// @vitest-environment node
import { describe, expect, test } from "vitest";
import { readRepoFile } from "~/utils/testing/repoPaths";

function readAdminDataSource() {
  return readRepoFile("apps/web/app/utils/data/.server/adminData.ts");
}

describe("admin data MFA enforcement boundary", () => {
  test("does not import MFA secret or recovery-code storage directly", () => {
    const source = readAdminDataSource();

    expect(source).not.toMatch(/mfaRecoveryCode|totpSecret|encryptedTotpSecret/i);
  });

  test("routes shared admin loader through the MFA enforcement boundary", () => {
    const source = readAdminDataSource();

    expect(source).toContain("getUserTotpStatus");
    expect(source).toContain("checkMfaStepUpState");
    expect(source).toContain("enforceAdminMfa");
    expect(source).toMatch(/if \(!mfaEnforcement\.allowed\) \{\s*throw redirect\(mfaEnforcement\.redirectTo\);\s*\}/);
  });
});