summaryrefslogtreecommitdiff
path: root/app/controllers/otp_challenges_controller.rb
AgeCommit message (Collapse)Author
2026-07-24Complete the login only after the second factorerdgeist
Enrolled users get a pending marker instead of a session after the password step; a valid code through the challenge writes the real session via reset_session. otp_required without enrollment funnels into setup everywhere except the enrollment, user, and login machinery.