Registration not possible with TOTP and Accounts_EmailVerification=true

Description:

Steps to reproduce:

Here are the steps I've done on a new docker-compose Rocket.Chat instance:

1. Setup Wizard: Leave "TOTP by email for new users" enabled.
2. Set Accounts_EmailVerification to true
3. Set Accounts_RegistrationForm to Secret URL
4. Open https://some.domain.com/register/*** and create a new user
5. Open the verification link received by email.
6. An error occurs: TOTP required and the user is redirected to https://some.domain.com/home
7. An email with the TOTP authentification code arrives.

Expected behavior:

When the verification link is opened, the account should be activated.

If the second factor is email, then a TOTP code via email should not be required for this step (as both, the registration link and the TOTP code are delivered on the same way).

Alternatively: One should see a field to enter the TOTP code and click "activate account" (or similar).

Actual behavior:

1. Browser

2. Email

3. Browser

4. Email

Server Setup Information:

• Version of Rocket.Chat Server: 3.16.2
• Deployment Method: docker
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: v12.22.1
• MongoDB Version: 4.0.25 / mmapv1 (oplog Enabled)

Client Setup Information

• Browser Version: Firefox 89.0
• Operating System: Arch Linux, 5.10.48-1-lts

Additional context

Relevant logs:

rocketchat_1                              | Exception while invoking method login Error: Invalid email __email__ [error-invalid-email]
rocketchat_1                              |     at app/authentication/server/startup/index.js:347:10
rocketchat_1                              |     at packages/callback-hook/hook.js:131:22
rocketchat_1                              |     at packages/accounts-base/accounts_server.js:191:15
rocketchat_1                              |     at Hook.each (packages/callback-hook/hook.js:109:15)
rocketchat_1                              |     at AccountsServer._validateLogin (packages/accounts-base/accounts_server.js:188:29)
rocketchat_1                              |     at AccountsServer._attemptLogin (packages/accounts-base/accounts_server.js:377:10)
rocketchat_1                              |     at MethodInvocation.methods.login (packages/accounts-base/accounts_server.js:559:23)
rocketchat_1                              |     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)
rocketchat_1                              |     at packages/ddp-server/livedata_server.js:1689:15
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at packages/ddp-server/livedata_server.js:1687:36
rocketchat_1                              |     at new Promise (<anonymous>)
rocketchat_1                              |     at Server.applyAsync (packages/ddp-server/livedata_server.js:1686:12)
rocketchat_1                              |     at Server.apply (packages/ddp-server/livedata_server.js:1625:26)
rocketchat_1                              |     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
rocketchat_1                              |     at Object.post (app/api/server/v1/misc.js:263:26)
rocketchat_1                              |     at app/api/server/api.js:394:82
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
rocketchat_1                              |     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
rocketchat_1                              |     at packages/nimble_restivus/lib/route.coffee:59:33
rocketchat_1                              |     at packages/simple_json-routes.js:98:9
rocketchat_1                              |  => awaited here:
rocketchat_1                              |     at Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
rocketchat_1                              |     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)
rocketchat_1                              |     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
rocketchat_1                              |     at Object.post (app/api/server/v1/misc.js:263:26)
rocketchat_1                              |     at app/api/server/api.js:394:82
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
rocketchat_1                              |     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
rocketchat_1                              |     at packages/nimble_restivus/lib/route.coffee:59:33
rocketchat_1                              |     at packages/simple_json-routes.js:98:9
rocketchat_1                              |  => awaited here:
rocketchat_1                              |     at Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
rocketchat_1                              |     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)
rocketchat_1                              |     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
rocketchat_1                              |     at Object.post (app/api/server/v1/misc.js:263:26)
rocketchat_1                              |     at app/api/server/api.js:394:82
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
rocketchat_1                              |     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
rocketchat_1                              |     at packages/nimble_restivus/lib/route.coffee:59:33
rocketchat_1                              |     at packages/simple_json-routes.js:98:9
rocketchat_1                              | Exception while invoking method verifyEmail Error: TOTP Required [totp-required]
rocketchat_1                              |     at checkCodeForUser (app/2fa/server/code/index.ts:186:9)
rocketchat_1                              |     at app/2fa/server/loginHandler.js:30:2
rocketchat_1                              |     at callbacks.runItem (app/callbacks/lib/callbacks.js:111:70)
rocketchat_1                              |     at Object.callbacks.runItem (app/metrics/server/callbacksMetrics.js:24:20)
rocketchat_1                              |     at app/callbacks/lib/callbacks.js:39:35
rocketchat_1                              |     at app/callbacks/lib/callbacks.js:45:45
rocketchat_1                              |     at callbacks.run (app/callbacks/lib/callbacks.js:127:9)
rocketchat_1                              |     at Object.callbacks.run (app/metrics/server/callbacksMetrics.js:14:17)
rocketchat_1                              |     at app/authentication/server/startup/index.js:351:20
rocketchat_1                              |     at packages/callback-hook/hook.js:131:22
rocketchat_1                              |     at packages/accounts-base/accounts_server.js:191:15
rocketchat_1                              |     at Hook.each (packages/callback-hook/hook.js:109:15)
rocketchat_1                              |     at AccountsServer._validateLogin (packages/accounts-base/accounts_server.js:188:29)
rocketchat_1                              |     at AccountsServer._attemptLogin (packages/accounts-base/accounts_server.js:377:10)
rocketchat_1                              |     at AccountsServer._loginMethod (packages/accounts-base/accounts_server.js:409:17)
rocketchat_1                              |     at MethodInvocation.verifyEmail (packages/accounts-password/password_server.js:932:19)
rocketchat_1                              |     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)
rocketchat_1                              |     at packages/ddp-server/livedata_server.js:1689:15
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at packages/ddp-server/livedata_server.js:1687:36
rocketchat_1                              |     at new Promise (<anonymous>)
rocketchat_1                              |     at Server.applyAsync (packages/ddp-server/livedata_server.js:1686:12)
rocketchat_1                              |     at Server.apply (packages/ddp-server/livedata_server.js:1625:26)
rocketchat_1                              |     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
rocketchat_1                              |     at Object.post (app/api/server/v1/misc.js:263:26)
rocketchat_1                              |     at app/api/server/api.js:394:82
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
rocketchat_1                              |     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
rocketchat_1                              |     at packages/nimble_restivus/lib/route.coffee:59:33
rocketchat_1                              |     at packages/simple_json-routes.js:98:9
rocketchat_1                              |  => awaited here:
rocketchat_1                              |     at Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)
rocketchat_1                              |     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)
rocketchat_1                              |     at Server.call (packages/ddp-server/livedata_server.js:1607:17)
rocketchat_1                              |     at Object.post (app/api/server/v1/misc.js:263:26)
rocketchat_1                              |     at app/api/server/api.js:394:82
rocketchat_1                              |     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)
rocketchat_1                              |     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)
rocketchat_1                              |     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)
rocketchat_1                              |     at packages/nimble_restivus/lib/route.coffee:59:33
rocketchat_1                              |     at packages/simple_json-routes.js:98:9

Reproduce the flow with Accounts_EmailVerification=true, TOTP by email enabled, and Secret URL registration. Start with app/authentication/server/startup/index.js and app/2fa/server/code/index.ts, then trace verifyEmail through packages/accounts-password/password_server.js and loginHandler.js. Done means the reported registration flow completes as specified without the TOTP-required failure.