@coffeerunhobby/mcp-ha-connect 2.2.1 → 2.4.0

package/tests/security/insecureDesign.test.ts

@@ -1,121 +0,0 @@
-/**
- * SEC-DESIGN — Insecure Design / Fail-open
- * OWASP A04:2021 (Insecure Design).
- *
- * Findings covered:
- *   L3 — default-allow `?? 0xFF` fallbacks. A tool invocation that arrives with no
- *        permission mask was granted FULL permissions. Secure behavior: fail closed
- *        (deny) unless the transport is the trusted-local stdio path, which opts in
- *        explicitly via setLocalFullTrust().
- *   L1 — automation/script CREATION is effectively arbitrary HA template/shell exec.
- *        Policy: it must remain behind a privileged bit (CONFIGURE), never a read or
- *        plain-control bit. This guard locks that contract so it can't silently
- *        regress to a lower tier.
- */
-
-import { describe, it, expect, vi, afterEach } from 'vitest';
-import type { ToolExtra } from '../../src/tools/common.js';
-import { wrapToolHandler, toToolResult, setLocalFullTrust } from '../../src/tools/common.js';
-import { Permission, Role, hasPermission } from '../../src/permissions/index.js';
-
-/** Build a ToolExtra; pass `undefined` to omit the permission mask entirely. */
-function extraWith(permissions?: number): ToolExtra {
-  // SDK v2 context shape: auth under http.authInfo; omitted entirely when absent.
-  return {
-    sessionId: 'test-session',
-    mcpReq: { id: 1, signal: new AbortController().signal },
-    ...(permissions !== undefined
-      ? { http: { authInfo: { token: 't', clientId: 'c', scopes: [], extra: { permissions } } } }
-      : {}),
-  } as unknown as ToolExtra;
-}
-
-describe('SEC-DESIGN — Insecure Design / Fail-open', () => {
-  // The local-trust flag is process-global; never let a test leak it.
-  afterEach(() => setLocalFullTrust(false));
-
-  describe('L3: missing permission mask fails closed', () => {
-    it('denies a privileged tool when no authInfo is present (HTTP anomaly)', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
-      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
-
-      const result = await wrapped({}, extraWith(undefined));
-
-      expect(handler).not.toHaveBeenCalled();
-      expect(result.isError).toBe(true);
-      expect((result.content[0] as { text: string }).text).toContain('Permission denied');
-    });
-
-    it('denies even a QUERY-only tool when no mask is present', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
-      const wrapped = wrapToolHandler('readTool', handler, Permission.QUERY);
-
-      const result = await wrapped({}, extraWith(undefined));
-
-      expect(handler).not.toHaveBeenCalled();
-      expect(result.isError).toBe(true);
-    });
-
-    it('still enforces an explicit insufficient mask (regression guard)', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
-      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
-
-      const result = await wrapped({}, extraWith(Permission.QUERY));
-
-      expect(handler).not.toHaveBeenCalled();
-      expect(result.isError).toBe(true);
-    });
-  });
-
-  describe('L3: stdio local-trust opt-in', () => {
-    it('grants full permissions for no-auth calls ONLY when local trust is enabled', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
-      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
-
-      setLocalFullTrust(true);
-      const result = await wrapped({}, extraWith(undefined));
-
-      expect(handler).toHaveBeenCalledOnce();
-      expect(result.isError).toBe(false);
-    });
-
-    it('reverts to fail-closed once local trust is turned back off', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('ok'));
-      const wrapped = wrapToolHandler('dangerTool', handler, Permission.ADMIN);
-
-      setLocalFullTrust(true);
-      setLocalFullTrust(false);
-      const result = await wrapped({}, extraWith(undefined));
-
-      expect(handler).not.toHaveBeenCalled();
-      expect(result.isError).toBe(true);
-    });
-  });
-
-  describe('L1: automation/script creation stays behind a privileged bit', () => {
-    it('CONFIGURE (the createAutomation gate) is NOT granted by read/operator roles', () => {
-      // createAutomation is registered with Permission.CONFIGURE. Document & lock that
-      // this bit represents code-exec-equivalent power: it must not leak into the
-      // low-privilege roles a typical read/control token would carry.
-      expect(hasPermission(Role.READONLY, Permission.CONFIGURE)).toBe(false);
-      expect(hasPermission(Role.OPERATOR, Permission.CONFIGURE)).toBe(false);
-
-      // Only the explicitly-privileged roles include it.
-      expect(hasPermission(Role.CONTRIBUTOR, Permission.CONFIGURE)).toBe(true);
-      expect(hasPermission(Role.ADMIN, Permission.CONFIGURE)).toBe(true);
-    });
-
-    it('a CONFIGURE gate denies an OPERATOR token but allows a CONTRIBUTOR token', async () => {
-      const handler = vi.fn().mockResolvedValue(toToolResult('created'));
-      const wrapped = wrapToolHandler('createAutomation', handler, Permission.CONFIGURE);
-
-      const denied = await wrapped({}, extraWith(Role.OPERATOR));
-      expect(handler).not.toHaveBeenCalled();
-      expect(denied.isError).toBe(true);
-
-      const allowed = await wrapped({}, extraWith(Role.CONTRIBUTOR));
-      expect(handler).toHaveBeenCalledOnce();
-      expect(allowed.isError).toBe(false);
-    });
-  });
-});

package/tests/security/logging.test.ts

@@ -1,131 +0,0 @@
-/**
- * SEC-LOG — Logging & Information Disclosure
- * OWASP A09:2021 (Security Logging and Monitoring Failures) / sensitive data exposure.
- *
- * Findings covered:
- *   M6 — error responses leak the raw internal `error.message` to clients
- *        (may contain internal hostnames, file paths, tokens, stack detail).
- *   M7 — the unauthenticated `/health` endpoint discloses version, auth method,
- *        and internal AI provider URLs.
- *
- * These tests assert the SECURE behavior: clients receive a generic error message
- * (the detail is logged server-side only), and `/health` returns liveness only.
- */
-
-import { describe, it, expect, vi } from 'vitest';
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import type { HaClient } from '../../src/haClient/index.js';
-import { sanitizeError } from '../../src/utils/sanitizeError.js';
-import { handleRestApi, handleHealthCheck } from '../../src/server/http.js';
-import type { AuthenticatedRequest } from '../../src/server/auth.js';
-
-/** An error whose message embeds infrastructure detail we must never echo. */
-const LEAKY = new Error('connect ECONNREFUSED 10.0.0.19:8123 (/volume1/docker/secret)');
-
-/** Build a mock request carrying a full permission mask. */
-function mockReq(method: string, url: string): AuthenticatedRequest {
-  const listeners: Record<string, ((arg?: unknown) => void)[]> = {};
-  const req = {
-    method,
-    url,
-    headers: { host: 'mcp.test:3000' },
-    auth: { token: 't', clientId: 'u', scopes: [], extra: { permissions: 0xff } },
-    on(event: string, cb: (arg?: unknown) => void) {
-      (listeners[event] ??= []).push(cb);
-      if (event === 'end') {
-        queueMicrotask(() => {
-          for (const e of listeners['end'] ?? []) e();
-        });
-      }
-      return req;
-    },
-  } as unknown as AuthenticatedRequest;
-  return req;
-}
-
-/** Capture status code and JSON body written to the response. */
-function mockRes(): ServerResponse & { _body?: unknown } {
-  const res = {
-    statusCode: 200,
-    headersSent: false,
-    setHeader: vi.fn(),
-    end: vi.fn(function (this: { _body?: unknown }, payload?: unknown) {
-      if (typeof payload === 'string') {
-        try {
-          this._body = JSON.parse(payload);
-        } catch {
-          this._body = payload;
-        }
-      }
-      return this;
-    }),
-  } as unknown as ServerResponse & { _body?: unknown };
-  return res;
-}
-
-describe('SEC-LOG — Logging & Information Disclosure', () => {
-  describe('M6: sanitizeError never echoes internal detail', () => {
-    it('returns a non-empty generic string', () => {
-      const out = sanitizeError(LEAKY);
-      expect(typeof out).toBe('string');
-      expect(out.length).toBeGreaterThan(0);
-    });
-
-    it('strips internal hostnames, ports and file paths from Error messages', () => {
-      const out = sanitizeError(LEAKY);
-      expect(out).not.toContain('10.0.0.19');
-      expect(out).not.toContain('8123');
-      expect(out).not.toContain('/volume1');
-      expect(out).not.toContain('ECONNREFUSED');
-    });
-
-    it('does not echo raw non-Error values', () => {
-      const out = sanitizeError('raw secret /volume1/docker/.env token=abc123');
-      expect(out).not.toContain('/volume1');
-      expect(out).not.toContain('abc123');
-    });
-
-    it('supports a caller-supplied generic fallback', () => {
-      expect(sanitizeError(LEAKY, 'Upstream request failed')).toBe('Upstream request failed');
-    });
-  });
-
-  describe('M6: handleRestApi 500 path returns a generic message', () => {
-    it('does not leak the upstream error detail to the client', async () => {
-      const client = { getStates: vi.fn().mockRejectedValue(LEAKY) } as unknown as HaClient;
-      const req = mockReq('GET', '/api/states');
-      const res = mockRes();
-
-      await handleRestApi(req, res, '/api/states', client);
-
-      expect(res.statusCode).toBe(500);
-      const body = JSON.stringify(res._body);
-      expect(body).not.toContain('10.0.0.19');
-      expect(body).not.toContain('/volume1');
-      expect(body).not.toContain('ECONNREFUSED');
-    });
-  });
-
-  describe('M7: /health discloses liveness only', () => {
-    it('returns status only — no version, auth method, or internal AI URLs', () => {
-      const res = mockRes();
-
-      handleHealthCheck(res);
-
-      const body = res._body as Record<string, unknown>;
-      expect(body).toEqual({ status: 'healthy' });
-
-      // Defense in depth: the serialized body carries none of the old internals.
-      const serialized = JSON.stringify(body);
-      expect(serialized).not.toContain('version');
-      expect(serialized).not.toContain('authMethod');
-      expect(serialized).not.toContain('aiUrl');
-      expect(serialized).not.toContain('aiProvider');
-      expect(body).not.toHaveProperty('rateLimitEnabled');
-      expect(body).not.toHaveProperty('eventsConnectedClients');
-    });
-  });
-});
-
-// Avoid unused-type lint on the IncomingMessage import in some configs.
-export type _LogTestReq = IncomingMessage;

package/tests/security/resourceConsumption.test.ts

@@ -1,142 +0,0 @@
-/**
- * SEC-DOS — Unrestricted Resource Consumption
- * OWASP A04 (Rate Limiting) / API4:2023 (Unrestricted Resource Consumption).
- *
- * Findings covered:
- *   M4 — the rate limiter keyed on the spoofable X-Forwarded-For / X-Real-IP
- *        headers, letting an attacker forge a new IP per request to evade limits
- *        AND grow the bucket Map without bound. Secure behavior: trust forwarding
- *        headers ONLY when the immediate peer is a configured trusted proxy;
- *        otherwise key on the socket address.
- *   M5 — request bodies had no size cap and the server set no slowloris timeouts.
- *        Secure behavior: parseBody rejects oversize bodies (413) and destroys the
- *        socket; the server is created with explicit request/headers/keep-alive
- *        timeouts.
- */
-
-import { describe, it, expect, vi } from 'vitest';
-import type { IncomingMessage } from 'node:http';
-import { RateLimiter } from '../../src/server/rateLimiter.js';
-import { parseBody, MAX_BODY_BYTES } from '../../src/server/http.js';
-
-/** Build a fake request with controllable headers and socket address. */
-function fakeReq(opts: {
-  url?: string;
-  remoteAddress?: string;
-  headers?: Record<string, string | string[] | undefined>;
-}): IncomingMessage {
-  return {
-    url: opts.url ?? '/mcp',
-    method: 'POST',
-    headers: opts.headers ?? {},
-    socket: { remoteAddress: opts.remoteAddress ?? '203.0.113.7' },
-  } as unknown as IncomingMessage;
-}
-
-describe('SEC-DOS — Unrestricted Resource Consumption', () => {
-  describe('M4: rate limiter ignores spoofable forwarding headers by default', () => {
-    it('keys on the socket address, not a forged X-Forwarded-For', () => {
-      const rl = new RateLimiter({ maxRequests: 2, windowMs: 60000 });
-
-      // Same socket, attacker rotates X-Forwarded-For each request to dodge limits.
-      const mk = (xff: string) =>
-        fakeReq({ remoteAddress: '198.51.100.5', headers: { 'x-forwarded-for': xff } });
-
-      expect(rl.check(mk('1.1.1.1')).allowed).toBe(true);
-      expect(rl.check(mk('2.2.2.2')).allowed).toBe(true);
-      // Third request from the same socket must be blocked despite a fresh XFF.
-      expect(rl.check(mk('3.3.3.3')).allowed).toBe(false);
-
-      rl.stop();
-    });
-
-    it('does not create unbounded buckets from forged headers', () => {
-      const rl = new RateLimiter({ maxRequests: 1000, windowMs: 60000 });
-      for (let i = 0; i < 50; i++) {
-        rl.check(fakeReq({ remoteAddress: '198.51.100.9', headers: { 'x-forwarded-for': `10.0.0.${i}` } }));
-      }
-      // All 50 requests shared ONE socket → exactly one bucket, not 50.
-      expect(rl.getStats().totalEntries).toBe(1);
-      rl.stop();
-    });
-
-    it('honors CF-Connecting-IP only when the peer is a trusted proxy', () => {
-      const rl = new RateLimiter({
-        maxRequests: 100,
-        windowMs: 60000,
-        trustedProxies: ['198.51.100.1'],
-      });
-
-      // Peer IS the trusted proxy → distinct client IPs get distinct buckets.
-      rl.check(fakeReq({ remoteAddress: '198.51.100.1', headers: { 'cf-connecting-ip': 'a.a.a.a' } }));
-      rl.check(fakeReq({ remoteAddress: '198.51.100.1', headers: { 'cf-connecting-ip': 'b.b.b.b' } }));
-      expect(rl.getStats().totalEntries).toBe(2);
-
-      rl.stop();
-    });
-
-    it('ignores forwarding headers when the peer is NOT trusted', () => {
-      const rl = new RateLimiter({
-        maxRequests: 100,
-        windowMs: 60000,
-        trustedProxies: ['198.51.100.1'],
-      });
-
-      // Peer is some random host claiming to be a proxy → headers ignored, one bucket.
-      rl.check(fakeReq({ remoteAddress: '203.0.113.50', headers: { 'cf-connecting-ip': 'a.a.a.a' } }));
-      rl.check(fakeReq({ remoteAddress: '203.0.113.50', headers: { 'cf-connecting-ip': 'b.b.b.b' } }));
-      expect(rl.getStats().totalEntries).toBe(1);
-
-      rl.stop();
-    });
-  });
-
-  describe('M5: request body size cap', () => {
-    /** Minimal EventEmitter-like request that streams the given chunks. */
-    function streamingReq(chunks: Buffer[]): IncomingMessage & { destroy: ReturnType<typeof vi.fn> } {
-      const handlers: Record<string, ((arg?: unknown) => void)[]> = {};
-      const req = {
-        destroy: vi.fn(),
-        on(event: string, cb: (arg?: unknown) => void) {
-          (handlers[event] ??= []).push(cb);
-          if (event === 'end') {
-            queueMicrotask(() => {
-              for (const chunk of chunks) {
-                for (const d of handlers['data'] ?? []) d(chunk);
-              }
-              for (const e of handlers['end'] ?? []) e();
-            });
-          }
-          return req;
-        },
-      } as unknown as IncomingMessage & { destroy: ReturnType<typeof vi.fn> };
-      return req;
-    }
-
-    it('exposes a sane default body cap (1 MB)', () => {
-      expect(MAX_BODY_BYTES).toBe(1024 * 1024);
-    });
-
-    it('parses a small JSON body normally', async () => {
-      const req = streamingReq([Buffer.from(JSON.stringify({ hello: 'world' }))]);
-      await expect(parseBody(req)).resolves.toEqual({ hello: 'world' });
-    });
-
-    it('rejects an oversize body with a 413 error and destroys the socket', async () => {
-      const big = Buffer.alloc(2048, 0x61); // 2 KB
-      const req = streamingReq([big]);
-
-      await expect(parseBody(req, 1024)).rejects.toMatchObject({ statusCode: 413 });
-      expect(req.destroy).toHaveBeenCalled();
-    });
-
-    it('rejects a malformed JSON body with a client-side 400, not a 500', async () => {
-      // A body the client mis-escaped (e.g. bash-style `\"` from a Windows shell)
-      // arrives as invalid JSON. It is the client's fault, so parseBody tags it 400
-      // and the request handler surfaces "400 Bad Request" instead of a generic 500.
-      const req = streamingReq([Buffer.from('{\\"jsonrpc\\":\\"2.0\\"}')]);
-
-      await expect(parseBody(req)).rejects.toMatchObject({ statusCode: 400 });
-    });
-  });
-});

package/tests/server/auth.test.ts

@@ -1,249 +0,0 @@
-/**
- * JWT authentication middleware tests
- */
-
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-import type { IncomingMessage, ServerResponse } from 'node:http';
-import { createAuthMiddleware } from '../../src/server/auth.js';
-import { createJwt } from '../../src/utils/jwt.js';
-import { logger } from '../../src/utils/logger.js';
-
-vi.mock('../../src/utils/logger.js');
-
-const SECRET = 'test-secret-key-32chars-minimum!';
-
-describe('Auth Middleware', () => {
-  let mockReq: Partial<IncomingMessage>;
-  let mockRes: Partial<ServerResponse>;
-  let responseData: { statusCode?: number; headers: Record<string, string>; body?: string };
-
-  beforeEach(() => {
-    responseData = { headers: {} };
-
-    mockReq = {
-      url: '/api/states',
-      method: 'GET',
-      headers: {},
-      socket: { remoteAddress: '127.0.0.1' } as any,
-    };
-
-    mockRes = {
-      statusCode: 200,
-      setHeader: vi.fn((key: string, value: string) => {
-        responseData.headers[key] = value;
-        return mockRes as ServerResponse;
-      }),
-      end: vi.fn((body?: string) => {
-        responseData.body = body;
-        return mockRes as ServerResponse;
-      }) as unknown as ServerResponse['end'],
-    };
-
-    Object.defineProperty(mockRes, 'statusCode', {
-      get: () => responseData.statusCode,
-      set: (val) => { responseData.statusCode = val; },
-    });
-  });
-
-  describe('No Auth', () => {
-    it('should allow all requests when method is none', () => {
-      const middleware = createAuthMiddleware({ method: 'none' });
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-      expect(mockRes.end).not.toHaveBeenCalled();
-    });
-  });
-
-  describe('Bearer Auth', () => {
-    it('should allow request with valid token', () => {
-      const token = createJwt({ sub: 'user1' }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-      expect(mockRes.end).not.toHaveBeenCalled();
-    });
-
-    it('should attach AuthInfo to request with payload in extra', () => {
-      const token = createJwt({ sub: 'admin', role: 'superuser' }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      const authReq = mockReq as IncomingMessage & { auth?: { clientId?: string; extra?: { payload?: { sub?: string; role?: string } } } };
-      // AuthInfo.clientId is set to JWT sub
-      expect(authReq.auth?.clientId).toBe('admin');
-      // JWT payload is in authInfo.extra.payload
-      expect(authReq.auth?.extra?.payload?.sub).toBe('admin');
-      expect(authReq.auth?.extra?.payload?.role).toBe('superuser');
-    });
-
-    it('should reject request without Authorization header', () => {
-      mockReq.headers = {};
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(401);
-      expect(responseData.headers['WWW-Authenticate']).toBe('Bearer');
-      expect(responseData.body).toContain('Missing Authorization header');
-    });
-
-    it('should reject request with invalid signature', () => {
-      const token = createJwt({ sub: 'user1' }, 'wrong-secret');
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(401);
-      expect(responseData.body).toContain('bad signature');
-    });
-
-    it('should reject expired token', () => {
-      const token = createJwt({ sub: 'user1', exp: Math.floor(Date.now() / 1000) - 60 }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(401);
-      expect(responseData.body).toContain('expired');
-    });
-
-    it('should reject malformed Authorization header', () => {
-      mockReq.headers = { authorization: 'Basic dXNlcjpwYXNz' };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(401);
-      expect(responseData.body).toContain('Expected: Bearer');
-    });
-
-    it('should return 500 if bearer auth enabled but no secret configured', () => {
-      const token = createJwt({ sub: 'user1' }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: undefined });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(500);
-      expect(responseData.body).toContain('misconfiguration');
-    });
-  });
-
-  describe('Skip Paths', () => {
-    it('should skip auth for exact path match', () => {
-      mockReq.url = '/health';
-      mockReq.headers = {};
-      const middleware = createAuthMiddleware({
-        method: 'bearer',
-        secret: SECRET,
-        skipPaths: ['/health'],
-      });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-    });
-
-    it('should skip auth for path prefix', () => {
-      mockReq.url = '/health/detailed';
-      mockReq.headers = {};
-      const middleware = createAuthMiddleware({
-        method: 'bearer',
-        secret: SECRET,
-        skipPaths: ['/health'],
-      });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-    });
-
-    it('should require auth for non-skipped paths', () => {
-      mockReq.url = '/api/states';
-      mockReq.headers = {};
-      const middleware = createAuthMiddleware({
-        method: 'bearer',
-        secret: SECRET,
-        skipPaths: ['/health'],
-      });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(false);
-      expect(responseData.statusCode).toBe(401);
-    });
-
-    it('should handle query strings in URL', () => {
-      mockReq.url = '/health?check=true';
-      mockReq.headers = {};
-      const middleware = createAuthMiddleware({
-        method: 'bearer',
-        secret: SECRET,
-        skipPaths: ['/health'],
-      });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-    });
-  });
-
-  describe('Bearer Payload Claims', () => {
-    it('should allow token with future exp', () => {
-      const token = createJwt({ sub: 'user1', exp: Math.floor(Date.now() / 1000) + 3600 }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-    });
-
-    it('should allow token without exp (no expiration)', () => {
-      const token = createJwt({ sub: 'service-account' }, SECRET);
-      mockReq.headers = { authorization: `Bearer ${token}` };
-      const middleware = createAuthMiddleware({ method: 'bearer', secret: SECRET });
-
-      const result = middleware(mockReq as IncomingMessage, mockRes as ServerResponse);
-
-      expect(result).toBe(true);
-    });
-  });
-});
-
-describe('Auth Middleware - permissive defaultRole warning', () => {
-  beforeEach(() => {
-    vi.mocked(logger.warn).mockClear();
-  });
-
-  const warnedAboutDefaultRole = (): boolean =>
-    vi.mocked(logger.warn).mock.calls.some(([msg]) => String(msg).includes('defaultRole'));
-
-  it('warns at creation when bearer auth has a defaultRole that grants access', () => {
-    createAuthMiddleware({ method: 'bearer', secret: SECRET, permissions: { users: [], defaultRole: 'OPERATOR' } });
-    expect(warnedAboutDefaultRole()).toBe(true);
-  });
-
-  it('stays silent when defaultRole is NONE', () => {
-    createAuthMiddleware({ method: 'bearer', secret: SECRET, permissions: { users: [], defaultRole: 'NONE' } });
-    expect(warnedAboutDefaultRole()).toBe(false);
-  });
-
-  it('stays silent when auth is not bearer (defaultRole is never applied)', () => {
-    createAuthMiddleware({ method: 'none', permissions: { users: [], defaultRole: 'OPERATOR' } });
-    expect(warnedAboutDefaultRole()).toBe(false);
-  });
-});