Add support for 2FA in admin mode feature

It was agreed that 2FA is not a hard requirement for a first GA release of the admin mode feature. Moving this to its own issue.

@reprazent @ifarkas @jbroullon

/cc @bufferoverflow

The following discussion from !18214 (merged) should be addressed:

  • @dlouzan started a discussion: (+5 comments)

    @reprazent @ifarkas I've been doing some tests today and I'm not sure if it will be possible to add 2FA support without customizing / duplicating the 2FA views, something I'd like to avoid, at least in this MR.

    I basically incorporated some admin mode code in AuthenticatesWithTwoFactor#authenticate_with_two_factor, but although I'm able to provoke the 2FA code input in the flow, I wasn't able to trigger the authenticate_with_two_factor method above in the re-authentication. As far as I can see this is only triggered on SessionsController:

    class SessionsController < Devise::SessionsController
      ...
        prepend_before_action :authenticate_with_two_factor,
          if: -> { action_name == 'create' && two_factor_enabled? }
      ...

    I guess we could incorporate this too in a dedicated method for Admin::SessionsController, but for that I understand I'd need to be able to customize the endpoint called by the 2FA form (hence my statement above about needing to duplicate the 2FA views).

    Thoughts?

Assignee Loading
Time tracking Loading