[antopalidi]

🎩 What? Why?

Participants have no way to protect their account beyond the password. This PR adds two-factor authentication (2FA): a page in the account where participants attach an authenticator app or the email code, with recovery codes, and a switch in the system panel to enable it per organization (off by default).

Please note: it is the first of three PRs. The next one asks for the code at sign in and confirms the account access before changing the factors; the last one adds enforcement for admins or everyone and passkeys. The migrations already cover all three.

📌 Related Issues

Link your PR to an issue

• Related to #?
• Fixes #?

Testing

1. In /system, edit the organization, check "Enable two-factor authentication" and save.
2. Log in as a participant and open "Two-factor authentication" in the profile menu.
3. Click "Add authenticator app", scan the QR code, enter the code from the app.
4. See the recovery codes, click "I have saved the codes".
5. See the authenticator app listed, remove it, see the recovery codes gone too.
6. Enable the email code the same way.
7. Run EMAIL=<email> HOST=<host> bin/rails decidim:two_factor:reset and see the factors removed and the email sent.

📷 Screenshots

♥️ Thank you!

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 597ed26f-7b5b-4da7-8204-04d52fe527b4

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

This pull request does not contain a valid label. Please add one of the following labels: ['type: feature', 'type: change', 'type: fix', 'type: removal', 'target: developer-experience', 'type: internal']

[microstudi]

Amazon job Anna, let's go for the next!