{"record":{"id":"4faeb069dffd278d","repo":"RocketChat/Rocket.Chat","slug":"error-two-factor-not-enabled","errorCode":"error-two-factor-not-enabled","errorMessage":"Two factor authentication is not enabled","messagePattern":"Two factor authentication is not enabled","errorType":"exception","errorClass":"Meteor.Error","httpStatus":400,"severity":"error","filePath":"apps/meteor/server/api/v1/users.ts","lineNumber":1805,"sourceCode":"\t\t\t\t\tusername: { type: 'string' },\n\t\t\t\t\tuser: { type: 'string' },\n\t\t\t\t},\n\t\t\t\tadditionalProperties: false,\n\t\t\t}),\n\t\t\tresponse: {\n\t\t\t\t200: voidSuccessResponse,\n\t\t\t\t400: validateBadRequestErrorResponse,\n\t\t\t\t401: validateUnauthorizedErrorResponse,\n\t\t\t},\n\t\t},\n\t\tasync function action() {\n\t\t\tif ('userId' in this.bodyParams || 'username' in this.bodyParams || 'user' in this.bodyParams) {\n\t\t\t\tif (!(await hasPermissionAsync(this.user, 'edit-other-user-totp'))) {\n\t\t\t\t\tthrow new Meteor.Error('error-not-allowed', 'Not allowed');\n\t\t\t\t}\n\n\t\t\t\tif (!settings.get('Accounts_TwoFactorAuthentication_Enabled')) {\n\t\t\t\t\tthrow new Meteor.Error('error-two-factor-not-enabled', 'Two factor authentication is not enabled');\n\t\t\t\t}\n\n\t\t\t\tconst user = await getUserFromParams(this.bodyParams);\n\t\t\t\tif (!user) {\n\t\t\t\t\tthrow new Meteor.Error('error-invalid-user-id', 'Invalid user id');\n\t\t\t\t}\n\n\t\t\t\tawait resetTOTP(user._id, true);\n\n\t\t\t\treturn API.v1.success();\n\t\t\t}\n\t\t\tawait resetTOTP(this.userId, false);\n\t\t\treturn API.v1.success();\n\t\t},\n\t);\n\nAPI.v1\n\t.get(","sourceCodeStart":1787,"sourceCodeEnd":1823,"githubUrl":"https://github.com/RocketChat/Rocket.Chat/blob/f9d3ec372bb580fa8d036f94cf03925a478ef768/apps/meteor/server/api/v1/users.ts#L1787-L1823","documentation":"Thrown by POST users.resetTOTP when the target path is taken (other user) but the global setting Accounts_TwoFactorAuthentication_Enabled is off. Resetting another user's TOTP is meaningless when 2FA is disabled server-wide, so the route refuses even if the caller is otherwise permissioned.","triggerScenarios":"An admin resets another user's TOTP via the API while the instance-wide 2FA setting is disabled. The setting may have been turned off for maintenance or never enabled.","commonSituations":"2FA disabled during a migration/import and not re-enabled. A new admin resets TOTP not realizing 2FA is off cluster-wide.","solutions":["Enable Accounts_TwoFactorAuthentication_Enabled (admin > Settings > Accounts > Two Factor Authentication) before resetting other users' TOTP.","If 2FA is intentionally off, do not call resetTOTP for others; no TOTP exists to reset.","Surface the setting state in the admin UI next to the reset action so the precondition is visible."],"exampleFix":"// before - 2FA setting off\nPOST('/api/v1/users.resetTOTP', { userId: target })  // -> error-two-factor-not-enabled\n\n// after\nawait Settings.set('Accounts_TwoFactorAuthentication_Enabled', true)\nPOST('/api/v1/users.resetTOTP', { userId: target })","handlingStrategy":"validation","validationCode":"const twoFactorEnabled = await getSetting('Accounts_TwoFactorAuthentication_Enabled');\nif (!twoFactorEnabled) {\n  throw new ClientError('config','Enable Accounts_TwoFactorAuthentication_Enabled first');\n}","typeGuard":"function twoFactorEnabledFor(value) { return value === true; }","tryCatchPattern":"try { await POST('/api/v1/users.resetTOTP', { userId }); }\ncatch (e) {\n  if (e?.error === 'error-two-factor-not-enabled') { surface('2FA is disabled server-wide'); return; }\n  throw e;\n}","preventionTips":["Check the public 2FA setting before offering reset-TOTP in the UI.","Re-enable 2FA after migrations/imports.","Document that other-user TOTP reset requires the global setting on."],"tags":["api","users","totp","two-factor","configuration","settings"],"backgroundTag":null,"analyzedSha":"f9d3ec372bb580fa8d036f94cf03925a478ef768","analyzedAt":"2026-08-12T19:07:17.372Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}