app/controllers/sessions_controller.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

# frozen_string_literal: true

class SessionsController < Devise::SessionsController
  def create
    if !params[:user][:otp_attempt]
      login_target = User.find_for_authentication(email: params[:user][:email])
      login_target = nil if login_target && !login_target.valid_password?(params[:user][:password])

      if login_target&.otp_required_for_login
        redirect_to '/users/sign_in', flash: {
          error:         'Please enter your two-factor auth code',
          otp_challenge: true,
          email:         params[:user][:email].presence,
          password:      params[:user][:password].presence,
          remember_me:   params[:user][:remember_me].presence
        }

        return
      end
    end

    super
  end
end