Add self-service TOTP enrollment UI and witnessed admin reset

1 files changed, 13 insertions, 1 deletions

diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 58f8a86b..946b5414 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -182,5 +182,17 @@ class UsersControllerTest < ActionController::TestCase
     assert_equal false, user.is_admin?
   end
   
-  
+  test "reset_otp is admin-only and witnessed" do
+    user = users(:quentin)
+    user.update!(:otp_secret => ROTP::Base32.random)
+
+    login_as :quentin
+    put :reset_otp, params: { :id => user.id }
+    assert user.reload.otp_enrolled?, "non-admin must be refused"
+
+    login_as :aaron
+    put :reset_otp, params: { :id => user.id }
+    assert_not user.reload.otp_enrolled?
+    assert_equal "otp_reset", NodeAction.last.action
+  end
 end