Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.

1 files changed, 15 insertions, 0 deletions

diff --git a/test/controllers/sessions_controller_test.rb b/test/controllers/sessions_controller_test.rb
index a5f511f5..62acd28a 100644
--- a/test/controllers/sessions_controller_test.rb
+++ b/test/controllers/sessions_controller_test.rb
@@ -23,4 +23,19 @@ class SessionsControllerTest < ActionController::TestCase
     assert_nil session[:user_id]
     assert_response :redirect
   end
+
+  test "login with password only is withheld for enrolled users" do
+    users(:quentin).update!(:otp_secret => ROTP::Base32.random)
+    post :create, params: { login: 'quentin', password: 'monkey' }
+    assert_nil session[:user_id]
+    assert_equal users(:quentin).id, session[:pending_otp_user_id]
+    assert_redirected_to new_otp_challenge_path
+  end
+
+  test "otp_required without enrollment logs in but funnels into setup" do
+    users(:quentin).update!(:otp_required => true)
+    post :create, params: { login: 'quentin', password: 'monkey' }
+    assert session[:user_id]
+    assert_redirected_to edit_user_path(users(:quentin))
+  end
 end