LG 11432 Prevent duplicate F/T setup if user hits back button on second MFA prompt

app/controllers/users/webauthn_setup_controller.rb

@@ -10,6 +10,7 @@ class WebauthnSetupController < ApplicationController
     before_action :apply_secure_headers_override
     before_action :set_webauthn_setup_presenter
     before_action :confirm_recently_authenticated_2fa
+    before_action :validate_existing_platform_authenticator
 
     helper_method :in_multi_mfa_selection_flow?
 
@@ -108,6 +109,17 @@ def show_delete
 
     private
 
+    def validate_existing_platform_authenticator
+      if platform_authenticator? && in_account_creation_flow? &&
+         current_user.webauthn_configurations.platform_authenticators.present?
+        redirect_to authentication_methods_setup_path
+     end
+    end
+
+    def platform_authenticator?
+      params[:platform] == 'true'
+    end
+
     def set_webauthn_setup_presenter
       @presenter = SetupPresenter.new(
         current_user: current_user,

spec/controllers/users/webauthn_setup_controller_spec.rb

@@ -230,6 +230,18 @@
           expect(additional_mfa_check).to be_truthy
         end
       end
+
+      context 'when the back button is clicked after platform is added' do
+        let(:user) { create(:user, :with_webauthn_platform) }
+        before do
+          controller.user_session[:in_account_creation_flow] = true
+        end
+        it 'should redirect to authentication methods setup' do
+          get :new, params: { platform: true }
+
+          expect(response).to redirect_to(authentication_methods_setup_path)
+        end
+      end
     end
 
     describe 'multiple MFA handling' do