[FIX] auto_totp: tour & check RPC w/ token

* Not sure how the tour passed during merge as it would not be looking
  for the button in the right tab, it would fail locally, fix this
  issue by properly switching to the Account Security tab
* add the missing test of RPC (which should not work on an account
  with totp enabled)
* also reorder ops & fix comments: turns out `totp_login_enabled`
  checks that totp is enabled *then disables it*

closes odoo/odoo#55979

Signed-off-by: Xavier Morel (xmo) <xmo@odoo.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/addons/auth_totp/static/tests/totp_flow.js b/addons/auth_totp/static/tests/totp_flow.js
index 3b3f1b67cc1..1eed5c3f88e 100644
--- a/addons/auth_totp/static/tests/totp_flow.js
+++ b/addons/auth_totp/static/tests/totp_flow.js
@@ -57,6 +57,10 @@ tour.register('totp_tour_setup', {
     trigger: '[data-menu=settings]',
     run: 'click',
 }, {
+    content: "Switch to security tab",
+    trigger: 'a[role=tab]:contains("Account Security")',
+    run: 'click',
+}, {
     content: "Check that the button has changed",
     trigger: 'button:contains(Disable two-factor authentication)',
     run: () => {}
@@ -134,6 +138,10 @@ tour.register('totp_login_enabled', {
     trigger: '[data-menu=settings]',
     run: 'click',
 }, {
+    content: "Switch to security tab",
+    trigger: 'a[role=tab]:contains("Account Security")',
+    run: 'click',
+}, {
     content: "Check that the button has changed",
     trigger: 'button:contains(Enable two-factor authentication)',
     run: () => {}