fix 2fa and move communication language to setting

apps/api/src/middleware/requireAdminAuth.test.ts

@@ -95,18 +95,19 @@ describe('requireAdminAuth middleware', () => {
     expect(next).toHaveBeenCalledTimes(1)
   })
 
-  it('blocks non-enrolled admins from privileged routes', async () => {
+  it('allows non-enrolled admins through regular admin auth', async () => {
     vi.mocked(jwt.verify).mockReturnValue({ sub: 'admin_1', type: 'admin' } as any)
-    vi.mocked(prisma.adminUser.findUnique).mockResolvedValue({ id: 'admin_1', isActive: true, role: 'ADMIN', totpEnabled: false } as any)
+    const admin = { id: 'admin_1', isActive: true, role: 'ADMIN', totpEnabled: false }
+    vi.mocked(prisma.adminUser.findUnique).mockResolvedValue(admin as any)
     const req = { headers: { authorization: 'Bearer admin-token' }, path: '/companies' } as Request
     const res = responseStub()
     const next = vi.fn() as NextFunction
 
     await requireAdminAuth(req, res, next)
 
-    expect(res.status).toHaveBeenCalledWith(403)
-    expect(res.json).toHaveBeenCalledWith({ error: 'admin_2fa_required', message: 'Admin 2FA enrollment is required before using privileged admin routes', statusCode: 403 })
-    expect(next).not.toHaveBeenCalled()
+    expect(req.admin).toEqual(admin)
+    expect(next).toHaveBeenCalledTimes(1)
+    expect(res.status).not.toHaveBeenCalled()
   })
 })
 

apps/api/src/middleware/requireAdminAuth.ts

@@ -13,17 +13,6 @@ const ADMIN_ROLE_ALLOWLIST: Record<AdminRole, readonly AdminRole[]> = {
   VIEWER:      ['SUPER_ADMIN', 'ADMIN', 'SUPPORT', 'FINANCE', 'VIEWER'],
 }
 
-const ADMIN_2FA_ENROLLMENT_EXEMPT_PATHS = new Set([
-  '/auth/me',
-  '/auth/logout',
-  '/auth/2fa/setup',
-  '/auth/2fa/verify',
-])
-
-function is2faEnrollmentExempt(req: Request) {
-  return ADMIN_2FA_ENROLLMENT_EXEMPT_PATHS.has(req.path)
-}
-
 /**
  * Requires a valid admin session token.
  *
@@ -47,10 +36,6 @@ export async function requireAdminAuth(req: Request, res: Response, next: NextFu
     return sendUnauthorized(res, 'unauthenticated', 'Admin account not found or deactivated')
   }
 
-  if (!admin.totpEnabled && !is2faEnrollmentExempt(req)) {
-    return sendForbidden(res, 'admin_2fa_required', 'Admin 2FA enrollment is required before using privileged admin routes')
-  }
-
   req.admin = admin
   req.adminAuthLast2faAt = typeof payload.last2faAt === 'number' ? payload.last2faAt : undefined
   next()