:elevation_attempts)
+      elevate!
+      redirect_to safe_return_to(session.delete(:elevation_return_to),
+                                 :default => users_path)
+    else
+      flash.now[:error] = t("flash.otp.code_mismatch")
+      render :new
+    end
+  end
+
+  def destroy
+    drop_elevation!
+    flash[:notice] = t("flash.elevation.dropped")
+    redirect_to admin_path
+  end
+end
diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
index eeaeac20..87586241 100644
--- a/app/controllers/otp_challenges_controller.rb
+++ b/app/controllers/otp_challenges_controller.rb
@@ -28,6 +28,9 @@ class OtpChallengesController < ApplicationController
       reset_session
       self.current_user = user
       session[:logged_in_at] = Time.now.to_i
+      # an admin who logs in and goes straight to user management
+      # is already elevated
+      elevate! if user.is_admin?
       flash[:notice] = t("flash.common.logged_in")
       redirect_to safe_return_to(return_to, :default => admin_path)
     else
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 052b2928..583ebac0 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -7,6 +7,7 @@ class UsersController < ApplicationController
   before_action :login_required
   before_action :find_user,     :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate]
   before_action :require_admin, :only => [:index, :new, :create, :reset_otp, :deactivate, :reactivate]
+  before_action :require_elevation, :only => [:new, :create, :reset_otp, :deactivate, :reactivate]
   before_action :verify_status, :except => [:index]
 
   layout 'admin'
@@ -87,7 +88,7 @@ class UsersController < ApplicationController
                                 :roles => [])
       # Checkbox arrays post a leading blank from the hidden field.
       permitted[:roles] = Array(permitted[:roles]).reject(&:blank?) if permitted.key?(:roles)
-      permitted.delete(:roles) unless current_user.is_admin?
+      permitted.delete(:roles) unless current_user.is_admin? && elevated?
       permitted
     end
 
diff --git a/app/views/elevations/new.html.erb b/app/views/elevations/new.html.erb
new file mode 100644
index 00000000..1091ff36
--- /dev/null
+++ b/app/views/elevations/new.html.erb
@@ -0,0 +1,23 @@
+<h1><%= t(".title") %></h1>
+
+<div id="admin_layout">
+  <% if current_user.otp_enrolled? %>
+    <p class="field_hint">
+      <%= t(".hint", :minutes => AuthenticatedSystem::ELEVATION_MAX_AGE.in_minutes.to_i) %>
+    </p>
+    <%= form_tag elevation_path do %>
+      <div class="layout_row_label"><%= t(".code") %></div>
+      <div class="layout_row_content">
+        <%= text_field_tag :code, nil, :autocomplete => "one-time-code",
+              :inputmode => "numeric", :autofocus => true %>
+      </div>
+      <div class="layout_row_label"></div>
+      <div class="layout_row_content"><%= submit_tag t(".elevate") %></div>
+    <% end %>
+  <% else %>
+    <%# An admin without an enrolled factor cannot elevate at all. Say so and
+        point at enrolment rather than showing a field that cannot work. %>
+    <p><%= t(".not_enrolled") %></p>
+    <%= link_to t(".enrol"), otp_enrollment_path, :class => "action_button" %>
+  <% end %>
+</div>