Reset TOTP / 2FA does not work and hides API error if Administrator uses 2FA

[svrnwnsch]

Description:

As an administrator I want to reset the TOTP for an user. I changed all settings so that I see the following button in the UI: I click on it but the user still has there 2FA enabled (and therefor cannot login).

On the Dev tools I see the request PUT https://server.url/api/v1/users.resetTOTP fails with:

{
    "success": false,
    "error": "TOTP Required [totp-required]",
    "errorType": "totp-required",
    "details": {
        "method": "totp",
        "codeGenerated": false,
        "availableMethods": [
            "totp"
        ]
    }
}

Steps to reproduce:

1. Create a user with 2FA enabled
2. Try to reset the 2FA as an administrator by clicking on the "Reset TOTP" button
3. No error message or success message but it did not work

Expected behavior:

I get a Prompt to input my 2FA token as an Administrator. And then the user 2FA is reseted.

Actual behavior:

Nothing happens

Server Setup Information:

• Version of Rocket.Chat Server: 4.1.2
• Operating System: docker
• Deployment Method:
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version:
• MongoDB Version:

Client Setup Information

• Desktop App or Browser Version: firefox browser
• Operating System: linux

Additional context

Relevant logs:

[mesouug]

It actually responds with error:

Same problem with resetting user password (but here we do see error message):

And we are not using 2FA/TOTP for Admin user but for end user.

[ulope]

@svrnwnsch How did you manage to get that "Reset TOTP" option? It doesn't even show up in our installation.

[slhck]

I also do not see this option.

FWIW I went into the mongo console and did this:

use rocketchat;
db.users.update({ username: "foo" }, { $unset: { "services.totp": 1 } });
db.users.update(
  { username: "foo" },
  {
    $set: {
      "services.resume.loginTokens": [],
    },
  }
);