From b19bc87361508d5df46420f0bac781eb36b626d2 Mon Sep 17 00:00:00 2001
From: reachableceo <charles@turnsys.com>
Date: Mon, 27 Jul 2026 10:16:48 -0500
Subject: [PATCH] fix(security): resolve user home dir for 2FA setup
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

setup_user_2fa wrote each user's 2FA-setup instructions to the quoted
path "~$user/2fa-setup-instructions.txt". Tilde expansion does not occur
inside double quotes, so the path was treated literally and the write
failed with "No such file or directory", aborting the whole 2FA module
(and thus provisioning) under errexit.

Resolve the home directory explicitly with `getent passwd` and use that
absolute path for both the instructions file and the chown. Skip the
user cleanly if no home directory exists.

🤖 Generated with [Crush](https://github.com/charmassociates/crush)

Assisted-by: GLM-5 via Crush <crush@charm.land>
---
 ProjectCode/Modules/Security/secharden-2fa.sh | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/ProjectCode/Modules/Security/secharden-2fa.sh b/ProjectCode/Modules/Security/secharden-2fa.sh
index 2e7a7e5..f94352d 100644
--- a/ProjectCode/Modules/Security/secharden-2fa.sh
+++ b/ProjectCode/Modules/Security/secharden-2fa.sh
@@ -240,7 +240,14 @@ function setup_user_2fa() {
     for user in "${users[@]}"; do
         if id "$user" &>/dev/null; then
             print_info "Setting up 2FA for user: $user"
-            
+
+            local user_home
+            user_home="$(getent passwd "$user" | cut -d: -f6)"
+            if [[ -z "$user_home" ]]; then
+                print_info "No home directory for $user, skipping"
+                continue
+            fi
+
             # Create 2FA setup script for user
             cat > "/tmp/setup-2fa-$user.sh" << 'EOF'
 #!/bin/bash
@@ -257,7 +264,7 @@ EOF
             chmod +x "/tmp/setup-2fa-$user.sh"
             
             # Instructions for user setup
-            cat > "~$user/2fa-setup-instructions.txt" << EOF
+            cat > "$user_home/2fa-setup-instructions.txt" << EOF
 TSYS Two-Factor Authentication Setup Instructions
 ==============================================
 
@@ -286,7 +293,7 @@ Without them, you may be locked out if you lose your phone.
 For support, contact your system administrator.
 EOF
             
-            chown "$user:$user" "~$user/2fa-setup-instructions.txt"
+            chown "$user:$user" "$user_home/2fa-setup-instructions.txt"
             print_info "2FA setup prepared for user: $user"
         else
             print_info "User $user not found, skipping"