dashboard/backend/tests/unit/test_auth.py

@@ -230,10 +230,15 @@ class TestTOTP:
 
         assert not verify_totp("000000")
 
-    def test_verify_totp_no_secret_enabled(self, mock_config, temp_auth_file):
+    def test_verify_totp_no_secret_enabled(self, mock_config, temp_auth_file, monkeypatch):
         """Test that TOTP verification passes when 2FA not enabled."""
         # Clear any existing secret from previous tests
         save_totp_secret("")
+        # Also clear environment variable fallback
+        monkeypatch.setenv("TOTP_SECRET", "")
+        import importlib
+        import config
+        importlib.reload(config)
         # No secret saved, should return True (2FA disabled)
         assert verify_totp("any_code")