fix: 2FA check flashing for mandatory roles

.changeset/chatty-kids-compare.md

@@ -0,0 +1,5 @@
+---
+'@rocket.chat/meteor': patch
+---
+
+Fixes an issue where account security page was flashing sometimes for users with mandatory two factor configured.

apps/meteor/app/authentication/server/startup/index.js

@@ -23,7 +23,7 @@ import { setAvatarFromServiceWithValidation } from '../../../lib/server/function
 import { notifyOnSettingChangedById } from '../../../lib/server/lib/notifyListener';
 import * as Mailer from '../../../mailer/server/api';
 import { settings } from '../../../settings/server';
-import { getBaseUserFields } from '../../../utils/server/functions/getBaseUserFields';
+import { getDefaultUserFields } from '../../../utils/server/functions/getDefaultUserFields';
 import { safeGetMeteorUser } from '../../../utils/server/functions/safeGetMeteorUser';
 import { isValidAttemptByUser, isValidLoginAttemptByIp } from '../lib/restrictLoginAttempts';
 
@@ -40,7 +40,7 @@ Accounts.config({
  *
  * we are removing the status here because meteor send 'offline'
  */
-Object.assign(Accounts._defaultPublishFields.projection, (({ status, ...rest }) => rest)(getBaseUserFields()));
+Object.assign(Accounts._defaultPublishFields.projection, (({ status, ...rest }) => rest)(getDefaultUserFields()));
 
 Meteor.startup(() => {
 	settings.watchMultiple(['Accounts_LoginExpiration', 'Site_Name', 'From_Email'], () => {

apps/meteor/server/startup/initialData.js

@@ -217,7 +217,7 @@ Meteor.startup(async () => {
 			emails: [
 				{
 					address: 'rocketchat.internal.admin.test@rocket.chat',
-					verified: false,
+					verified: true,
 				},
 			],
 			status: 'offline',

apps/meteor/tests/e2e/enforce-2FA.spec.ts

@@ -0,0 +1,63 @@
+import { IS_EE } from './config/constants';
+import { Users } from './fixtures/userStates';
+import { HomeChannel, AccountProfile } from './page-objects';
+import { createCustomRole, deleteCustomRole } from './utils/custom-role';
+import { test, expect } from './utils/test';
+
+test.use({ storageState: Users.admin.state });
+
+test.describe('enforce two factor authentication', () => {
+	test.skip(!IS_EE, 'Enterprise Only');
+
+	let poHomeChannel: HomeChannel;
+	let poAccountProfile: AccountProfile;
+	let customRoleId = '';
+	test.beforeEach(async ({ page }) => {
+		poHomeChannel = new HomeChannel(page);
+		poAccountProfile = new AccountProfile(page);
+	});
+
+	test.beforeAll(async ({ api }) => {
+		const roleResponse = await createCustomRole(api, { name: 'enforce-2FA', mandatory2fa: true });
+		expect(roleResponse.status()).toBe(200);
+		const { role } = await roleResponse.json();
+		customRoleId = role._id;
+
+		const userUpdateRes = await api.post('/users.update', {
+			data: { roles: ['user', customRoleId, 'admin'] },
+			userId: 'rocketchat.internal.admin.test',
+		});
+		expect(userUpdateRes.status()).toBe(200);
+
+		const disableEmail2FA = await api.post('/users.2fa.disableEmail', {});
+		expect(disableEmail2FA.status()).toBe(200);
+	});
+
+	test.afterAll(async ({ api }) => {
+		const userUpdateRes = await api.post('/users.update', {
+			data: { roles: ['user', 'admin'] },
+			userId: 'rocketchat.internal.admin.test',
+		});
+		expect(userUpdateRes.status()).toBe(200);
+
+		const deleteRole = await deleteCustomRole(api, 'enforce-2FA');
+		expect(deleteRole.status()).toBe(200);
+
+		const enableEmail2FA = await api.post('/users.2fa.enableEmail', {});
+		expect(enableEmail2FA.status()).toBe(200);
+	});
+
+	test('should redirect to 2FA setup page and setup email 2FA', async ({ page }) => {
+		await page.goto('/home');
+		await expect(poHomeChannel.sidenav.sidebarHomeAction).not.toBeVisible();
+		await expect(poAccountProfile.securityHeader).toBeVisible();
+
+		await poAccountProfile.security2FASection.click();
+		await expect(poAccountProfile.enableEmail2FAButton).toBeVisible();
+		await poAccountProfile.enableEmail2FAButton.click();
+
+		await expect(poHomeChannel.toastSuccess).toBeVisible();
+		await expect(poHomeChannel.sidenav.sidebarHomeAction).toBeVisible();
+		await expect(poAccountProfile.securityHeader).not.toBeVisible();
+	});
+});

apps/meteor/tests/e2e/page-objects/fragments/home-sidenav.ts

@@ -53,6 +53,10 @@ export class HomeSidenav {
 		return this.page.getByRole('toolbar', { name: 'Sidebar actions' });
 	}
 
+	get sidebarHomeAction(): Locator {
+		return this.sidebarToolbar.getByRole('button', { name: 'Home' });
+	}
+
 	async setDisplayMode(mode: 'Extended' | 'Medium' | 'Condensed'): Promise<void> {
 		await this.sidebarToolbar.getByRole('button', { name: 'Display', exact: true }).click();
 		await this.sidebarToolbar.getByRole('menuitemcheckbox', { name: mode }).click();