vibecarbon 0.1.0

package/carbon/supabase/migrations/00002_theme_settings.sql

@@ -0,0 +1,13 @@
+-- Theme Settings Migration
+-- Adds the app_theme key to app_settings and allows public read access.
+
+-- Insert default theme (empty object = use CSS defaults)
+INSERT INTO app_settings (key, value)
+VALUES ('app_theme', '{}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+-- Allow public read so all users get the custom theme on page load
+DROP POLICY IF EXISTS "Public can read whitelisted settings" ON app_settings;
+CREATE POLICY "Public can read whitelisted settings"
+  ON app_settings FOR SELECT
+  USING (key IN ('mfa_enabled', 'app_theme'));

package/carbon/supabase/migrations/00003_pg_cron.sql

@@ -0,0 +1,121 @@
+-- =============================================================================
+-- pg_cron: Background job scheduling via PostgreSQL
+-- =============================================================================
+
+-- Enable the pg_cron extension (available in Supabase PostgreSQL)
+CREATE EXTENSION IF NOT EXISTS pg_cron;
+
+-- Grant usage to postgres role (required for Supabase)
+GRANT USAGE ON SCHEMA cron TO postgres;
+
+-- =============================================================================
+-- Job execution history table (readable by super admins via API)
+-- =============================================================================
+
+CREATE TABLE IF NOT EXISTS public.cron_job_history (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  job_name TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'running', -- running, succeeded, failed
+  started_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  finished_at TIMESTAMPTZ,
+  duration_ms INTEGER,
+  result TEXT,
+  error TEXT,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_cron_job_history_job_name ON public.cron_job_history (job_name);
+CREATE INDEX IF NOT EXISTS idx_cron_job_history_started_at ON public.cron_job_history (started_at DESC);
+
+ALTER TABLE public.cron_job_history ENABLE ROW LEVEL SECURITY;
+
+-- Only super admins can read job history
+DROP POLICY IF EXISTS "Super admins can read job history" ON public.cron_job_history;
+CREATE POLICY "Super admins can read job history"
+  ON public.cron_job_history FOR SELECT
+  USING (public.is_super_admin());
+
+-- =============================================================================
+-- Helper function to log job execution
+-- =============================================================================
+
+CREATE OR REPLACE FUNCTION public.log_cron_job(
+  p_job_name TEXT,
+  p_status TEXT DEFAULT 'succeeded',
+  p_result TEXT DEFAULT NULL,
+  p_error TEXT DEFAULT NULL
+)
+RETURNS void
+LANGUAGE plpgsql
+SECURITY DEFINER
+AS $$
+BEGIN
+  INSERT INTO public.cron_job_history (job_name, status, finished_at, result, error)
+  VALUES (p_job_name, p_status, now(), p_result, p_error);
+END;
+$$;
+
+-- =============================================================================
+-- Schedule default jobs
+-- =============================================================================
+
+-- 1. Clean up old failed login attempts (every 6 hours)
+-- Replaces the Node.js setInterval in server/index.ts
+SELECT cron.schedule(
+  'cleanup-login-attempts',
+  '0 */6 * * *',  -- every 6 hours
+  $$
+  DO $body$
+  DECLARE
+    deleted_count INTEGER;
+  BEGIN
+    DELETE FROM public.failed_login_attempts
+    WHERE created_at < now() - interval '24 hours';
+    GET DIAGNOSTICS deleted_count = ROW_COUNT;
+    PERFORM public.log_cron_job('cleanup-login-attempts', 'succeeded',
+      'Deleted ' || deleted_count || ' old login attempts');
+  EXCEPTION WHEN OTHERS THEN
+    PERFORM public.log_cron_job('cleanup-login-attempts', 'failed', NULL, SQLERRM);
+  END $body$;
+  $$
+);
+
+-- 2. Clean up expired notifications (daily at 3am)
+SELECT cron.schedule(
+  'cleanup-expired-notifications',
+  '0 3 * * *',  -- daily at 3:00 AM
+  $$
+  DO $body$
+  DECLARE
+    deleted_count INTEGER;
+  BEGIN
+    DELETE FROM public.notifications
+    WHERE expires_at IS NOT NULL AND expires_at < now();
+    GET DIAGNOSTICS deleted_count = ROW_COUNT;
+    PERFORM public.log_cron_job('cleanup-expired-notifications', 'succeeded',
+      'Deleted ' || deleted_count || ' expired notifications');
+  EXCEPTION WHEN OTHERS THEN
+    PERFORM public.log_cron_job('cleanup-expired-notifications', 'failed', NULL, SQLERRM);
+  END $body$;
+  $$
+);
+
+-- 3. Clean up old cron job history (weekly, keep last 30 days)
+SELECT cron.schedule(
+  'cleanup-job-history',
+  '0 4 * * 0',  -- Sundays at 4:00 AM
+  $$
+  DO $body$
+  DECLARE
+    deleted_count INTEGER;
+  BEGIN
+    DELETE FROM public.cron_job_history
+    WHERE created_at < now() - interval '30 days';
+    GET DIAGNOSTICS deleted_count = ROW_COUNT;
+    PERFORM public.log_cron_job('cleanup-job-history', 'succeeded',
+      'Deleted ' || deleted_count || ' old history entries');
+  EXCEPTION WHEN OTHERS THEN
+    PERFORM public.log_cron_job('cleanup-job-history', 'failed', NULL, SQLERRM);
+  END $body$;
+  $$
+);

package/carbon/supabase/migrations/00004_contact_newsletter.sql

@@ -0,0 +1,81 @@
+-- =============================================================================
+-- Contact form submissions + Newsletter subscribers
+-- =============================================================================
+
+-- ========== CONTACT SUBMISSIONS ==========
+
+CREATE TABLE IF NOT EXISTS public.contact_submissions (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  name TEXT NOT NULL,
+  email TEXT NOT NULL,
+  subject TEXT NOT NULL,
+  message TEXT NOT NULL,
+  status TEXT NOT NULL DEFAULT 'unread', -- unread, read, replied, archived
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_contact_submissions_status ON public.contact_submissions (status);
+CREATE INDEX IF NOT EXISTS idx_contact_submissions_created_at ON public.contact_submissions (created_at DESC);
+
+ALTER TABLE public.contact_submissions ENABLE ROW LEVEL SECURITY;
+
+-- Only super admins can read/manage contact submissions
+DROP POLICY IF EXISTS "Super admins can manage contact submissions" ON public.contact_submissions;
+CREATE POLICY "Super admins can manage contact submissions"
+  ON public.contact_submissions FOR ALL
+  USING (public.is_super_admin());
+
+-- Allow anonymous inserts (public contact form)
+DROP POLICY IF EXISTS "Anyone can submit contact form" ON public.contact_submissions;
+CREATE POLICY "Anyone can submit contact form"
+  ON public.contact_submissions FOR INSERT
+  WITH CHECK (true);
+
+DROP TRIGGER IF EXISTS update_contact_submissions_updated_at ON public.contact_submissions;
+CREATE TRIGGER update_contact_submissions_updated_at
+  BEFORE UPDATE ON public.contact_submissions
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at();
+
+-- ========== NEWSLETTER SUBSCRIBERS ==========
+
+CREATE TABLE IF NOT EXISTS public.newsletter_subscribers (
+  id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+  email TEXT NOT NULL UNIQUE,
+  name TEXT,
+  status TEXT NOT NULL DEFAULT 'pending', -- pending, active, unsubscribed
+  confirmation_token UUID DEFAULT gen_random_uuid(),
+  subscribed_at TIMESTAMPTZ,
+  unsubscribed_at TIMESTAMPTZ,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_status ON public.newsletter_subscribers (status);
+CREATE INDEX IF NOT EXISTS idx_newsletter_subscribers_email ON public.newsletter_subscribers (email);
+
+ALTER TABLE public.newsletter_subscribers ENABLE ROW LEVEL SECURITY;
+
+-- Only super admins can read/manage subscribers
+DROP POLICY IF EXISTS "Super admins can manage newsletter subscribers" ON public.newsletter_subscribers;
+CREATE POLICY "Super admins can manage newsletter subscribers"
+  ON public.newsletter_subscribers FOR ALL
+  USING (public.is_super_admin());
+
+-- Allow anonymous inserts (public signup form)
+DROP POLICY IF EXISTS "Anyone can subscribe to newsletter" ON public.newsletter_subscribers;
+CREATE POLICY "Anyone can subscribe to newsletter"
+  ON public.newsletter_subscribers FOR INSERT
+  WITH CHECK (true);
+
+-- Allow anonymous updates for confirmation/unsubscribe (by token or email)
+DROP POLICY IF EXISTS "Anyone can confirm or unsubscribe" ON public.newsletter_subscribers;
+CREATE POLICY "Anyone can confirm or unsubscribe"
+  ON public.newsletter_subscribers FOR UPDATE
+  USING (true)
+  WITH CHECK (true);
+
+DROP TRIGGER IF EXISTS update_newsletter_subscribers_updated_at ON public.newsletter_subscribers;
+CREATE TRIGGER update_newsletter_subscribers_updated_at
+  BEFORE UPDATE ON public.newsletter_subscribers
+  FOR EACH ROW EXECUTE FUNCTION update_updated_at();

package/carbon/supabase/migrations/00005_localization_languages.sql

@@ -0,0 +1,22 @@
+-- Localization: enabled languages
+--
+-- Promotes the language list from a build-time env var
+-- (VITE_ENABLED_LANGUAGES) to a runtime DB-backed setting so admins can
+-- swap languages from the admin Settings UI without redeploying.
+--
+-- The on/off master switch (`localization_enabled`) was added earlier.
+-- This adds the companion list of which languages the switcher should
+-- offer when it's on. With <2 codes the switcher auto-hides at the
+-- component level (LanguageSwitcher.tsx), so a single-language project
+-- has no visible switcher even with localization_enabled=true.
+
+INSERT INTO app_settings (key, value)
+VALUES ('enabled_languages', '{"codes": ["en"]}'::jsonb)
+ON CONFLICT (key) DO NOTHING;
+
+-- Public read so unauthenticated nav can render the right switcher
+-- options before login (mirrors mfa_enabled / app_theme / localization_enabled).
+DROP POLICY IF EXISTS "Public can read whitelisted settings" ON app_settings;
+CREATE POLICY "Public can read whitelisted settings"
+  ON app_settings FOR SELECT
+  USING (key IN ('mfa_enabled', 'app_theme', 'localization_enabled', 'enabled_languages'));

package/carbon/supabase/seed.sql

@@ -0,0 +1,16 @@
+-- Seed data for development
+-- This file is optional and can be run to populate initial test data
+
+-- Note: In a real application, organizations and memberships should be
+-- created through the application after users sign up.
+
+-- Example: Create a demo organization (run this manually after first user signup)
+-- INSERT INTO organizations (name, slug, plan)
+-- VALUES ('Demo Organization', 'demo-org', 'FREE');
+
+-- Then add the first user as owner:
+-- INSERT INTO memberships (user_id, organization_id, role)
+-- SELECT
+--   auth.uid(),
+--   (SELECT id FROM organizations WHERE slug = 'demo-org'),
+--   'OWNER';

package/carbon/tests/_helpers/app.ts

@@ -0,0 +1,45 @@
+import { Hono } from 'hono';
+import type { HonoVariables } from '../../src/server/types';
+
+/**
+ * Mount a route module onto a fresh Hono instance at a given prefix.
+ *
+ * Integration tests get a clean app per test — no global middleware
+ * (CORS, rate-limit, security-headers) so assertions stay focused on the
+ * route under test. If you need those, mount them on the returned app
+ * before issuing requests.
+ *
+ * Example:
+ *   import { healthRoutes } from '@server/routes/health';
+ *   const app = mountRoute('/api/health', healthRoutes);
+ *   const res = await app.request('/api/health/');
+ *   expect(res.status).toBe(200);
+ */
+export function mountRoute(prefix: string, routes: Hono<{ Variables: HonoVariables }>): Hono {
+  const app = new Hono();
+  app.route(prefix, routes);
+  return app;
+}
+
+/**
+ * Build a JSON POST Request for app.request(...). Saves the boilerplate of
+ * setting `method`, `headers`, and JSON-encoding the body in every test.
+ *
+ * Example:
+ *   const res = await app.request('/api/v1/contact/submit', jsonPost({
+ *     name: 'Ada', email: 'ada@example.com', subject: 'Hi', message: 'Hello there.',
+ *   }));
+ */
+export function jsonPost(body: unknown, init: RequestInit = {}): RequestInit {
+  return {
+    method: 'POST',
+    headers: {
+      'content-type': 'application/json',
+      ...(init.headers ?? {}),
+    },
+    body: JSON.stringify(body),
+    ...init,
+    // Re-apply method/headers/body after the spread so callers can't
+    // accidentally clobber them with an empty init.
+  };
+}

package/carbon/tests/_helpers/env.ts

@@ -0,0 +1,37 @@
+/**
+ * Temporarily set environment variables for a test, returning a restore
+ * function. Closure-based — no globals, safe to call from concurrent tests
+ * as long as the variables don't overlap.
+ *
+ * Example:
+ *   it('falls back to default SITE_URL', () => {
+ *     const restore = mockEnv({ SITE_URL: undefined });
+ *     try {
+ *       // ... assertion that exercises the fallback path
+ *     } finally {
+ *       restore();
+ *     }
+ *   });
+ */
+export function mockEnv(vars: Record<string, string | undefined>): () => void {
+  const original: Record<string, string | undefined> = {};
+
+  for (const [key, value] of Object.entries(vars)) {
+    original[key] = process.env[key];
+    if (value === undefined) {
+      delete process.env[key];
+    } else {
+      process.env[key] = value;
+    }
+  }
+
+  return () => {
+    for (const [key, value] of Object.entries(original)) {
+      if (value === undefined) {
+        delete process.env[key];
+      } else {
+        process.env[key] = value;
+      }
+    }
+  };
+}

package/carbon/tests/_helpers/factories.ts

@@ -0,0 +1,69 @@
+import { randomBytes } from 'node:crypto';
+
+/**
+ * Lightweight factories that produce plausible domain objects for tests.
+ *
+ * These don't touch the DB — they return plain TS objects you can hand to
+ * a mocked Supabase client's resolved value (e.g. `mockResolvedValue({
+ * data: makeUser(), error: null })`).
+ *
+ * Add new factories here as you write tests; the test-maintainer agent
+ * follows this pattern when extending coverage.
+ */
+
+function rid(prefix: string): string {
+  return `${prefix}-${randomBytes(4).toString('hex')}`;
+}
+
+export interface TestUser {
+  id: string;
+  email: string;
+  user_metadata: { full_name?: string };
+}
+
+export function makeUser(overrides: Partial<TestUser> = {}): TestUser {
+  return {
+    id: rid('user'),
+    email: `${rid('user')}@example.test`,
+    user_metadata: { full_name: 'Test User' },
+    ...overrides,
+  };
+}
+
+export interface TestOrg {
+  id: string;
+  name: string;
+  slug: string;
+  owner_id: string;
+}
+
+export function makeOrg(overrides: Partial<TestOrg> = {}): TestOrg {
+  const id = rid('org');
+  return {
+    id,
+    name: 'Test Org',
+    slug: id,
+    owner_id: rid('user'),
+    ...overrides,
+  };
+}
+
+export interface ContactSubmission {
+  name: string;
+  email: string;
+  subject: string;
+  message: string;
+  website?: string;
+}
+
+export function makeContactSubmission(
+  overrides: Partial<ContactSubmission> = {},
+): ContactSubmission {
+  return {
+    name: 'Ada Lovelace',
+    email: 'ada@example.test',
+    subject: 'Hello',
+    message: 'Just dropping a line — this is a test message.',
+    ...overrides,
+  };
+}

package/carbon/tests/_helpers/jwt.ts

@@ -0,0 +1,23 @@
+import { createHmac } from 'node:crypto';
+
+/**
+ * Build an HS256-signed JWT for tests.
+ *
+ * The default secret matches what the auth middleware's mock paths expect
+ * — pass an explicit `secret` if you're testing the real JWT verifier.
+ *
+ * Example:
+ *   const token = mockJwt({ sub: 'user-123', role: 'authenticated' });
+ *   const res = await app.request('/api/v1/me', {
+ *     headers: { authorization: `Bearer ${token}` },
+ *   });
+ */
+export function mockJwt(payload: Record<string, unknown>, secret = 'test-secret'): string {
+  const header = { alg: 'HS256', typ: 'JWT' };
+  const encodedHeader = Buffer.from(JSON.stringify(header)).toString('base64url');
+  const encodedPayload = Buffer.from(JSON.stringify(payload)).toString('base64url');
+  const signature = createHmac('sha256', secret)
+    .update(`${encodedHeader}.${encodedPayload}`)
+    .digest('base64url');
+  return `${encodedHeader}.${encodedPayload}.${signature}`;
+}

package/carbon/tests/_helpers/setup-integration.ts

@@ -0,0 +1,20 @@
+// Vitest setupFile for the `integration` project.
+//
+// The server modules (env, supabase, email) validate required env vars at
+// import time via zod. Tests don't connect to real Supabase/SMTP — but the
+// schemas still need plausible values to pass `.url()` / `.min(1)` checks
+// before `vi.mock()` swaps in the test doubles.
+//
+// Set them once here so individual tests stay focused on behavior.
+const defaults: Record<string, string> = {
+  SUPABASE_URL: 'http://supabase.test',
+  SUPABASE_ANON_KEY: 'test-anon-key',
+  SUPABASE_SERVICE_ROLE_KEY: 'test-service-role-key',
+  NODE_ENV: 'test',
+};
+
+for (const [key, value] of Object.entries(defaults)) {
+  if (process.env[key] === undefined) {
+    process.env[key] = value;
+  }
+}

package/carbon/tests/_helpers/setup-rtl.ts

@@ -0,0 +1,12 @@
+// Vitest setupFile for the `component` project.
+//
+// 1. Loads @testing-library/jest-dom so matchers like .toBeInTheDocument()
+//    are typed and available.
+// 2. Runs RTL's cleanup() after each test so DOM state doesn't leak.
+import '@testing-library/jest-dom/vitest';
+import { cleanup } from '@testing-library/react';
+import { afterEach } from 'vitest';
+
+afterEach(() => {
+  cleanup();
+});

package/carbon/tests/component/ErrorBoundary.test.tsx

@@ -0,0 +1,53 @@
+import { render, screen } from '@testing-library/react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { ErrorBoundary } from '@/components/ErrorBoundary';
+
+// React's default rendering logs the caught error to console.error in dev,
+// which clutters test output but isn't an assertion failure. Silence it for
+// the error path only.
+let errorSpy: ReturnType<typeof vi.spyOn>;
+beforeEach(() => {
+  errorSpy = vi.spyOn(console, 'error').mockImplementation(() => {});
+});
+afterEach(() => {
+  errorSpy.mockRestore();
+});
+
+function Boom(): never {
+  throw new Error('kaboom');
+}
+
+describe('<ErrorBoundary />', () => {
+  it('renders children when no error is thrown', () => {
+    render(
+      <ErrorBoundary>
+        <p>healthy</p>
+      </ErrorBoundary>,
+    );
+    expect(screen.getByText('healthy')).toBeInTheDocument();
+  });
+
+  it('renders the fallback UI when a child throws', () => {
+    render(
+      <ErrorBoundary>
+        <Boom />
+      </ErrorBoundary>,
+    );
+    expect(screen.getByText('Something went wrong')).toBeInTheDocument();
+    expect(screen.getByRole('button', { name: /reload page/i })).toBeInTheDocument();
+  });
+
+  it('logs the caught error so it surfaces in observability', () => {
+    render(
+      <ErrorBoundary>
+        <Boom />
+      </ErrorBoundary>,
+    );
+    // Two console.error calls land here: one from React's own dev warning,
+    // and one from ErrorBoundary.componentDidCatch. Assert ours is present.
+    const fromBoundary = errorSpy.mock.calls.find(
+      (args) => typeof args[0] === 'string' && args[0].includes('ErrorBoundary caught an error'),
+    );
+    expect(fromBoundary).toBeDefined();
+  });
+});

package/carbon/tests/component/use-auth-settings.test.tsx

@@ -0,0 +1,119 @@
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
+import { renderHook, waitFor } from '@testing-library/react';
+import type { ReactNode } from 'react';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import {
+  type AuthSettings,
+  authSettingsQueryKey,
+  useAuthSettings,
+  useMfaRequired,
+} from '@/hooks/api/useAuthSettings';
+
+// Wraps any rendered hook in a fresh QueryClient — retry: false so a
+// fetch rejection surfaces in `error` immediately instead of after the
+// useQuery defaults' multiple retries.
+function makeWrapper() {
+  const client = new QueryClient({
+    defaultOptions: { queries: { retry: false } },
+  });
+  return function Wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={client}>{children}</QueryClientProvider>;
+  };
+}
+
+const okSettings: AuthSettings = {
+  settings: {
+    mfaEnabled: true,
+    localizationEnabled: false,
+    enabledLanguages: ['en'],
+  },
+};
+
+beforeEach(() => {
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => new Response(JSON.stringify(okSettings), { status: 200 })),
+  );
+});
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('useAuthSettings', () => {
+  it('returns settings on success', async () => {
+    const { result } = renderHook(() => useAuthSettings(), { wrapper: makeWrapper() });
+
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+
+    expect(result.current.data).toEqual(okSettings);
+    expect(result.current.error).toBeNull();
+  });
+
+  it('hits /api/v1/auth/settings exactly once when called multiple times (TanStack dedupes)', async () => {
+    const wrapper = makeWrapper();
+    const a = renderHook(() => useAuthSettings(), { wrapper });
+    const b = renderHook(() => useAuthSettings(), { wrapper });
+
+    await waitFor(() => expect(a.result.current.isLoading).toBe(false));
+    await waitFor(() => expect(b.result.current.isLoading).toBe(false));
+
+    expect(fetch).toHaveBeenCalledTimes(1);
+    expect(fetch).toHaveBeenCalledWith('/api/v1/auth/settings');
+  });
+
+  it('surfaces an error when fetch returns non-2xx', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response('boom', { status: 500 })),
+    );
+
+    const { result } = renderHook(() => useAuthSettings(), { wrapper: makeWrapper() });
+
+    // The hook sets `retry: 1` (per-query options override the wrapper's
+    // `retry: false` default), so we get one retry with TanStack's 1s
+    // exponential-backoff delay before isError flips. Generous waitFor
+    // timeout covers it.
+    await waitFor(() => expect(result.current.isError).toBe(true), { timeout: 5_000 });
+    expect(result.current.error).toBeInstanceOf(Error);
+  });
+
+  it('does not fetch when `enabled: false` is passed', async () => {
+    const { result } = renderHook(() => useAuthSettings({ enabled: false }), {
+      wrapper: makeWrapper(),
+    });
+
+    expect(result.current.fetchStatus).toBe('idle');
+    expect(fetch).not.toHaveBeenCalled();
+  });
+
+  it('exports a stable query key (cache invalidation contract)', () => {
+    // Renaming this key is a breaking change for any external invalidation
+    // callers — pin it so regressions surface in review.
+    expect(authSettingsQueryKey).toEqual(['auth', 'settings']);
+  });
+});
+
+describe('useMfaRequired', () => {
+  it('derives mfaRequired from the underlying settings', async () => {
+    const { result } = renderHook(() => useMfaRequired(), { wrapper: makeWrapper() });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.mfaRequired).toBe(true);
+  });
+
+  it('defaults to false when settings are missing', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(
+        async () =>
+          new Response(JSON.stringify({ settings: null } satisfies AuthSettings), {
+            status: 200,
+          }),
+      ),
+    );
+
+    const { result } = renderHook(() => useMfaRequired(), { wrapper: makeWrapper() });
+    await waitFor(() => expect(result.current.isLoading).toBe(false));
+    expect(result.current.mfaRequired).toBe(false);
+  });
+});