- if ( $return eq 'ok' ) {
- Koha::Logger->get->debug(sprintf "AUTH_SESSION: (%s)\t%s %s - %s", map { $session->param($_) || q{} } qw(cardnumber firstname surname branch));
+ if ( $return eq 'ok' || $return eq 'additional-auth-needed' ) {
+ $userid = $session->param('id');
+ }
+
+ $auth_state =
+ $return eq 'ok' ? 'completed'
+ : $return eq 'additional-auth-needed' ? 'additional-auth-needed'
+ : 'failed';
+
+ # We are at the second screen if the waiting-for-2FA is set in session
+ # and otp_token param has been passed
+ if ( $require_2FA
+ && $auth_state eq 'additional-auth-needed'
+ && ( my $otp_token = $query->param('otp_token') ) )
+ {
+ my $patron = Koha::Patrons->find( { userid => $userid } );
+ my $auth = Koha::Auth::TwoFactorAuth->new( { patron => $patron } );
+ my $verified = $auth->verify($otp_token, 1);
+ $auth->clear;
+ if ( $verified ) {
+ # The token is correct, the user is fully logged in!
+ $auth_state = 'completed';
+ $session->param( 'waiting-for-2FA', 0 );
+
+ # This is an ugly trick to pass the test
+ # $query->param('koha_login_context') && ( $q_userid ne $userid )
+ # few lines later
+ $q_userid = $userid;
+ }
+ else {
+ $invalid_otp_token = 1;
+ }
+ }