check totp_enabled feature when checking if a totp is required

1 files changed, 6 insertions, 0 deletions

diff --git a/src/routes/v1/users.rs b/src/routes/v1/users.rs
index a3f1810..36206c7 100644
--- a/src/routes/v1/users.rs
+++ b/src/routes/v1/users.rs
@@ -85,6 +85,12 @@ pub async fn needs_totp(
     Query(params): Query<HashMap<String, String>>,
     Extension(pool): Extension<Arc<Pool<Postgres>>>,
 ) -> impl IntoResponse {
+    if !(*crate::features::TOTP_ENABLED) {
+        return (
+            StatusCode::BAD_REQUEST,
+            Json(json!({ "error": "TOTP is not enabled" })),
+        );
+    }
     match params.get("email") {
         Some(email) => match db::users::get_user(&pool, email).await {
             Ok(user) => (