test(19-03): add failing tests for localAuthMiddleware and GET /api/auth/mode

- RED: 8 tests failing (modules not yet created)
- localAuthMiddleware: 4 tests for cookie→user shape, no-cookie passthrough, missing user row, devAuthBypass coexistence
- authMode: 3 tests for mode response with no oidc, env oidc, app_config oidc

apps/api/tests/routes/authMode.test.ts

@@ -0,0 +1,123 @@
+/**
+ * GET /api/auth/mode — unit tests (Plan 19-03, TDD RED → GREEN).
+ *
+ * Covers:
+ *   Test 5: returns { localEnabled:true, oidcEnabled:false } when no oidc_issuer in env or app_config
+ *   Test 6: returns { oidcEnabled:true } when OIDC_ISSUER env var is set
+ *   Test 6b: returns { oidcEnabled:true } when oidc_issuer is in app_config (no env var)
+ *
+ * Pre-auth surface: reachable without OIDC session (same as /api/setup/status).
+ */
+
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+
+// ---------------------------------------------------------------------------
+// DB mock — controls app_config rows returned for oidc_issuer
+// ---------------------------------------------------------------------------
+
+let mockAppConfigOidcIssuer: string | null = null;
+
+vi.mock('../../src/db/client.js', () => ({
+  db: {
+    execute: vi.fn().mockResolvedValue([[{ '1': 1 }]]),
+    select: vi.fn().mockImplementation(() => ({
+      from: vi.fn().mockReturnValue({
+        where: vi.fn().mockReturnValue({
+          limit: vi.fn().mockImplementation(() => {
+            if (mockAppConfigOidcIssuer) {
+              return Promise.resolve([{ value: mockAppConfigOidcIssuer }]);
+            }
+            return Promise.resolve([]);
+          }),
+        }),
+      }),
+    })),
+    insert: vi.fn().mockReturnValue({
+      values: vi.fn().mockReturnValue({
+        onDuplicateKeyUpdate: vi.fn().mockResolvedValue(undefined),
+      }),
+    }),
+  },
+}));
+
+vi.mock('@hono/oidc-auth', () => ({
+  oidcAuthMiddleware: () => async (_c: unknown, next: () => Promise<void>) => next(),
+  processOAuthCallback: () => async (c: { json: (v: unknown) => unknown }) => c.json({ ok: true }),
+  getAuth: vi.fn().mockResolvedValue(null),
+}));
+
+vi.mock('../../src/auth/devBypass.js', () => ({
+  devAuthBypass:
+    () => async (_c: unknown, next: () => Promise<void>) => next(),
+}));
+
+vi.mock('../../src/auth/localAuthMiddleware.js', () => ({
+  localAuthMiddleware:
+    () => async (_c: unknown, next: () => Promise<void>) => next(),
+}));
+
+// ---------------------------------------------------------------------------
+// Env snapshot
+// ---------------------------------------------------------------------------
+
+const originalOidcIssuer = process.env.OIDC_ISSUER;
+
+beforeEach(() => {
+  mockAppConfigOidcIssuer = null;
+  delete process.env.OIDC_ISSUER;
+  vi.resetModules();
+});
+
+afterEach(() => {
+  if (originalOidcIssuer === undefined) {
+    delete process.env.OIDC_ISSUER;
+  } else {
+    process.env.OIDC_ISSUER = originalOidcIssuer;
+  }
+  vi.resetModules();
+});
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('GET /api/auth/mode', () => {
+  it('Test 5: returns { localEnabled:true, oidcEnabled:false } when no oidc_issuer in env or app_config', async () => {
+    delete process.env.OIDC_ISSUER;
+    mockAppConfigOidcIssuer = null;
+
+    const { app } = await import('../../src/index.js');
+    const res = await app.request('/api/auth/mode');
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean };
+    expect(body.localEnabled).toBe(true);
+    expect(body.oidcEnabled).toBe(false);
+  });
+
+  it('Test 6: returns { oidcEnabled:true } when OIDC_ISSUER env var is set', async () => {
+    process.env.OIDC_ISSUER = 'https://auth.example.com';
+    mockAppConfigOidcIssuer = null;
+
+    const { app } = await import('../../src/index.js');
+    const res = await app.request('/api/auth/mode');
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean };
+    expect(body.localEnabled).toBe(true);
+    expect(body.oidcEnabled).toBe(true);
+  });
+
+  it('Test 6b: returns { oidcEnabled:true } when oidc_issuer is in app_config (no env var)', async () => {
+    delete process.env.OIDC_ISSUER;
+    mockAppConfigOidcIssuer = 'https://auth-from-config.example.com';
+
+    const { app } = await import('../../src/index.js');
+    const res = await app.request('/api/auth/mode');
+
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as { localEnabled: boolean; oidcEnabled: boolean };
+    expect(body.localEnabled).toBe(true);
+    expect(body.oidcEnabled).toBe(true);
+  });
+});