Require a second factor for elevation, not for holding admin

1 files changed, 5 insertions, 1 deletions

diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb
index 065a5f7d..483e6c88 100644
--- a/lib/authenticated_test_helper.rb
+++ b/lib/authenticated_test_helper.rb
@@ -6,6 +6,10 @@ module AuthenticatedTestHelper
   end
 
   def elevate_session!
-    session[:elevated_at] = Time.now.to_i
+    user = User.find_by(:id => @request.session[:user_id])
+    if user && !user.otp_enrolled?
+      user.update_column(:otp_secret, ROTP::Base32.random)
+    end
+    @request.session[:elevated_at] = Time.now.to_i
   end
 end