Graham McIntire
264154a3d8
- Add UserSudoController with GET and POST /users/sudo/verify routes - Create verify.html.heex template for TOTP verification form - Only accept TOTP codes (6 numeric digits), reject recovery codes - Update grant_sudo_mode to set authenticated_at virtual field - Exclude /users/sudo paths from return_to overwriting - Add comprehensive controller tests (12 test cases) - Verify redirect behavior, error handling, and session management 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
47 lines
1.4 KiB
Text
47 lines
1.4 KiB
Text
<Layouts.app flash={@flash} current_scope={@current_scope}>
|
|
<div class="mx-auto max-w-sm">
|
|
<div class="text-center">
|
|
<.header>
|
|
Re-authenticate
|
|
<:subtitle>
|
|
Enter the 6-digit code from your authenticator app to continue
|
|
</:subtitle>
|
|
</.header>
|
|
</div>
|
|
|
|
<div class="mt-8">
|
|
<.form :let={f} for={@form} as={:user} id="sudo_verify_form" action={~p"/users/sudo/verify"}>
|
|
<.input
|
|
field={f[:totp_code]}
|
|
type="text"
|
|
label="Authentication Code"
|
|
placeholder="000000"
|
|
autocomplete="one-time-code"
|
|
inputmode="numeric"
|
|
required
|
|
phx-mounted={JS.focus()}
|
|
/>
|
|
<div class="mt-2">
|
|
<p class="text-sm text-gray-500 dark:text-gray-400">
|
|
Enter the 6-digit code from your authenticator app. Recovery codes are not allowed for sensitive operations.
|
|
</p>
|
|
</div>
|
|
<div class="mt-6">
|
|
<.button class="w-full" variant="primary">
|
|
Verify <span aria-hidden="true">→</span>
|
|
</.button>
|
|
</div>
|
|
</.form>
|
|
|
|
<div class="mt-6 text-center">
|
|
<.link
|
|
href={~p"/users/log-out"}
|
|
method="delete"
|
|
class="text-sm font-semibold text-gray-600 hover:text-gray-700 dark:text-gray-400 dark:hover:text-gray-300"
|
|
>
|
|
← Log out instead
|
|
</.link>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</Layouts.app>
|