@jskit-ai/auth-provider-local-core 0.1.15 → 0.1.17

package/package.descriptor.mjs

@@ -1,7 +1,7 @@
 export default Object.freeze({
   "packageVersion": 1,
   "packageId": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "kind": "runtime",
   "description": "Local auth provider with a file backend default and no database requirement.",
   "dependsOn": [
@@ -54,11 +54,18 @@ export default Object.freeze({
       }
     }
   },
+  "ci": {
+    "environment": {
+      "AUTH_PROVIDER": "local"
+    },
+    "services": [],
+    "steps": []
+  },
   "mutations": {
     "dependencies": {
       "runtime": {
-        "@jskit-ai/auth-core": "0.1.114",
-        "@jskit-ai/kernel": "0.1.116",
+        "@jskit-ai/auth-core": "0.1.115",
+        "@jskit-ai/kernel": "0.1.118",
         "nodemailer": "^7.0.10",
         "dotenv": "^16.4.5"
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jskit-ai/auth-provider-local-core",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "type": "module",
   "scripts": {
     "test": "node --test"
@@ -11,8 +11,8 @@
     "./server/lib/index": "./src/server/lib/index.js"
   },
   "dependencies": {
-    "@jskit-ai/auth-core": "0.1.114",
-    "@jskit-ai/kernel": "0.1.116",
+    "@jskit-ai/auth-core": "0.1.115",
+    "@jskit-ai/kernel": "0.1.118",
     "nodemailer": "^7.0.10"
   }
 }

package/src/server/lib/service.js

@@ -6,6 +6,12 @@ import {
 import { normalizeAuthCapabilities } from "@jskit-ai/auth-core/shared/authCapabilities";
 import { buildSecurityStatusFromAuthMethodsStatus } from "@jskit-ai/auth-core/shared/authSecurityStatus";
 import { normalizeAuthActor, normalizeAuthResult } from "@jskit-ai/auth-core/server/authActor";
+import {
+  assertDevAuthPolicy,
+  ensureDevAuthExchangeAvailable,
+  ensureDevAuthRuntimeAvailable,
+  resolveDevAuthPolicy
+} from "@jskit-ai/auth-core/server/devAuth";
 import { normalizeEmail } from "@jskit-ai/auth-core/server/utils";
 import { throwUnsupportedAuthOperation } from "@jskit-ai/auth-core/server/unsupportedOperation";
 import { normalizePasswordStrategy } from "./passwords.js";
@@ -15,6 +21,7 @@ const ACCESS_TOKEN_COOKIE = "jskit_local_access_token";
 const REFRESH_TOKEN_COOKIE = "jskit_local_refresh_token";
 const RECOVERY_TOKEN_COOKIE = "jskit_local_recovery_token";
 const PROVIDER_ID = "local";
+const DEV_AUTH_SESSION_PURPOSE = "dev-auth";
 const ACCESS_TTL_SECONDS = 15 * 60;
 const REFRESH_TTL_SECONDS = 60 * 60 * 24 * 30;
 const RECOVERY_SESSION_TTL_SECONDS = 15 * 60;
@@ -36,6 +43,14 @@ function isNormalSession(session) {
   return (session?.purpose || "normal") === "normal";
 }
 
+function isDevAuthSession(session) {
+  return session?.purpose === DEV_AUTH_SESSION_PURPOSE;
+}
+
+function isAuthenticatingSession(session) {
+  return isNormalSession(session) || isDevAuthSession(session);
+}
+
 function normalizeDisplayName(value, email) {
   const displayName = String(value || "").trim();
   if (displayName) {
@@ -52,6 +67,15 @@ function safeRequestCookies(request) {
   return request && request.cookies && typeof request.cookies === "object" ? request.cookies : {};
 }
 
+function unauthenticatedAuthResult(clearSession = false) {
+  return {
+    authenticated: false,
+    clearSession: Boolean(clearSession),
+    session: null,
+    transientFailure: false
+  };
+}
+
 function cookieOptions(isProduction, maxAge) {
   return {
     path: "/",
@@ -92,21 +116,59 @@ function buildActor(user, profile = null) {
   });
 }
 
-async function buildAuthPayload({ user, session, profileProjector, profileOptions = {} }) {
-  let profile = buildProfile(user);
-  if (profileProjector && typeof profileProjector.syncIdentityProfile === "function") {
-    profile = await profileProjector.syncIdentityProfile(profile, profileOptions);
-    if (!profile || typeof profile !== "object") {
-      throw new Error("auth.profile.projector.syncIdentityProfile() must return a profile object.");
-    }
-  }
+function buildAuthResult({ user, session, appProfile = null }) {
   return normalizeAuthResult({
-    profile,
-    actor: buildActor(user, profileProjector ? profile : null),
+    profile: appProfile || buildProfile(user),
+    actor: buildActor(user, appProfile),
     session
   });
 }
 
+function requireProfileResult(profile, methodName) {
+  if (!profile || typeof profile !== "object") {
+    throw new Error(`auth.profile.projector.${methodName}() must return a profile object.`);
+  }
+  return profile;
+}
+
+async function buildAuthPayload({ user, session, profileProjector, profileOptions = {} }) {
+  const appProfile = profileProjector
+    ? requireProfileResult(
+        await profileProjector.syncIdentityProfile(buildProfile(user), profileOptions),
+        "syncIdentityProfile"
+      )
+    : null;
+  return buildAuthResult({ user, session, appProfile });
+}
+
+async function findExistingAppProfile(user, profileProjector) {
+  if (!profileProjector) {
+    return null;
+  }
+  if (typeof profileProjector.findByIdentity !== "function") {
+    throw new Error(
+      "auth.profile.projector.findByIdentity() is required for dev auth impersonation."
+    );
+  }
+  const profile = await profileProjector.findByIdentity(buildProfile(user));
+  return profile ? requireProfileResult(profile, "findByIdentity") : null;
+}
+
+async function buildSessionAuthPayload({ devAuth, profileProjector, request, session, user }) {
+  if (!isDevAuthSession(session)) {
+    return buildAuthPayload({ user, session: null, profileProjector });
+  }
+  try {
+    ensureDevAuthRuntimeAvailable(devAuth, request);
+  } catch {
+    return null;
+  }
+  const appProfile = await findExistingAppProfile(user, profileProjector);
+  return profileProjector && !appProfile
+    ? null
+    : buildAuthResult({ user, session: null, appProfile });
+}
+
 function buildAccessToken({ user, session, secret, ttlSeconds = ACCESS_TTL_SECONDS }) {
   const issuedAt = nowSeconds();
   return signToken(
@@ -166,6 +228,22 @@ function validateEmailInput(email) {
   return normalized;
 }
 
+function devLoginAsValidationError(fieldErrors = {}) {
+  const messages = Object.values(fieldErrors).filter(Boolean);
+  return new AppError(400, messages[0] || "Provide a user id or email.", {
+    details: {
+      fieldErrors
+    }
+  });
+}
+
+function devLoginAsUserNotFound({ email = "", userId = "" } = {}) {
+  return devLoginAsValidationError({
+    ...(userId ? { userId: "User not found." } : {}),
+    ...(email ? { email: "User not found." } : {})
+  });
+}
+
 function normalizeInvitationInput(value = null) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return null;
@@ -221,6 +299,10 @@ function createLocalAuthService({
 
   const passwords = normalizePasswordStrategy(passwordStrategy);
   const isProduction = config.nodeEnv === "production";
+  const devAuth = config.devAuth || resolveDevAuthPolicy({
+    nodeEnv: config.nodeEnv
+  });
+  assertDevAuthPolicy(devAuth);
   const profileProjectionEnabled = typeof profileProjector?.syncIdentityProfile === "function";
   const recoveryDelivery = config.smtpConfigured
     ? "smtp"
@@ -262,7 +344,8 @@ function createLocalAuthService({
       },
       securityStatus: true,
       signOutOtherSessions: true,
-      appProfileProjection: profileProjectionEnabled
+      appProfileProjection: profileProjectionEnabled,
+      devLoginAs: devAuth.enabled === true && devAuth.isProduction !== true
     }
   });
 
@@ -367,6 +450,40 @@ function createLocalAuthService({
     });
   }
 
+  function isDevAuthBootstrapEnabled() {
+    return devAuth.enabled === true && devAuth.isProduction !== true;
+  }
+
+  async function devLoginAs(request, input = {}) {
+    ensureDevAuthExchangeAvailable(devAuth, request);
+    const userId = String(input?.userId || "").trim();
+    const email = normalizeEmail(input?.email || "");
+    if (!userId && !email) {
+      throw devLoginAsValidationError({
+        userId: "Provide a user id or email.",
+        email: "Provide a user id or email."
+      });
+    }
+
+    return backend.withTransaction(async (tx) => {
+      let user = userId ? await tx.users.findById(userId) : null;
+      if (!user && email) {
+        user = await tx.users.findByEmail(email);
+      }
+      if (!user || user.disabled) {
+        throw devLoginAsUserNotFound({ email, userId });
+      }
+      const appProfile = await findExistingAppProfile(user, profileProjector);
+      if (profileProjector && !appProfile) {
+        throw devLoginAsUserNotFound({ email, userId });
+      }
+      const session = await createSessionForUser(tx, user, {
+        purpose: DEV_AUTH_SESSION_PURPOSE
+      });
+      return buildAuthResult({ user, session, appProfile });
+    });
+  }
+
   async function authenticateRequest(request) {
     const cookies = safeRequestCookies(request);
     const accessToken = String(cookies[ACCESS_TOKEN_COOKIE] || "").trim();
@@ -386,10 +503,20 @@ function createLocalAuthService({
           }
           return { user, session };
         });
-        if (resolved && isNormalSession(resolved.session)) {
+        if (resolved && isAuthenticatingSession(resolved.session)) {
+          const authPayload = await buildSessionAuthPayload({
+            devAuth,
+            profileProjector,
+            request,
+            session: resolved.session,
+            user: resolved.user
+          });
+          if (!authPayload) {
+            return unauthenticatedAuthResult(true);
+          }
           return {
             authenticated: true,
-            ...(await buildAuthPayload({ user: resolved.user, session: null, profileProjector })),
+            ...authPayload,
             session: null,
             sessionPurpose: resolved.session.purpose || "normal",
             clearSession: false,
@@ -400,36 +527,32 @@ function createLocalAuthService({
     }
 
     if (!refreshToken) {
-      return {
-        authenticated: false,
-        clearSession: Boolean(accessToken),
-        session: null,
-        transientFailure: false
-      };
+      return unauthenticatedAuthResult(Boolean(accessToken));
     }
 
     const resolved = await resolveValidSessionByRefreshToken(refreshToken);
     if (!resolved) {
-      return {
-        authenticated: false,
-        clearSession: true,
-        session: null,
-        transientFailure: false
-      };
+      return unauthenticatedAuthResult(true);
     }
 
-    if (!isNormalSession(resolved.session)) {
-      return {
-        authenticated: false,
-        clearSession: false,
-        session: null,
-        transientFailure: false
-      };
+    if (!isAuthenticatingSession(resolved.session)) {
+      return unauthenticatedAuthResult();
+    }
+
+    const authPayload = await buildSessionAuthPayload({
+      devAuth,
+      profileProjector,
+      request,
+      session: resolved.session,
+      user: resolved.user
+    });
+    if (!authPayload) {
+      return unauthenticatedAuthResult(true);
     }
 
     return {
       authenticated: true,
-      ...(await buildAuthPayload({ user: resolved.user, session: null, profileProjector })),
+      ...authPayload,
       session: buildSessionPayload({
         user: resolved.user,
         session: resolved.session,
@@ -686,6 +809,8 @@ function createLocalAuthService({
 
   return Object.freeze({
     getCapabilities,
+    isDevAuthBootstrapEnabled,
+    devLoginAs,
     authenticateRequest,
     hasAccessTokenCookie(request) {
       return Boolean(safeRequestCookies(request)[ACCESS_TOKEN_COOKIE] || safeRequestCookies(request)[RECOVERY_TOKEN_COOKIE]);

package/src/server/providers/AuthLocalServiceProvider.js

@@ -1,4 +1,9 @@
 import { applyAuthServiceDecorators } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
+import { parseBooleanFlag } from "@jskit-ai/auth-core/server/booleanFlag";
+import {
+  assertDevAuthPolicy,
+  resolveDevAuthPolicyFromEnv
+} from "@jskit-ai/auth-core/server/devAuth";
 import fs from "node:fs";
 import path from "node:path";
 import { randomBytes } from "node:crypto";
@@ -12,20 +17,6 @@ function resolveLocalBackendMode(scope) {
   return String(env.AUTH_LOCAL_BACKEND || "file").trim().toLowerCase() || "file";
 }
 
-function parseBoolean(value, fallback = false) {
-  const raw = String(value || "").trim().toLowerCase();
-  if (!raw) {
-    return fallback;
-  }
-  if (["1", "true", "yes", "on"].includes(raw)) {
-    return true;
-  }
-  if (["0", "false", "no", "off"].includes(raw)) {
-    return false;
-  }
-  return fallback;
-}
-
 function resolveRuntimeEnv(scope) {
   const env = scope && typeof scope.has === "function" && scope.has("jskit.env") ? scope.make("jskit.env") : {};
   return {
@@ -91,7 +82,7 @@ function resolveSmtpConfig(env) {
     smtp: {
       host,
       port: Number(env.AUTH_LOCAL_SMTP_PORT || 587),
-      secure: parseBoolean(env.AUTH_LOCAL_SMTP_SECURE, false),
+      secure: parseBooleanFlag(env.AUTH_LOCAL_SMTP_SECURE, false),
       user: String(env.AUTH_LOCAL_SMTP_USER || "").trim(),
       password: String(env.AUTH_LOCAL_SMTP_PASSWORD || ""),
       from,
@@ -130,10 +121,12 @@ function resolveConfig(scope) {
   const isProduction = nodeEnv === "production";
   const backend = String(env.AUTH_LOCAL_BACKEND || "file").trim().toLowerCase() || "file";
   const storeDir = resolveStoreDir(env);
-  if (backend === "file" && isProduction && !parseBoolean(env.AUTH_LOCAL_FILE_PRODUCTION_ACK, false)) {
+  if (backend === "file" && isProduction && !parseBooleanFlag(env.AUTH_LOCAL_FILE_PRODUCTION_ACK, false)) {
     throw new Error("AUTH_LOCAL_FILE_PRODUCTION_ACK is required to use the local file auth backend in production.");
   }
   const smtp = resolveSmtpConfig(env);
+  const devAuth = resolveDevAuthPolicyFromEnv(env);
+  assertDevAuthPolicy(devAuth);
   return {
     backend,
     storeDir,
@@ -145,10 +138,32 @@ function resolveConfig(scope) {
       isProduction
     }),
     recoveryDevOutput: String(env.AUTH_LOCAL_RECOVERY_DEV_OUTPUT || "log").trim().toLowerCase() || "log",
+    devAuth,
     ...smtp
   };
 }
 
+function createLazyProfileProjector(scope) {
+  if (!scope.has("auth.profile.projector")) {
+    return null;
+  }
+  const resolveMethod = (methodName) => {
+    const projector = scope.make("auth.profile.projector");
+    if (!projector || typeof projector[methodName] !== "function") {
+      throw new Error(`auth.profile.projector.${methodName}() must be a function.`);
+    }
+    return projector[methodName].bind(projector);
+  };
+  return {
+    findByIdentity(identity, options = {}) {
+      return resolveMethod("findByIdentity")(identity, options);
+    },
+    syncIdentityProfile(profile, options = {}) {
+      return resolveMethod("syncIdentityProfile")(profile, options);
+    }
+  };
+}
+
 class AuthLocalServiceProvider {
   static id = "auth.provider.local";
 
@@ -178,17 +193,7 @@ class AuthLocalServiceProvider {
         throw new Error(`AUTH_LOCAL_BACKEND="${config.backend}" requires a package or app provider that registers auth.local.backend.`);
       }
       const backend = scope.make("auth.local.backend");
-      const profileProjector = scope.has("auth.profile.projector")
-        ? {
-            async syncIdentityProfile(profile, options = {}) {
-              const projector = scope.make("auth.profile.projector");
-              if (!projector || typeof projector.syncIdentityProfile !== "function") {
-                throw new Error("auth.profile.projector.syncIdentityProfile() must be a function.");
-              }
-              return projector.syncIdentityProfile(profile, options);
-            }
-          }
-        : null;
+      const profileProjector = createLazyProfileProjector(scope);
       const invitationContextResolver = scope.has("auth.invitationContextResolver")
         ? {
             async resolveInvitationContext(invitation, options = {}) {

package/test/packageDescriptor.test.js

@@ -0,0 +1,13 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import descriptor from "../package.descriptor.mjs";
+
+test("local auth contributes only its provider selection to CI", () => {
+  assert.deepEqual(descriptor.ci, {
+    environment: {
+      AUTH_PROVIDER: "local"
+    },
+    services: [],
+    steps: []
+  });
+});

package/test/providerRuntime.test.js

@@ -6,6 +6,7 @@ import test from "node:test";
 import { createApplication } from "@jskit-ai/kernel/_testable";
 import { ActionRuntimeServiceProvider } from "@jskit-ai/kernel/server/actions";
 import { registerAuthServiceDecorator } from "@jskit-ai/auth-core/server/authServiceDecoratorRegistry";
+import { DEV_AUTH_SECRET_HEADER } from "@jskit-ai/auth-core/server/devAuth";
 import { AuthActionsServiceProvider } from "@jskit-ai/auth-core/server/providers/AuthActionsServiceProvider";
 import { AuthLocalServiceProvider } from "../src/server/providers/AuthLocalServiceProvider.js";
 import { AuthProviderServiceProvider } from "../src/server/providers/AuthProviderServiceProvider.js";
@@ -18,6 +19,8 @@ import {
   verifyPassword
 } from "../src/server/lib/index.js";
 
+const DEV_AUTH_SECRET = "local-preview-exchange-secret";
+
 function createAppConfigFixture() {
   return {
     surfaceModeAll: "all",
@@ -52,7 +55,44 @@ function createReplyFixture() {
   };
 }
 
+function createLocalAuthRequest({
+  cookies = {},
+  headers = {},
+  host = "localhost:4100",
+  remoteAddress = "127.0.0.1"
+} = {}) {
+  return {
+    cookies,
+    headers: {
+      host,
+      ...headers
+    },
+    socket: {
+      remoteAddress
+    }
+  };
+}
+
+function createDevAuthExchangeRequest(options = {}) {
+  const request = createLocalAuthRequest(options);
+  return {
+    ...request,
+    headers: {
+      ...request.headers,
+      [DEV_AUTH_SECRET_HEADER]: DEV_AUTH_SECRET
+    }
+  };
+}
+
+function devAuthEnv() {
+  return {
+    AUTH_DEV_BYPASS_ENABLED: "true",
+    AUTH_DEV_BYPASS_SECRET: DEV_AUTH_SECRET
+  };
+}
+
 async function createStartedApp({
+  env = {},
   profileProjector = null,
   profileProjectorFactory = null,
   passwordStrategy = null,
@@ -68,7 +108,8 @@ async function createStartedApp({
     AUTH_LOCAL_STORE_DIR: storeDir,
     AUTH_LOCAL_RECOVERY_DEV_OUTPUT: "response",
     APP_PUBLIC_URL: "http://localhost:5173",
-    NODE_ENV: "test"
+    NODE_ENV: "test",
+    ...env
   });
   app.instance(
     "jskit.logger",
@@ -162,6 +203,179 @@ test("local auth provider registers, logs in, reads session, and logs out with f
   assert.match(usersFile, /^user:v1:/);
 });
 
+test("local file auth login-as issues native cookies for an existing user", async () => {
+  const { app } = await createStartedApp({
+    env: devAuthEnv()
+  });
+  const authService = app.make("authService");
+  await authService.register({
+    displayName: "Ada",
+    email: "ada@example.com",
+    password: "correct horse battery staple"
+  });
+
+  const impersonated = await authService.devLoginAs(createDevAuthExchangeRequest(), {
+    email: "ADA@EXAMPLE.COM"
+  });
+  assert.equal(impersonated.profile.email, "ada@example.com");
+  assert.equal(impersonated.session.purpose, "dev-auth");
+  assert.equal(authService.getCapabilities().features.devLoginAs, true);
+
+  const reply = createReplyFixture();
+  authService.writeSessionCookies(reply, impersonated.session);
+  assert.equal(Boolean(reply.cookies.jskit_local_access_token), true);
+  assert.equal(Boolean(reply.cookies.jskit_local_refresh_token), true);
+
+  const authenticated = await authService.authenticateRequest(createLocalAuthRequest({
+    cookies: reply.cookies
+  }));
+  assert.equal(authenticated.authenticated, true);
+  assert.equal(authenticated.actor.email, "ada@example.com");
+  assert.equal(authenticated.sessionPurpose, "dev-auth");
+});
+
+test("local login-as never invokes the mutating profile projector", async () => {
+  const projectedProfile = {
+    id: "app-user-ada",
+    authProvider: "local",
+    authProviderUserSid: "provider-user-ada",
+    displayName: "Ada",
+    email: "ada@example.com"
+  };
+  let findCalls = 0;
+  let syncCalls = 0;
+  const { app } = await createStartedApp({
+    env: devAuthEnv(),
+    profileProjector: {
+      async findByIdentity() {
+        findCalls += 1;
+        return projectedProfile;
+      },
+      async syncIdentityProfile(profile) {
+        syncCalls += 1;
+        return {
+          ...projectedProfile,
+          authProviderUserSid: profile.authProviderUserSid
+        };
+      }
+    }
+  });
+  const authService = app.make("authService");
+  const registered = await authService.register({
+    displayName: "Ada",
+    email: "ada@example.com",
+    password: "correct horse battery staple"
+  });
+  projectedProfile.authProviderUserSid = registered.actor.providerUserId;
+  findCalls = 0;
+  syncCalls = 0;
+
+  const impersonated = await authService.devLoginAs(createDevAuthExchangeRequest(), {
+    email: "ada@example.com"
+  });
+  const reply = createReplyFixture();
+  authService.writeSessionCookies(reply, impersonated.session);
+  const authenticated = await authService.authenticateRequest(createLocalAuthRequest({
+    cookies: reply.cookies
+  }));
+
+  assert.equal(impersonated.profile.id, "app-user-ada");
+  assert.equal(authenticated.profile.id, "app-user-ada");
+  assert.equal(findCalls, 2);
+  assert.equal(syncCalls, 0);
+});
+
+test("local login-as rejects missing, disabled, and unprojected users", async () => {
+  const { app } = await createStartedApp({
+    env: devAuthEnv(),
+    profileProjector: {
+      async findByIdentity() {
+        return null;
+      },
+      async syncIdentityProfile() {
+        throw new Error("preview login must not synchronize profiles");
+      }
+    }
+  });
+  const backend = app.make("auth.local.backend");
+  const password = await hashPassword("stored password value");
+  await backend.withTransaction(async (tx) => {
+    await tx.users.create({
+      disabled: false,
+      displayName: "Unprojected",
+      email: "unprojected@example.com",
+      id: "usr_unprojected",
+      password
+    });
+    await tx.users.create({
+      disabled: true,
+      displayName: "Disabled",
+      email: "disabled@example.com",
+      id: "usr_disabled",
+      password
+    });
+  });
+  const authService = app.make("authService");
+
+  for (const email of [
+    "missing@example.com",
+    "disabled@example.com",
+    "unprojected@example.com"
+  ]) {
+    await assert.rejects(
+      () => authService.devLoginAs(createDevAuthExchangeRequest(), { email }),
+      /User not found/
+    );
+  }
+});
+
+test("local login-as rejects missing, incorrect, and non-loopback exchange authorization", async () => {
+  const { app } = await createStartedApp({
+    env: devAuthEnv()
+  });
+  const authService = app.make("authService");
+  await authService.register({
+    displayName: "Ada",
+    email: "ada@example.com",
+    password: "correct horse battery staple"
+  });
+
+  await assert.rejects(
+    () => authService.devLoginAs(createLocalAuthRequest(), { email: "ada@example.com" }),
+    /not authorized/
+  );
+  await assert.rejects(
+    () => authService.devLoginAs(createLocalAuthRequest({
+      headers: {
+        [DEV_AUTH_SECRET_HEADER]: "wrong-secret"
+      }
+    }), { email: "ada@example.com" }),
+    /not authorized/
+  );
+  await assert.rejects(
+    () => authService.devLoginAs(createDevAuthExchangeRequest({
+      remoteAddress: "203.0.113.5"
+    }), { email: "ada@example.com" }),
+    /localhost/
+  );
+});
+
+test("local auth provider rejects dev login-as enablement in production", async () => {
+  await assert.rejects(
+    () => createStartedApp({
+      env: {
+        ...devAuthEnv(),
+        AUTH_LOCAL_FILE_PRODUCTION_ACK: "true",
+        AUTH_LOCAL_SESSION_SECRET: "production-session-secret",
+        NODE_ENV: "production"
+      }
+    }),
+    (error) => /must not be enabled in production/.test(
+      String(error.details?.cause?.message || error.message || "")
+    )
+  );
+});
+
 test("local auth provider applies auth service decorators for blocking and non-blocking hooks", async () => {
   const calls = [];
   const errors = [];