Add ability to require 2FA for specific roles (including Everybody) (#37701)

app/views/settings/two_factor_authentication/confirmations/new.html.haml

@@ -12,6 +12,8 @@
       %samp.qr-alternative__code= @new_otp_secret.scan(/.{4}/).join(' ')
 
   .fields-group
+    = hidden_field_tag :oauth, params[:oauth]
+
     = f.input :otp_attempt,
               hint: t('otp_authentication.code_hint'),
               input_html: { autocomplete: 'off' },

app/views/settings/two_factor_authentication/otp_authentication/show.html.haml

@@ -1,9 +1,12 @@
 - content_for :page_title do
   = t('settings.two_factor_authentication')
 
+- if current_user.role.require_2fa?
+  .flash-message= t('two_factor_authentication.role_requirement', domain: site_hostname)
+
 .simple_form
   %p.hint= t('otp_authentication.description_html')
 
   %hr.spacer/
 
-  = link_to t('otp_authentication.setup'), settings_otp_authentication_path, data: { method: :post }, class: 'button button--block'
+  = link_to t('otp_authentication.setup'), settings_otp_authentication_path(params.permit(:oauth)), data: { method: :post }, class: 'button button--block'

app/views/settings/two_factor_authentication/recovery_codes/index.html.haml

@@ -7,3 +7,9 @@
   - @recovery_codes.each do |code|
     %li<
       %samp= code
+
+- if params[:oauth]
+  %hr.spacer/
+
+  .simple_form
+    = link_to t('two_factor_authentication.resume_app_authorization'), return_to_app_url, class: 'button button--block'