From 0aa6499a48a19d9fb58a69b277f493609fc3453a Mon Sep 17 00:00:00 2001
From: Max Erenberg <max.erenberg@mattermost.com>
Date: Mon, 22 Mar 2021 14:32:19 -0400
Subject: [PATCH] MM-29607 allow user to deactivate MFA even when disabled
 (#16994)

Automatic Merge
---
 app/user.go      |  4 ----
 app/user_test.go | 15 +++++++++++++++
 2 files changed, 15 insertions(+), 4 deletions(-)

diff --git a/app/user.go b/app/user.go
index 8d6c6702ba..29a0916ca3 100644
--- a/app/user.go
+++ b/app/user.go
@@ -781,10 +781,6 @@ func (a *App) ActivateMfa(userID, token string) *model.AppError {
 }
 
 func (a *App) DeactivateMfa(userID string) *model.AppError {
-	if !*a.Config().ServiceSettings.EnableMultifactorAuthentication {
-		return model.NewAppError("DeactivateMfa", "mfa.mfa_disabled.app_error", nil, "", http.StatusNotImplemented)
-	}
-
 	if err := mfa.New(a.Srv().Store.User()).Deactivate(userID); err != nil {
 		return model.NewAppError("DeactivateMfa", "mfa.deactivate.app_error", nil, err.Error(), http.StatusInternalServerError)
 	}
diff --git a/app/user_test.go b/app/user_test.go
index c5ea5180af..97c2456034 100644
--- a/app/user_test.go
+++ b/app/user_test.go
@@ -1440,3 +1440,18 @@ func TestUpdateUserRolesWithUser(t *testing.T) {
 	_, err = th.App.UpdateUserRolesWithUser(user, "does not exist", false)
 	require.NotNil(t, err)
 }
+
+func TestDeactivateMfa(t *testing.T) {
+	t.Run("MFA is disabled", func(t *testing.T) {
+		th := Setup(t).InitBasic()
+		defer th.TearDown()
+
+		th.App.UpdateConfig(func(cfg *model.Config) {
+			*cfg.ServiceSettings.EnableMultifactorAuthentication = false
+		})
+
+		user := th.BasicUser
+		err := th.App.DeactivateMfa(user.Id)
+		require.Nil(t, err)
+	})
+}