From f6c1f0f08f031778a491465d35ac694bfcdc12b0 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 1 Aug 2026 01:10:35 +0200
Subject: Require a fresh second factor for user management

Administrative actions are gated behind a 30-minute elevation window:
creating and retiring accounts, editing roles, clearing a second factor.
Reading the list is not gated, and content work is untouched.

elevated? is tied to is_admin?, so losing the role closes the window at
once. The window opens when the second factor verifies at login, so an
admin heading straight for user management is already elevated, and closes
on logout with the other session state. Five wrong codes end the session,
mirroring the login challenge.

users#update carries no elevation filter, since self-service reaches it;
the role field is gated in user_params instead and fails closed.
---
 config/locales/de.yml | 11 +++++++++++
 config/locales/en.yml | 11 +++++++++++
 config/routes.rb      |  1 +
 3 files changed, 23 insertions(+)

(limited to 'config')

diff --git a/config/locales/de.yml b/config/locales/de.yml
index 04eb738e..7edffe2d 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -628,6 +628,8 @@ de:
       none_to_remove: "Es existiert keine %{lang}-Übersetzung zum Entfernen."
       last_translation: "Die einzige verbliebene Übersetzung kann nicht entfernt werden."
       removed: "%{lang}-Übersetzung aus dem Entwurf entfernt. Veröffentlichen, um das dauerhaft zu machen."
+    elevation:
+      dropped: "Administrative Rechte abgelegt."
 
   assets:
     index:
@@ -721,6 +723,15 @@ de:
     title_fields:
       falls_back: "Menu-Titel. Leere Titel werden aus deutsch übernommen"
 
+  elevations:
+    new:
+      title: "Administrative Rechte anfordern"
+      hint: "Für Benutzerverwaltung ist ein aktueller zweiter Faktor nötig. Die Rechte gelten dann %{minutes} Minuten."
+      code: "Aktueller Code"
+      elevate: "Rechte anfordern"
+      not_enrolled: "Für administrative Arbeiten ist ein zweiter Faktor erforderlich. Bitte zuerst einen einrichten."
+      enrol: "Zweiten Faktor einrichten"
+
   layouts:
     application:
       light_mode_aria: "Zwischen dunklem und hellem Modus wechseln"
diff --git a/config/locales/en.yml b/config/locales/en.yml
index 2f7ac72f..9a8041bf 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -587,6 +587,8 @@ en:
       none_to_remove: "No %{lang} translation exists to remove."
       last_translation: "Can't remove the only remaining translation."
       removed: "%{lang} translation removed from the draft. Publish to make this permanent."
+    elevation:
+      dropped: "Administrative rights dropped."
 
   assets:
     index:
@@ -664,6 +666,15 @@ en:
       title: "Compare"
       default_marker: "default"
 
+  elevations:
+    new:
+      title: "Request administrative rights"
+      hint: "User management needs a current second factor. The rights then last %{minutes} minutes."
+      code: "Current code"
+      elevate: "Request rights"
+      not_enrolled: "Administrative work requires a second factor. Please set one up first."
+      enrol: "Set up a second factor"
+
   layouts:
     application:
       light_mode_aria: "Switch between dark and light mode"
diff --git a/config/routes.rb b/config/routes.rb
index 1898dbbb..4c37e70f 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -106,6 +106,7 @@ Cccms::Application.routes.draw do
     end
     resource :otp_enrollment, :only => [:show, :create, :update, :destroy]
     resource :otp_challenge, :only => [:new, :create]
+    resource :elevation, :only => [:new, :create, :destroy]
 
     resources :menu_items, :except => :show do
       member do
-- 
cgit v1.3