Skip to content

ADR 0006: Portal auth: Devise, mandatory 2FA, AR encryption

  • Status: Accepted
  • Date: 2026-09-11

Context

The portal holds client data, consent evidence and financial planning. It is exposed on the public internet and operated by a tiny team where a single phished password must not be enough.

Decision

Devise for authentication with mandatory TOTP two factor for every user, enforced by a controller-level gate (enforce_two_factor!) that no signed-in request can bypass. OTP secrets and other sensitive columns use Active Record encryption; the encryption keys are deployment secrets and the app refuses to boot in production without them.

Consequences

Lost second factors are an admin-assisted recovery, by design. The encryption keys are part of disaster recovery: without them the encrypted columns are unreadable, so they are backed up separately from the database.