From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 24 Jul 2026 13:53:13 +0200
Subject: Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.
---
 app/controllers/application_controller.rb    | 13 +++++++
 app/controllers/otp_challenges_controller.rb | 54 ++++++++++++++++++++++++++++
 app/controllers/sessions_controller.rb       | 20 +++++++++--
 3 files changed, 84 insertions(+), 3 deletions(-)
 create mode 100644 app/controllers/otp_challenges_controller.rb

(limited to 'app/controllers')

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index d8de9750..6d46d522 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -4,6 +4,7 @@ class ApplicationController < ActionController::Base
   protect_from_forgery
 
   before_action :set_locale
+  before_action :enforce_otp_enrollment
 
   helper_method :safe_return_to
 
@@ -30,4 +31,16 @@ class ApplicationController < ActionController::Base
   rescue URI::InvalidURIError
     default
   end
+
+  # The hard gate for the slow transition: a user flagged otp_required
+  # who has not enrolled can reach only enrollment, their own user page,
+  # the login machinery, and the challenge -- everything else funnels
+  # into setup. Anonymous visitors are untouched (not logged_in?).
+  def enforce_otp_enrollment
+    return unless logged_in?
+    return unless current_user.otp_required? && !current_user.otp_enrolled?
+    return if %w[otp_enrollments otp_challenges sessions users].include?(controller_name)
+    flash[:error] = "Your account requires a second factor -- set it up to continue."
+    redirect_to edit_user_path(current_user)
+  end
 end
diff --git a/app/controllers/otp_challenges_controller.rb b/app/controllers/otp_challenges_controller.rb
new file mode 100644
index 00000000..892503a8
--- /dev/null
+++ b/app/controllers/otp_challenges_controller.rb
@@ -0,0 +1,54 @@
+# The second half of a two-step login. A pending marker (set by
+# sessions#create after a correct password) plus deadline and attempt
+# counter live in the session; the real user_id is only written after a
+# valid code, through a fresh session.
+class OtpChallengesController < ApplicationController
+
+  layout 'admin'
+
+  MAX_ATTEMPTS = 5
+
+  def new
+    redirect_to login_path unless pending_user
+  end
+
+  def create
+    user = pending_user
+    return redirect_to login_path unless user
+
+    session[:otp_attempts] = session[:otp_attempts].to_i + 1
+    if session[:otp_attempts] > MAX_ATTEMPTS
+      clear_pending
+      flash[:error] = "Too many attempts -- log in again."
+      return redirect_to login_path
+    end
+
+    if user.verify_otp!(params[:code])
+      return_to = session[:return_to]
+      reset_session
+      self.current_user = user
+      flash[:notice] = "Logged in successfully"
+      redirect_to safe_return_to(return_to, :default => admin_path)
+    else
+      flash.now[:error] = "That code did not match."
+      render :new
+    end
+  end
+
+  private
+
+    def pending_user
+      return nil if session[:pending_otp_user_id].blank?
+      if session[:otp_deadline].to_i < Time.now.to_i
+        clear_pending
+        return nil
+      end
+      @pending_user ||= User.find_by(:id => session[:pending_otp_user_id])
+    end
+
+    def clear_pending
+      session.delete(:pending_otp_user_id)
+      session.delete(:otp_deadline)
+      session.delete(:otp_attempts)
+    end
+end
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index 64bf951a..f0d5cf9b 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -20,9 +20,23 @@ class SessionsController < ApplicationController
       # button. Uncomment if you understand the tradeoffs.
       reset_session
       
-      self.current_user = user
-      redirect_to safe_return_to(return_to, :default => admin_path)
-      flash[:notice] = "Logged in successfully"
+      if user.otp_enrolled?
+        # Half-completed login: no user_id yet, only the pending marker.
+        session[:pending_otp_user_id] = user.id
+        session[:otp_deadline]        = 2.minutes.from_now.to_i
+        session[:otp_attempts]        = 0
+        session[:return_to]           = return_to
+        redirect_to new_otp_challenge_path
+      else
+        self.current_user = user
+        if user.otp_required?
+          flash[:error] = "Your account requires a second factor -- set it up now."
+          redirect_to edit_user_path(user)
+        else
+          flash[:notice] = "Logged in successfully"
+          redirect_to safe_return_to(return_to, :default => admin_path)
+        end
+      end
     else
       note_failed_signin
       @login = params[:login]
-- 
cgit v1.3