2FA disabled by admin – tab in settings still visible for users

Description:

I disabled 2FA by setting these settings to false via MongoDB:

• Accounts_TwoFactorAuthentication_Enabled
• Accounts_TwoFactorAuthentication_By_TOTP_Enabled
• Accounts_TwoFactorAuthentication_By_Email_Enabled

(The configuration update was deployed by loading a JSON file to MongoDB, since we need to have an audit trail of these changes.)

Steps to reproduce:

1. Log in as user A and go to the 2FA settings page
2. Load the JSON file with this command: mongoimport --uri="mongodb://admin:admin@mongodb:27017/rocketchat?authSource=admin" --collection=rocketchat_settings --upsert --upsertFields _id --jsonArray < settings.json
3. restart RocketChat (this does not seem to change anything, but we want to be extra sure the new settings were processed)
4. refresh the 2FA settings page => still visible
5. verify as an admin that 2FA settings are indeed disabled (in a different browser)
6. log in as a different user B (in a different browser) and see that 2FA settings are not available
7. as user A (in the original browser): clear the site's storage (Chromium DevTools => tab Application, Storage => button Clear site data)
8. as user A (in the original browser): refresh the page => 2FA settings should be done

Expected behavior:

Visibility of security-related features (or rather all settings) should not depend on client-side state. If caching is required for performance reasons, that cache should at least be reliably cleared when settings on the server are touched.

Actual behavior:

The settings are still available even when disabled. Added bonus is that 2FA is not disabled for users that have already turned it on once I disable it on the server. Since custom OAuth + 2FA is broken ATM, this leaves users with a non-working login without anything they can do.

Server Setup Information:

• Version of Rocket.Chat Server: 5.4.10
• Operating System: (official RocketChat container)
• Deployment Method: Docker
• Number of Running Instances: 1
• DB Replicaset Oplog: ???
• NodeJS Version: see official container
• MongoDB Version: 5.0.18

Client Setup Information

• Desktop App or Browser Version: verified in Chromium, but I'm pretty sure it also happened in Firefox
• Operating System: Ubuntu 22.04

Additional context

Relevant logs:

Start at the 2FA settings page and trace how Accounts_TwoFactorAuthentication_Enabled, Accounts_TwoFactorAuthentication_By_TOTP_Enabled, and Accounts_TwoFactorAuthentication_By_Email_Enabled reach the client. Check the cached state and behavior for users who already enabled 2FA, then verify that changing the server settings updates visibility and login behavior without clearing site data.