From 45432cba9f524c99015c90b6b6aa381fe2b04984 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 18:38:42 +0200 Subject: Require a second factor for elevation, not for holding admin --- app/models/user.rb | 1 + 1 file changed, 1 insertion(+) (limited to 'app/models/user.rb') diff --git a/app/models/user.rb b/app/models/user.rb index c3035a02..4b70ebe5 100644 --- a/app/models/user.rb +++ b/app/models/user.rb @@ -242,6 +242,7 @@ class User < ApplicationRecord def admin_needs_second_factor return unless roles.include?("admin") return if otp_secret.present? + return if persisted? && roles_in_database.to_a.include?("admin") errors.add(:roles, :admin_needs_otp) end end -- cgit v1.3