Require a fresh second factor for user management

Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.

elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.

users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.

2 files changed, 29 insertions, 2 deletions

diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb
index 4e70c28d..9a351dde 100644
--- a/lib/authenticated_system.rb
+++ b/lib/authenticated_system.rb
@@ -1,5 +1,6 @@
 module AuthenticatedSystem
   SESSION_MAX_AGE = 7.days
+  ELEVATION_MAX_AGE = 30.minutes
 
   protected
     # Returns true or false if the user is logged in.
@@ -20,6 +21,26 @@ module AuthenticatedSystem
       @current_user = new_user || false
     end
 
+    # Tied to is_admin? so losing the role closes the window at once, rather
+    # than leaving a timestamp that would count again if the role returned.
+    def elevated?
+      return false unless current_user&.is_admin?
+      session[:elevated_at].to_i > ELEVATION_MAX_AGE.ago.to_i
+    end
+
+    def elevation_expires_at
+      return nil unless elevated?
+      Time.at(session[:elevated_at].to_i) + ELEVATION_MAX_AGE
+    end
+
+    def elevate!
+      session[:elevated_at] = Time.now.to_i
+    end
+
+    def drop_elevation!
+      session.delete(:elevated_at)
+    end
+
     # Check if the user is authorized
     #
     # Override this method in your controllers if you want to restrict access
@@ -91,7 +112,8 @@ module AuthenticatedSystem
     # Inclusion hook to make #current_user and #logged_in?
     # available as ActionView helper methods.
     def self.included(base)
-      base.send :helper_method, :current_user, :logged_in?, :authorized? if base.respond_to? :helper_method
+      base.send :helper_method, :current_user, :logged_in?, :authorized?,
+                :elevated?, :elevation_expires_at if base.respond_to? :helper_method
     end
 
     #
@@ -123,7 +145,8 @@ module AuthenticatedSystem
     def logout_keeping_session!
       @current_user = false     # not logged in, and don't do it for me
       session[:user_id] = nil   # keeps the session but kill our variable
-      # explicitly kill any other session variables you set
+      session.delete(:elevated_at)
+      session.delete(:elevation_attempts)
     end
 
     # The session should only be reset at the tail end of a form POST --
diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb
index 8f3a3732..065a5f7d 100644
--- a/lib/authenticated_test_helper.rb
+++ b/lib/authenticated_test_helper.rb
@@ -4,4 +4,8 @@ module AuthenticatedTestHelper
     @request.session[:user_id] = user ? users(user).id : nil
     @request.session[:logged_in_at] = Time.now.to_i
   end
+
+  def elevate_session!
+    session[:elevated_at] = Time.now.to_i
+  end
 end