From dcb576618b868b888a5b1b31e35491f300ce4050 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 24 Jul 2026 13:53:13 +0200
Subject: Complete the login only after the second factor

Enrolled users get a pending marker instead of a session after the
password step; a valid code through the challenge writes the real
session via reset_session. otp_required without enrollment funnels
into setup everywhere except the enrollment, user, and login
machinery.
---
 app/views/otp_challenges/new.html.erb | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 app/views/otp_challenges/new.html.erb

(limited to 'app/views')

diff --git a/app/views/otp_challenges/new.html.erb b/app/views/otp_challenges/new.html.erb
new file mode 100644
index 00000000..a9c7a15c
--- /dev/null
+++ b/app/views/otp_challenges/new.html.erb
@@ -0,0 +1,13 @@
+<h1>Second factor</h1>
+
+<div id="page_editor">
+  <div class="node_description">Code</div>
+  <div class="node_content">
+    <%= form_tag otp_challenge_path, :method => :post do %>
+      <%= text_field_tag :code, nil, :autofocus => true,
+            :autocomplete => "one-time-code", :inputmode => "numeric" %>
+      <%= submit_tag "Log in" %>
+    <% end %>
+    <span class="field_hint">Enter the six-digit code from your authenticator app.</span>
+  </div>
+</div>
-- 
cgit v1.3