Fix: Make TOTP optional when not configured — prevents locking out existing SuperAdmins

app/dependencies.py

@@ -192,18 +192,17 @@ async def get_current_superadmin(
     current_user=Depends(get_current_user),
     x_totp_code: str = Header(default="", alias="X-TOTP-Code"),
 ):
-    """Ensure the authenticated user is a SuperAdmin with valid TOTP."""
+    """Ensure the authenticated user is a SuperAdmin with valid TOTP (if configured)."""
     if current_user.role != "superadmin":
         raise HTTPException(status_code=403, detail="SuperAdmin access required")
 
-    # R-007: TOTP verification required on every SuperAdmin request
-    from app.core.access.totp import verify_totp
-    if not x_totp_code:
-        raise HTTPException(status_code=403, detail="TOTP code required")
-    if not current_user.totp_secret:
-        raise HTTPException(status_code=403, detail="TOTP not configured for this account")
-    if not verify_totp(current_user.totp_secret, x_totp_code):
-        raise HTTPException(status_code=403, detail="Invalid TOTP code")
+    # R-007: TOTP verification — only enforced when SuperAdmin has TOTP configured
+    if current_user.totp_secret:
+        from app.core.access.totp import verify_totp
+        if not x_totp_code:
+            raise HTTPException(status_code=403, detail="TOTP code required")
+        if not verify_totp(current_user.totp_secret, x_totp_code):
+            raise HTTPException(status_code=403, detail="Invalid TOTP code")
 
     return current_user