Currently, TOTP takes its permissions from the password permissions. So, if you have passwords copy/view disabled, this also disables copy/view for the TOTP code. This is no good. There are many instances in which Passbolt cannot detect the TOTP field. In these instances, the user needs to be able to copy the code and paste it into the field.
Unlike with passwords, there’s no risk to making the TOTP code visible, since by definition, it’s a one-time code. Moreover, websites display the TOTP code when it’s entered, so it’s not even possible to hide the code. Therefore, TOTP codes should always be visible and copyable in Passbolt. If someone disagrees with this, then at least provide a separate permission setting for TOTP codes, so we can make them visible.