Add OTP_REQUIRED switch for email OTP login

app/login/api/engine/login_confirm.php

@@ -58,6 +58,7 @@ require_once '../../../config.php';
 require_once '../../../preset.php';
 define('UNAUTHENTICATED_ROUTE', true);
 require_once '../../../assets/utils/db_auth.php';
+require_once '../../../assets/utils/otp_policy.php';
 
 // ── Step 1: Load session state written by login_otp.php ───────────────────────
 $data["username"] = $_SESSION["login_data"]['username'];
@@ -100,9 +101,15 @@ $_SESSION["diff"] = $otp_diff_minutes;
 
 // ── Step 4: Validate OTP value and expiry ─────────────────────────────────────
 // Skipped for staff/viewer roles — login_otp.php sets skip_otp=true in session
-// so they never receive or enter an OTP. Admin/owner always go through this check.
+// so they never receive or enter an OTP. Admin/owner always go through this check,
+// unless OTP_REQUIRED=false in config.php: that also covers a user who was already
+// on the OTP screen when the switch was turned off.
 if (empty($_SESSION['skip_otp'])) {
-    if ($data["otp"] != $otp || $otp_diff_minutes > 5) {
+    if (!otp_required()) {
+        if (!empty($user_id)) {
+            otp_log_bypass($user_id, 'login_confirm');
+        }
+    } elseif ($data["otp"] != $otp || $otp_diff_minutes > 5) {
         $answer["message"] = "Wrong OTP! Please try again. (Our OTP is valid for 5 minute)";
         exit(json_encode($answer));
     }

app/login/api/engine/login_otp.php

@@ -62,6 +62,7 @@ require_once '../../../config.php';
 require_once '../../../preset.php';
 define('UNAUTHENTICATED_ROUTE', true);
 require_once '../../../assets/utils/db_auth.php';
+require_once '../../../assets/utils/otp_policy.php';
 
 // ── Step 1: Resolve user_id from username or email (case-insensitive) ────────
 $sth = $pdo1->prepare("select user_id from user where ? in (username,email) ");
@@ -253,11 +254,15 @@ if (password_verify(trim($data["password"]), $temp["password"])) {
         exit(json_encode($answer));
     }
 
-    // ── Step 5g: Role check — staff/viewer skip OTP entirely ─────────────────
-    // Owners always require 2FA. Invited users (license='user') require 2FA only
+    // ── Step 5g: OTP policy, then role check — staff/viewer skip OTP entirely ─
+    // OTP_REQUIRED=false in config.php turns the email OTP off for everyone and
+    // logs the sign-in as a bypass (see assets/utils/otp_policy.php).
+    // Otherwise owners always require 2FA. Invited users (license='user') require 2FA only
     // if their role in this company is admin or owner; staff/viewer go straight in.
-    $requires_otp = true;
-    if (($r['license'] ?? 'owner') !== 'owner') {
+    $requires_otp = otp_required();
+    if (!$requires_otp) {
+        otp_log_bypass($user_id, 'login_otp');
+    } elseif (($r['license'] ?? 'owner') !== 'owner') {
         $sth_role = $pdo1->prepare(
             "SELECT role FROM company_map_user WHERE company_id = :cid AND user_id = :uid LIMIT 1"
         );

app/login/index.php

@@ -1,6 +1,7 @@
 <?php 
   require '../session.php';
   require '../config.php';
+  require_once '../assets/utils/otp_policy.php';
   require '../include_header.php';
   // successful login — redirect based on app_access
   if(!empty($_SESSION["login_status"])){
@@ -32,6 +33,13 @@
         </div>
 
         <form class="needs-validation mt-3" novalidate id="login-form">
+          <?php if (!otp_required()): ?>
+          <!-- OTP_REQUIRED=false in config.php: a weakened sign-in must never be invisible -->
+          <div class="alert alert-warning small py-2 mb-3" title="OTP_REQUIRED=false in config.php">
+            <i class="ti ti-alert-triangle me-1"></i>
+            Email OTP is temporarily disabled — sign-in is password only.
+          </div>
+          <?php endif; ?>
           <!-- first step login [OTP] -->
           <?php if(!isset($_SESSION['login_data'])){?>
           <div class="mb-3">
@@ -51,7 +59,7 @@
 
           <div class="d-flex justify-content-between align-items-center mb-3">
             <!-- "Remember me" is intentionally excluded.
-            This login uses 2FA (OTP via email) on every session.
+            This login uses 2FA (OTP via email) on every session, unless OTP_REQUIRED=false in config.php.
             A persistent login would bypass the OTP step and undermine the security model.
             Do not add this back. -->
           </div>
@@ -62,6 +70,7 @@
           </p>
           <?php }else{ ?>
           <!-- second step login  -->
+          <?php if (otp_required()): ?>
           <div class="alert alert-warning small py-2 mb-3">
             <i class="ti ti-mail me-1"></i>
             OTP is sent via your company's SMTP setting.
@@ -73,13 +82,20 @@
               <span>One Time Password</span>
             </label>
             <input id="otp" type="otp" class="form-control"
-              placeholder="your otp for reference number <?php echo $_SESSION["reference"]?>" required minlength="6">
+              placeholder="your otp for reference number <?php echo $_SESSION["reference"] ?? ''?>" required minlength="6">
             <div class="invalid-feedback">Please provide a otp (min 6 characters).</div>
           </div>
+          <?php else: ?>
+          <!-- OTP_REQUIRED was switched off while this session sat on the OTP step:
+               login_confirm.php no longer checks the code, so there is nothing to type. -->
+          <input id="otp" type="hidden" value="">
+          <?php endif; ?>
           <div class="mb-3">
             <label for="password" class="form-label d-flex justify-content-between">
               <a href="javascript:;" class="small link-primary" onclick="back()">Back</a>
+              <?php if (otp_required()): ?>
               <a href="javascript:;" class="small link-primary" onclick="request_new_otp();">Request New OTP</a>
+              <?php endif; ?>
             </label>
           </div>
           <button class="btn btn-primary w-100" onclick="login_confirm();">Sign in</button>