Visitor sign in kiosk: multi-site, badge printing, WWCC expiry warnings, admin accounts with 2FA

src/routes/admin.js

@@ -116,7 +116,11 @@ router.post('/login', loginLimiter, (req, res) => {
 
   if (user.totp_enabled) {
     req.session.pendingUserId = user.id;
-    return res.json({ status: 'twoFactorRequired' });
+    // Told up front so the sign in pages can show an honest "step 2 of 3".
+    return res.json({
+      status: 'twoFactorRequired',
+      passwordChangeToFollow: Boolean(user.must_change_password),
+    });
   }
   if (config.admin.require2fa) {
     req.session.pendingUserId = user.id;
@@ -141,7 +145,12 @@ async function startTwoFactorSetup(req, res, user) {
   req.session.pendingTotpSecret = secret;
   const url = otpauthUrl({ secret, email: user.email, issuer: config.siteName });
   const qr = await QRCode.toDataURL(url, { margin: 1, width: 240 });
-  res.json({ status: 'twoFactorSetup', secret, qr });
+  res.json({
+    status: 'twoFactorSetup',
+    secret,
+    qr,
+    passwordChangeToFollow: Boolean(user.must_change_password),
+  });
 }
 
 router.post('/login/2fa', loginLimiter, (req, res) => {