From 45432cba9f524c99015c90b6b6aa381fe2b04984 Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 18:38:42 +0200 Subject: Require a second factor for elevation, not for holding admin --- lib/authenticated_system.rb | 7 ++++--- lib/authenticated_test_helper.rb | 6 +++++- 2 files changed, 9 insertions(+), 4 deletions(-) (limited to 'lib') diff --git a/lib/authenticated_system.rb b/lib/authenticated_system.rb index 04d8051f..668436b5 100644 --- a/lib/authenticated_system.rb +++ b/lib/authenticated_system.rb @@ -25,9 +25,10 @@ module AuthenticatedSystem # Tied to is_admin? so losing the role closes the window at once, rather # than leaving a timestamp that would count again if the role returned. def elevated? - return false unless current_user&.is_admin? - session[:elevated_at].to_i > ELEVATION_MAX_AGE.ago.to_i - end + return false unless current_user&.is_admin? + return false unless current_user.otp_enrolled? + session[:elevated_at].to_i > ELEVATION_MAX_AGE.ago.to_i + end def elevation_expires_at return nil unless elevated? diff --git a/lib/authenticated_test_helper.rb b/lib/authenticated_test_helper.rb index 065a5f7d..483e6c88 100644 --- a/lib/authenticated_test_helper.rb +++ b/lib/authenticated_test_helper.rb @@ -6,6 +6,10 @@ module AuthenticatedTestHelper end def elevate_session! - session[:elevated_at] = Time.now.to_i + user = User.find_by(:id => @request.session[:user_id]) + if user && !user.otp_enrolled? + user.update_column(:otp_secret, ROTP::Base32.random) + end + @request.session[:elevated_at] = Time.now.to_i end end -- cgit v1.3