Require MFA during bootstrap mode

src/internal/adapters/privacyidea/adapter_test.go

@@ -101,6 +101,27 @@ func TestCheckMFARequired_ActiveTokenPresent_ReturnsTrue(t *testing.T) {
 	}
 }
 
+func TestCheckMFARequired_RequireForAll_ReturnsTrueWithoutTokenList(t *testing.T) {
+	client := &mockHTTPClient{
+		doFn: func(_ *http.Request) (*http.Response, error) {
+			t.Fatal("token-list endpoint must not be called when RequireForAll is enabled")
+			return nil, nil
+		},
+	}
+
+	cfg := testConfig()
+	cfg.RequireForAll = true
+	adapter := privacyidea.New(cfg, client)
+
+	required, err := adapter.CheckMFARequired(context.Background(), "alice")
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !required {
+		t.Error("expected MFA required=true when RequireForAll is enabled")
+	}
+}
+
 func TestCheckMFARequired_InactiveTokenOnly_ReturnsFalse(t *testing.T) {
 	client := &mockHTTPClient{
 		doFn: func(_ *http.Request) (*http.Response, error) {