0pt/tests/auth/middleware-internal-token.test.ts

/**
 * P014 regression test: before this pass, POST /api/0pt/quality/bridge-run
 * -- the ONE route the Python engine's quality_bridge.py actually calls,
 * using X-Internal-Token, never a Bearer token -- was rejected 401 by
 * middleware.ts in any environment enforcing auth (the default), because
 * middleware required a verified Zitadel Bearer token unconditionally on
 * every /api/0pt/* path. See src/auth/internal-token.ts's doc comment for
 * the full story. Neither existing test suite caught it: the TS bridge test
 * calls the route's POST function directly (bypassing middleware.ts
 * entirely) and the Python test mocks the HTTP layer.
 *
 * This test exercises the actual `middleware` function, not the route
 * handler, so it proves the fix at the layer where the bug lived.
 */
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
import { NextRequest } from 'next/server';
import { middleware } from '../../middleware';

function req(path: string, headers: Record<string, string> = {}): NextRequest {
  return new NextRequest(new URL(path, 'http://localhost'), { headers });
}

describe('middleware.ts: internal-token path for /api/0pt/quality/bridge-run', () => {
  const saved = { auth: process.env.AUTH_ENFORCE, internal: process.env.INTERNAL_TOKEN, node: process.env.NODE_ENV };

  beforeEach(() => {
    delete process.env.AUTH_ENFORCE; // default posture: enforced
    process.env.INTERNAL_TOKEN = 'engine-shared-secret';
  });

  afterEach(() => {
    for (const [k, v] of Object.entries(saved)) {
      const envKey = k === 'auth' ? 'AUTH_ENFORCE' : k === 'internal' ? 'INTERNAL_TOKEN' : 'NODE_ENV';
      if (v === undefined) delete process.env[envKey];
      else process.env[envKey] = v;
    }
  });

  it('REGRESSION: a valid X-Internal-Token lets the engine through with NO Bearer token (was: 401)', async () => {
    const res = await middleware(
      req('/api/0pt/quality/bridge-run', { 'x-internal-token': 'engine-shared-secret' }),
    );
    // NextResponse.next() carries no body/status override -- it is not an
    // error JSON response the way a rejection is.
    expect(res.status).toBe(200);
  });

  it('an invalid X-Internal-Token still falls through to the ordinary Bearer requirement (401, not a bypass)', async () => {
    const res = await middleware(req('/api/0pt/quality/bridge-run', { 'x-internal-token': 'wrong-secret' }));
    expect(res.status).toBe(401);
    const body = await res.json();
    expect(body.error).toBe('OPT_UNAUTHENTICATED');
  });

  it('a valid X-Internal-Token on a DIFFERENT /api/0pt/* route does NOT bypass auth (not a blanket exemption)', async () => {
    const res = await middleware(req('/api/0pt/sources', { 'x-internal-token': 'engine-shared-secret' }));
    expect(res.status).toBe(401);
  });

  it('no INTERNAL_TOKEN configured on the edge -- the internal-token path never activates, even with the right-looking header', async () => {
    delete process.env.INTERNAL_TOKEN;
    const res = await middleware(
      req('/api/0pt/quality/bridge-run', { 'x-internal-token': 'engine-shared-secret' }),
    );
    expect(res.status).toBe(401);
  });

  it('a real Bearer-authenticated caller can still reach bridge-run directly (not internal-token-only)', async () => {
    // No X-Internal-Token at all, no Authorization header either -> falls to
    // the normal Bearer requirement -> 401, proving this path is additive,
    // not a replacement for the existing Zitadel flow.
    const res = await middleware(req('/api/0pt/quality/bridge-run'));
    expect(res.status).toBe(401);
  });
});