From 800df45db2dd9f3baf8377896ecde8a917901fe6 Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Fri, 10 Jul 2015 17:11:18 -0400
Subject: Add disable_two_factor route for Admin::Users

---
 app/controllers/admin/users_controller.rb       |  6 ++++++
 config/routes.rb                                |  1 +
 spec/controllers/admin/users_controller_spec.rb | 28 +++++++++++++++++++++++++
 3 files changed, 35 insertions(+)

diff --git a/app/controllers/admin/users_controller.rb b/app/controllers/admin/users_controller.rb
index 7a683098df3..770fe00af51 100644
--- a/app/controllers/admin/users_controller.rb
+++ b/app/controllers/admin/users_controller.rb
@@ -55,6 +55,12 @@ class Admin::UsersController < Admin::ApplicationController
     end
   end
 
+  def disable_two_factor
+    user.disable_two_factor!
+    redirect_to admin_user_path(user),
+      notice: 'Two-factor Authentication has been disabled for this user'
+  end
+
   def create
     opts = {
       force_random_password: true,
diff --git a/config/routes.rb b/config/routes.rb
index fd04d7b2f54..055d59a0c93 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -159,6 +159,7 @@ Gitlab::Application.routes.draw do
         put :block
         put :unblock
         put :unlock
+        patch :disable_two_factor
         delete 'remove/:email_id', action: 'remove_email', as: 'remove_email'
       end
     end
diff --git a/spec/controllers/admin/users_controller_spec.rb b/spec/controllers/admin/users_controller_spec.rb
index 550a91a79e2..6f4c8987637 100644
--- a/spec/controllers/admin/users_controller_spec.rb
+++ b/spec/controllers/admin/users_controller_spec.rb
@@ -36,4 +36,32 @@ describe Admin::UsersController do
       expect(user.access_locked?).to be_falsey
     end
   end
+
+  describe 'PATCH disable_two_factor' do
+    let(:user) { create(:user) }
+
+    it 'disables 2FA for the user' do
+      expect(user).to receive(:disable_two_factor!)
+      allow(subject).to receive(:user).and_return(user)
+
+      go
+    end
+
+    it 'redirects back' do
+      go
+
+      expect(response).to redirect_to(admin_user_path(user))
+    end
+
+    it 'displays an alert' do
+      go
+
+      expect(flash[:notice]).
+        to eq 'Two-factor Authentication has been disabled for this user'
+    end
+
+    def go
+      patch :disable_two_factor, id: user.to_param
+    end
+  end
 end
-- 
cgit v1.2.1


From db8f4c06060d002c63b20ff51871976aaf9c9d4c Mon Sep 17 00:00:00 2001
From: Robert Speicher <rspeicher@gmail.com>
Date: Fri, 10 Jul 2015 17:11:39 -0400
Subject: Add a button to Admin::Users#show to disable 2FA for that user

---
 CHANGELOG                                          |  1 +
 app/views/admin/users/show.html.haml               |  1 +
 .../admin/admin_disables_two_factor_spec.rb        | 33 ++++++++++++++++++++++
 3 files changed, 35 insertions(+)
 create mode 100644 spec/features/admin/admin_disables_two_factor_spec.rb

diff --git a/CHANGELOG b/CHANGELOG
index a964a192216..a63d90a8f91 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -43,6 +43,7 @@ v 7.13.0 (unreleased)
   - Redesign project page. Show README as default instead of activity. Move project activity to separate page
   - Make left menu more hierarchical and less contextual by adding back item at top
   - A fork can’t have a visibility level that is greater than the original project.
+  - Allow administrators to disable 2FA for a specific user
 
 v 7.12.2
   - Correctly show anonymous authorized applications under Profile > Applications.
diff --git a/app/views/admin/users/show.html.haml b/app/views/admin/users/show.html.haml
index 8c6b8e851c4..33730ff05df 100644
--- a/app/views/admin/users/show.html.haml
+++ b/app/views/admin/users/show.html.haml
@@ -43,6 +43,7 @@
           %strong{class: @user.two_factor_enabled? ? 'cgreen' : 'cred'}
             - if @user.two_factor_enabled?
               Enabled
+              = link_to 'Disable', disable_two_factor_admin_user_path(@user), data: {confirm: 'Are you sure?'}, method: :patch, class: 'btn btn-xs btn-remove pull-right', title: 'Disable Two-factor Authentication'
             - else
               Disabled
 
diff --git a/spec/features/admin/admin_disables_two_factor_spec.rb b/spec/features/admin/admin_disables_two_factor_spec.rb
new file mode 100644
index 00000000000..71be66303d2
--- /dev/null
+++ b/spec/features/admin/admin_disables_two_factor_spec.rb
@@ -0,0 +1,33 @@
+require 'rails_helper'
+
+feature 'Admin disables 2FA for a user', feature: true do
+  scenario 'successfully', js: true do
+    login_as(:admin)
+    user = create(:user, :two_factor)
+
+    edit_user(user)
+    page.within('.two-factor-status') do
+      click_link 'Disable'
+    end
+
+    page.within('.two-factor-status') do
+      expect(page).to have_content 'Disabled'
+      expect(page).not_to have_button 'Disable'
+    end
+  end
+
+  scenario 'for a user without 2FA enabled' do
+    login_as(:admin)
+    user = create(:user)
+
+    edit_user(user)
+
+    page.within('.two-factor-status') do
+      expect(page).not_to have_button 'Disable'
+    end
+  end
+
+  def edit_user(user)
+    visit admin_user_path(user)
+  end
+end
-- 
cgit v1.2.1