[antopalidi]

🎩 What? Why?

Participants have no way to protect their account beyond the password. This PR adds two-factor authentication (2FA): a page in the account where participants attach an authenticator app or the email code, with recovery codes, and a switch in the system panel to enable it per organization (off by default).

Please note: it is the first of three PRs. The next one asks for the code at sign in and confirms the account access before changing the factors; the last one adds enforcement for admins or everyone and passkeys. The migrations already cover all three.

📌 Related Issues

Link your PR to an issue

• Related to #?
• Fixes #?

Testing

1. In /system, edit the organization, check "Enable two-factor authentication" and save.
2. Log in as a participant and open "Two-factor authentication" in the profile menu.
3. Click "Add authenticator app", scan the QR code, enter the code from the app.
4. See the recovery codes, click "I have saved the codes".
5. See the authenticator app listed, remove it, see the recovery codes gone too.
6. Enable the email code the same way.
7. Run EMAIL=<email> HOST=<host> bin/rails decidim:two_factor:reset and see the factors removed and the email sent.

📷 Screenshots

♥️ Thank you!

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}