From 4b15f2ad7c9c08f86326e16c6f21a2337392d89c Mon Sep 17 00:00:00 2001
From: "Rudy B." <btte.rudy@gmail.com>
Date: Sat, 25 Apr 2026 20:05:50 +0200
Subject: [PATCH] fix(2FA): error when trying to setup an already activated 2FA

---
 public/intl/messages/en-US.json         | 1 +
 public/intl/messages/fr-FR.json         | 1 +
 src/app/api/2fa/setup/initiate/route.ts | 9 +++++++++
 src/components/messages.ts              | 1 +
 4 files changed, 12 insertions(+)

diff --git a/public/intl/messages/en-US.json b/public/intl/messages/en-US.json
index bc51979b9..980c6c02e 100644
--- a/public/intl/messages/en-US.json
+++ b/public/intl/messages/en-US.json
@@ -485,6 +485,7 @@
     "two-factor-error-too-many-attempts": "Too many failed attempts. Your account is temporarily locked.",
     "two-factor-error-disable-not-allowed": "Two-factor authentication is required and cannot be disabled.",
     "two-factor-error-incorrect-password": "Incorrect password.",
+    "two-factor-error-already-enabled": "Two-factor authentication is already enabled.",
     "two-factor-error-not-enabled": "Two-factor authentication is not enabled.",
     "two-factor-error-no-pending-setup": "No pending two-factor authentication setup found.",
     "two-factor-locked-message": "Too many failed attempts. Try again at {time}.",
diff --git a/public/intl/messages/fr-FR.json b/public/intl/messages/fr-FR.json
index 51860286f..b6810ad56 100644
--- a/public/intl/messages/fr-FR.json
+++ b/public/intl/messages/fr-FR.json
@@ -483,6 +483,7 @@
     "two-factor-error-too-many-attempts": "Trop de tentatives infructueuses. Votre compte est temporairement verrouillé.",
     "two-factor-error-disable-not-allowed": "L’authentification à deux facteurs est obligatoire et ne peut pas être désactivée.",
     "two-factor-error-incorrect-password": "Mot de passe incorrect.",
+    "two-factor-error-already-enabled": "L’authentification à deux facteurs est déjà activée.",
     "two-factor-error-not-enabled": "L’authentification à deux facteurs n’est pas activée.",
     "two-factor-error-no-pending-setup": "Aucune configuration d’authentification à deux facteurs en attente n’a été trouvée.",
     "two-factor-locked-message": "Trop de tentatives infructueuses. Réessayez à {time}.",
diff --git a/src/app/api/2fa/setup/initiate/route.ts b/src/app/api/2fa/setup/initiate/route.ts
index 43a83f191..00a071674 100644
--- a/src/app/api/2fa/setup/initiate/route.ts
+++ b/src/app/api/2fa/setup/initiate/route.ts
@@ -23,6 +23,15 @@ export async function POST(request: Request) {
     return badRequest({ message: 'User not found' });
   }
 
+  const existing = await prisma.client.twoFactorAuth.findUnique({ where: { userId } });
+
+  if (existing?.isEnabled) {
+    return badRequest({
+      code: 'two-factor-error-already-enabled',
+      message: '2FA is already enabled',
+    });
+  }
+
   const secret = generateTotpSecret();
   const encryptedSecret = encryptSecret(secret);
   const otpAuthUri = generateOtpAuthUri(secret, user.username);
diff --git a/src/components/messages.ts b/src/components/messages.ts
index b62590b63..4d6b332d6 100644
--- a/src/components/messages.ts
+++ b/src/components/messages.ts
@@ -487,6 +487,7 @@ export const messages: Record<string, string> = {
   twoFactorErrorTooManyAttempts: 'message.two-factor-error-too-many-attempts',
   twoFactorErrorDisableNotAllowed: 'message.two-factor-error-disable-not-allowed',
   twoFactorErrorIncorrectPassword: 'message.two-factor-error-incorrect-password',
+  twoFactorErrorAlreadyEnabled: 'message.two-factor-error-already-enabled',
   twoFactorErrorNotEnabled: 'message.two-factor-error-not-enabled',
   twoFactorErrorNoPendingSetup: 'message.two-factor-error-no-pending-setup',
 };