From 8414e891b3e4fac608b2735d331c9d09203479b0 Mon Sep 17 00:00:00 2001
From: Lucas Berger <me@lucasberger.ca>
Date: Sat, 13 Jun 2026 05:12:33 -0400
Subject: [PATCH] test(16-01): add failing tests for boot-time dev-bypass guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Three test cases: prod+bypass=exit(1), dev+bypass=no-exit, prod+unset=no-exit
- Fails with Cannot find module (src/lib/bootGuards.ts absent) — RED confirmed
---
 apps/api/tests/lib/bootGuards.test.ts | 74 +++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 apps/api/tests/lib/bootGuards.test.ts

diff --git a/apps/api/tests/lib/bootGuards.test.ts b/apps/api/tests/lib/bootGuards.test.ts
new file mode 100644
index 0000000..43970aa
--- /dev/null
+++ b/apps/api/tests/lib/bootGuards.test.ts
@@ -0,0 +1,74 @@
+/**
+ * assertNotDevBypassInProduction() — unit tests.
+ *
+ * Tests the three behavioral cases:
+ *  1. NODE_ENV='production' AND DEV_AUTH_BYPASS='true' → calls process.exit(1)
+ *  2. NODE_ENV='development' AND DEV_AUTH_BYPASS='true' → does NOT call process.exit
+ *  3. NODE_ENV='production' AND DEV_AUTH_BYPASS unset → does NOT call process.exit
+ */
+
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { assertNotDevBypassInProduction } from '../../src/lib/bootGuards.js';
+
+describe('assertNotDevBypassInProduction', () => {
+  const originalNodeEnv = process.env.NODE_ENV;
+  const originalBypassFlag = process.env.DEV_AUTH_BYPASS;
+
+  afterEach(() => {
+    // Restore env after each test
+    process.env.NODE_ENV = originalNodeEnv;
+    if (originalBypassFlag === undefined) {
+      delete process.env.DEV_AUTH_BYPASS;
+    } else {
+      process.env.DEV_AUTH_BYPASS = originalBypassFlag;
+    }
+  });
+
+  it('calls process.exit(1) when NODE_ENV=production and DEV_AUTH_BYPASS=true', () => {
+    process.env.NODE_ENV = 'production';
+    process.env.DEV_AUTH_BYPASS = 'true';
+
+    const exitSpy = vi
+      .spyOn(process, 'exit')
+      .mockImplementation((() => {
+        throw new Error('process.exit called');
+      }) as never);
+
+    expect(() => assertNotDevBypassInProduction()).toThrow('process.exit called');
+    expect(exitSpy).toHaveBeenCalledWith(1);
+
+    exitSpy.mockRestore();
+  });
+
+  it('does NOT call process.exit when NODE_ENV=development and DEV_AUTH_BYPASS=true', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.DEV_AUTH_BYPASS = 'true';
+
+    const exitSpy = vi
+      .spyOn(process, 'exit')
+      .mockImplementation((() => {
+        throw new Error('process.exit called');
+      }) as never);
+
+    expect(() => assertNotDevBypassInProduction()).not.toThrow();
+    expect(exitSpy).not.toHaveBeenCalled();
+
+    exitSpy.mockRestore();
+  });
+
+  it('does NOT call process.exit when NODE_ENV=production and DEV_AUTH_BYPASS is unset', () => {
+    process.env.NODE_ENV = 'production';
+    delete process.env.DEV_AUTH_BYPASS;
+
+    const exitSpy = vi
+      .spyOn(process, 'exit')
+      .mockImplementation((() => {
+        throw new Error('process.exit called');
+      }) as never);
+
+    expect(() => assertNotDevBypassInProduction()).not.toThrow();
+    expect(exitSpy).not.toHaveBeenCalled();
+
+    exitSpy.mockRestore();
+  });
+});