Add ability to require 2FA for specific roles (including Everybody) (#37701)

app/controllers/settings/two_factor_authentication/base_controller.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Settings
+  module TwoFactorAuthentication
+    class BaseController < ::Settings::BaseController
+      layout -> { truthy_param?(:oauth) ? 'modal' : 'admin' }
+    end
+  end
+end

app/controllers/settings/two_factor_authentication/confirmations_controller.rb

@@ -4,12 +4,15 @@ module Settings
   module TwoFactorAuthentication
     class ConfirmationsController < BaseController
       include ChallengableConcern
+      include Devise::Controllers::StoreLocation
 
       skip_before_action :require_functional!
 
       before_action :require_challenge!
       before_action :ensure_otp_secret
 
+      helper_method :return_to_app_url
+
       def new
         prepare_two_factor_form
       end
@@ -37,6 +40,10 @@ module Settings
 
       private
 
+      def return_to_app_url
+        stored_location_for(:user)
+      end
+
       def confirmation_params
         params.expect(form_two_factor_confirmation: [:otp_attempt])
       end

app/controllers/settings/two_factor_authentication/otp_authentication_controller.rb

@@ -17,7 +17,7 @@ module Settings
       def create
         session[:new_otp_secret] = User.generate_otp_secret
 
-        redirect_to new_settings_two_factor_authentication_confirmation_path
+        redirect_to new_settings_two_factor_authentication_confirmation_path(params.permit(:oauth))
       end
 
       private