/**
 * Whether the legacy username+password sign-in path may mint a session for a
 * user with the given 2FA-enrolment state.
 *
 * Security invariant (T1): a user who has enrolled in TOTP must complete the
 * challenge via /api/auth/login → /api/auth/2fa-challenge before a session is
 * created. The legacy credentials path must NEVER mint their session — and
 * this does NOT depend on the global AUTH_2FA_ENFORCED flag. Gating it on that
 * flag was the bypass behind the 2026-05-31 prod incident: when the flag read
 * as false at runtime, enrolled users got a session from a password alone.
 */
export function legacyPasswordLoginAllowed(totpEnabled: boolean): boolean {
    return !totpEnabled;
}