From fefec929c59c72dc93e4be30e8f23cd8c5258b0a Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 24 Jul 2026 13:52:56 +0200
Subject: Add self-service TOTP enrollment UI and witnessed admin reset

---
 app/controllers/otp_enrollments_controller.rb | 48 +++++++++++++++++++++++++++
 app/controllers/users_controller.rb           |  9 ++++-
 app/views/otp_enrollments/show.html.erb       | 23 +++++++++++++
 app/views/users/edit.html.erb                 | 30 +++++++++++++++++
 4 files changed, 109 insertions(+), 1 deletion(-)
 create mode 100644 app/controllers/otp_enrollments_controller.rb
 create mode 100644 app/views/otp_enrollments/show.html.erb

(limited to 'app')

diff --git a/app/controllers/otp_enrollments_controller.rb b/app/controllers/otp_enrollments_controller.rb
new file mode 100644
index 00000000..7a31d1e1
--- /dev/null
+++ b/app/controllers/otp_enrollments_controller.rb
@@ -0,0 +1,48 @@
+# Self-service TOTP enrollment, deliberately scoped to current_user only:
+# an administrator must never hold another account's secret -- admins get
+# the witnessed reset on the user page instead.
+class OtpEnrollmentsController < ApplicationController
+  before_action :login_required
+
+  layout 'admin'
+
+  # QR plus confirmation form; only meaningful while a pending secret exists.
+  def show
+    redirect_to edit_user_path(current_user) if current_user.otp_pending_secret.blank?
+  end
+
+  # Begins (or restarts) enrollment. Requires the current password so an
+  # unattended logged-in session cannot be enrolled onto a stranger's phone.
+  def create
+    unless User.authenticate(current_user.login, params[:current_password].to_s)
+      flash[:error] = "Wrong password."
+      return redirect_to edit_user_path(current_user)
+    end
+    current_user.begin_otp_enrollment!
+    redirect_to otp_enrollment_path
+  end
+
+  # Confirms with the first generated code.
+  def update
+    if current_user.confirm_otp_enrollment!(params[:code])
+      flash[:notice] = "Second factor enabled. The code you just entered is " \
+                        "spent -- wait for the next one before logging in with it."
+      redirect_to edit_user_path(current_user)
+    else
+      flash.now[:error] = "That code did not match. Rescan or wait for the next code."
+      render :show
+    end
+  end
+
+  # Self-service disable: password AND a current code.
+  def destroy
+    unless User.authenticate(current_user.login, params[:current_password].to_s) &&
+           current_user.verify_otp!(params[:code])
+      flash[:error] = "Password or code wrong -- second factor unchanged."
+      return redirect_to edit_user_path(current_user)
+    end
+    current_user.disable_otp!(:actor => current_user)
+    flash[:notice] = "Second factor disabled."
+    redirect_to edit_user_path(current_user)
+  end
+end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 6572b7a2..08541b0c 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -3,7 +3,7 @@ class UsersController < ApplicationController
   # Private
 
   before_action :login_required
-  before_action :find_user,     :only => [:show, :edit, :update, :destroy]
+  before_action :find_user,     :only => [:show, :edit, :update, :destroy, :reset_otp]
   before_action :verify_status, :except => [:index, :show]
 
   layout 'admin'
@@ -52,6 +52,13 @@ class UsersController < ApplicationController
     redirect_to users_path
   end
 
+  def reset_otp
+    return deny_user_access unless current_user.admin?
+    @user.disable_otp!(:actor => current_user)
+    flash[:notice] = "Second factor reset for #{@user.login}"
+    redirect_to edit_user_path(@user)
+  end
+
   private
 
     def user_params
diff --git a/app/views/otp_enrollments/show.html.erb b/app/views/otp_enrollments/show.html.erb
new file mode 100644
index 00000000..9dfa3422
--- /dev/null
+++ b/app/views/otp_enrollments/show.html.erb
@@ -0,0 +1,23 @@
+<h1>Enable second factor</h1>
+
+<div id="page_editor">
+  <div class="node_description">Scan</div>
+  <div class="node_content">
+    <%= raw RQRCode::QRCode.new(current_user.pending_otp_provisioning_uri)
+              .as_svg(:module_size => 4, :viewbox => true,
+                      :color => "000", :fill => "fff") %>
+    <span class="field_hint">Or enter the secret manually:
+      <code><%= current_user.otp_pending_secret %></code></span>
+  </div>
+
+  <div class="node_description">Confirm</div>
+  <div class="node_content">
+    <%= form_tag otp_enrollment_path, :method => :put do %>
+      <%= text_field_tag :code, nil, :autofocus => true,
+            :autocomplete => "one-time-code", :inputmode => "numeric" %>
+      <%= submit_tag "Confirm" %>
+    <% end %>
+    <span class="field_hint">Enter the six-digit code your app shows
+      for “<%= OTP_ISSUER %>”.</span>
+  </div>
+</div>
diff --git a/app/views/users/edit.html.erb b/app/views/users/edit.html.erb
index 77b33c6a..8d14a058 100644
--- a/app/views/users/edit.html.erb
+++ b/app/views/users/edit.html.erb
@@ -30,4 +30,34 @@
     <div class="node_content"><%= f.submit "Update" %></div>
   <% end %>
   </div>
+
+  <% if @user == current_user %>
+    <div class="node_description">Second factor</div>
+    <div class="node_content">
+      <% if current_user.otp_enrolled? %>
+        <p>Enabled.</p>
+        <%= form_tag otp_enrollment_path, :method => :delete do %>
+          <%= password_field_tag :current_password, nil, :placeholder => "Current password" %>
+          <%= text_field_tag :code, nil, :placeholder => "Current code",
+                :autocomplete => "one-time-code", :inputmode => "numeric" %>
+          <%= submit_tag "Disable second factor" %>
+        <% end %>
+      <% else %>
+        <p>Not enrolled.</p>
+        <%= form_tag otp_enrollment_path, :method => :post do %>
+          <%= password_field_tag :current_password, nil, :placeholder => "Current password" %>
+          <%= submit_tag "Enable second factor" %>
+        <% end %>
+      <% end %>
+    </div>
+  <% elsif current_user.admin? && @user.otp_enrolled? %>
+    <div class="node_description">Second factor</div>
+    <div class="node_content">
+      Enabled.
+      <%= button_to "Reset second factor", reset_otp_user_path(@user), :method => :put,
+            :form_class => "button_to destructive",
+            :form => { :data => { :confirm =>
+              "Reset #{@user.login}'s second factor? They will log in with password only afterwards." } } %>
+    </div>
+  <% end %>
 </div>
-- 
cgit v1.3