mfa fixing

internal/webui/account.go

@@ -13,13 +13,13 @@ import (
 
 // accountPage shows the admin their own profile: password change, TOTP MFA
 // enable/disable, and registered passkeys (passkey registration itself is wired up
-// in webauthn.go).
+// in webauthn.go). Only ever reached with MFA already satisfying enforce_admin_mfa
+// (or enforcement off) — requireAuth redirects everywhere else, including here, to
+// the isolated /mfa-setup page otherwise (see mfaSetupRequiredPage).
 func (a *App) accountPage(w http.ResponseWriter, r *http.Request) {
 	user := userFromContext(r)
 	creds, _ := a.DB.ListWebAuthnCredentials(user.ID)
-	hasMFA := user.TOTPEnabled || len(creds) > 0
-	mfaRequired := !hasMFA && a.Cfg.Section("Auth").Key("enforce_admin_mfa").MustBool(false)
-	a.render(w, r, "account.html", M{"active": "account", "user": user, "passkeys": creds, "mfa_required": mfaRequired})
+	a.render(w, r, "account.html", M{"active": "account", "user": user, "passkeys": creds})
 }
 
 // changePassword mirrors a normal (not forced) password change from account settings.
@@ -59,6 +59,15 @@ func (a *App) changePassword(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, Prefix+"/account", http.StatusFound)
 }
 
+// mfaSetupRequiredPage is the isolated, sidebar-free landing page requireAuth sends
+// an admin to when enforce_admin_mfa applies and they have no second factor yet — the
+// only page (besides the totp/passkey setup actions themselves) reachable until they
+// set one up, so there's no visible navigation to anything else in the browser.
+func (a *App) mfaSetupRequiredPage(w http.ResponseWriter, r *http.Request) {
+	user := userFromContext(r)
+	a.render(w, r, "mfa_setup_required.html", M{"username": user.Username, "flashes": popFlashes(w, r)})
+}
+
 // totpSetupBegin generates a fresh (not-yet-enabled) TOTP secret and shows it as a
 // scannable QR code (rendered inline as a data: URI — simplest way to hand the
 // browser an image without a second round-trip route) plus the manual entry key.
@@ -105,6 +114,7 @@ func (a *App) totpSetupConfirm(w http.ResponseWriter, r *http.Request) {
 		http.Redirect(w, r, Prefix+"/account", http.StatusFound)
 		return
 	}
+	_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "TOTP authenticator enabled")
 	setFlash(w, "success", "Authenticator app MFA enabled")
 	http.Redirect(w, r, Prefix+"/account", http.StatusFound)
 }
@@ -114,6 +124,7 @@ func (a *App) totpDisable(w http.ResponseWriter, r *http.Request) {
 	if err := a.DB.DisableAdminTOTP(user.ID); err != nil {
 		setFlash(w, "error", "Something went wrong")
 	} else {
+		_ = a.DB.LogAuthAttempt("admin_mfa", user.Username, requestIP(r), true, "TOTP authenticator disabled")
 		setFlash(w, "success", "Authenticator app MFA disabled")
 	}
 	http.Redirect(w, r, Prefix+"/account", http.StatusFound)