Track HiveGrid Cloud planning reference

hivegrid-cloud/apps/web/app/utils/data/.server/adminData.mfa.test.ts

@@ -0,0 +1,24 @@
+// @vitest-environment node
+import { describe, expect, test } from "vitest";
+import { readRepoFile } from "~/utils/testing/repoPaths";
+
+function readAdminDataSource() {
+  return readRepoFile("apps/web/app/utils/data/.server/adminData.ts");
+}
+
+describe("admin data MFA enforcement boundary", () => {
+  test("does not import MFA secret or recovery-code storage directly", () => {
+    const source = readAdminDataSource();
+
+    expect(source).not.toMatch(/mfaRecoveryCode|totpSecret|encryptedTotpSecret/i);
+  });
+
+  test("routes shared admin loader through the MFA enforcement boundary", () => {
+    const source = readAdminDataSource();
+
+    expect(source).toContain("getUserTotpStatus");
+    expect(source).toContain("checkMfaStepUpState");
+    expect(source).toContain("enforceAdminMfa");
+    expect(source).toMatch(/if \(!mfaEnforcement\.allowed\) \{\s*throw redirect\(mfaEnforcement\.redirectTo\);\s*\}/);
+  });
+});