2FA bypass when using rest api and personal access token

Description:

I'm trying to verify that 2FA is working correctly. It seems that when using rest api with a personal access token where 2FA required, RC server does not require two factor authentication. For example I'm able to create a user without any 2FA requirement.

Steps to reproduce:

1. Create a local account with admin permission.
2. Login with just created local user.
3. Enable 2FA for the account by TOTP.
4. Test that when login with RC user interface then 2FA is required.
5. Create a personal access token with two factor authentication required for the user .
6. Send /api/v1/users.create REST API call with Curl to the server. Use the personal access token which was just created. User is created without 2FA required.
7. Default setting in Administration/Accounts/Two Factor Authentication "Remember Two Factor for (seconds)" setting is 300. Also tried to set this to 5 but still 2FA is not required.

Expected behavior:

2FA is required when sending rest API calls to the server. Especially when creating a new user.

Actual behavior:

User is created without 2FA requirement.

Server Setup Information:

• Version of Rocket.Chat Server: 4.3.1
• Operating System: Centos 7
• Deployment Method: tar
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: 12.22.1
• MongoDB Version: 4.2.18

Client Setup Information

• Desktop App or Browser Version:
• Operating System:

Additional context

Relevant logs:

Start by reproducing the /api/v1/users.create request with a personal access token on an account requiring TOTP, then trace how REST authentication handles the two-factor requirement. Done means the API enforces 2FA for the described request while preserving the expected behavior for authenticated calls.