add 2FA

config/initializers/devise.rb

@@ -4,6 +4,8 @@ require_relative '../../lib/auth_with_token_strategy'
 
 Warden::Strategies.add(:auth_token, AuthWithTokenStrategy)
 
+Devise.otp_allowed_drift = 60.seconds
+
 # Assuming you have not yet modified this file, each configuration option below
 # is set to its default value. Note that some are commented out while others
 # are not: uncommented lines are intended to protect your configuration from
@@ -13,6 +15,10 @@ Warden::Strategies.add(:auth_token, AuthWithTokenStrategy)
 # Use this hook to configure devise mailer, warden hooks and so forth.
 # Many of these configuration options can be set straight in your model.
 Devise.setup do |config|
+  config.warden do |manager|
+    manager.default_strategies(scope: :user).unshift(:two_factor_authenticatable)
+  end
+
   # The secret key used by Devise. Devise uses this key to generate
   # random tokens. Changing this key will render invalid all existing
   # confirmation, reset password and unlock tokens in the database.

config/initializers/filter_parameter_logging.rb

@@ -1,3 +1,3 @@
 # frozen_string_literal: true
 
-Rails.application.config.filter_parameters += %i[password token]
+Rails.application.config.filter_parameters += %i[password token otp_attempt]

config/routes.rb

@@ -41,6 +41,7 @@ Rails.application.routes.draw do
   end
 
   resources :verify_pdf_signature, only: %i[create]
+  resource :mfa_setup, only: %i[new edit create destroy], controller: 'mfa_setup'
   resources :dashboard, only: %i[index]
   resources :setup, only: %i[index create]
   resource :newsletter, only: %i[show update]