Add a very rough enforce_sudo_mode implementation

Author: davidcornu

app/controllers/users_controller.rb

@@ -20,6 +20,7 @@ class UsersController < ApplicationController
                                                :complete_sms_auth_verification,
                                                :start_sms_auth_verification]
   before_action :set_shown_private_feature_previews, only: [:edit, :edit_featurepreviews, :edit_security, :edit_admin]
+  before_action :enforce_sudo_mode, only: [:update]
 
   wrap_parameters format: :url_encoded_form
 

app/helpers/sessions_helper.rb

@@ -152,4 +152,35 @@ def sign_out_of_all_sessions(user = current_user)
   def sudo_mode?
     current_session&.sudo_mode?
   end
+
+  def enforce_sudo_mode
+    return if sudo_mode?
+
+    if params[:_sudo]
+      @login = Login.incomplete.active.find_by_hashid!(params[:_sudo][:login_id])
+
+      UserService::ExchangeLoginCodeForUser.new(
+        user_id: current_user.id,
+        login_code: params[:_sudo][:login_code],
+        sms: false,
+        ).run
+
+      @login.update!(authenticated_with_email: true)
+      @login.update!(user_session: current_session)
+
+      current_session.reload
+    else
+      @login = Login.create!(
+        user: current_user,
+        initial_login: current_session.initial_login
+      )
+
+      LoginCodeService::Request.new(email: current_user.email, sms: false, ip_address: request.remote_ip, user_agent: request.user_agent).run
+
+      render(
+        template: "sudo_mode/reauthenticate",
+        status: :unprocessable_entity
+      )
+    end
+  end
 end

app/views/sudo_mode/reauthenticate.html.erb

@@ -0,0 +1,21 @@
+<h1>Confirm Access</h1>
+
+<p>Signed in as <%= current_user.email %></p>
+
+<%= form_tag(request.path, method: request.request_method_symbol) do %>
+  <%
+    Rack::Utils
+      .parse_query(request.request_parameters.to_query)
+      .except("authenticity_token", "_method")
+      .each do |name, value|
+  %>
+    <%= hidden_field_tag(name, value) %>
+  <% end %>
+
+  <%= hidden_field_tag("_sudo[login_id]", @login.hashid) %>
+
+  <%= label_tag("_sudo[login_code]", "Login code") %>
+  <%= text_field_tag("_sudo[login_code]") %>
+
+  <%= submit_tag("Continue") %>
+<% end %>