test(server): add robust coverage for server/middleware/api-guard.ts

[anthuanvasquez]

Summary

Adds dedicated unit test coverage for server/middleware/api-guard.ts to prevent regressions in origin validation and internal secret handling.

Changes

• Created tests/server/api-guard.test.ts covering all critical branches:
  • Route filtering (skips non-/api/ paths)
  • Development bypass (NODE_ENV === 'development')
  • Valid and invalid x-internal-secret handling in production
  • Rejection of missing origin/referer headers (403)
  • Rejection when allowedOrigin config is missing or invalid (500)
  • Rejection when request origin URL is malformed or unauthorized (403)
  • Authorized requests with matching origins or referers, including port handling

Testing

• Ran full test suite with Vitest (44/44 passing across 10 test files)
• Verified clean linter and prettier checks (pnpm lint)

Closes #82

[Copilot]

🟡 Changes recommended

The new test file uses useRuntimeConfig() without mocking/stubbing it locally, making the suite order-dependent and potentially failing when run in isolation.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds a new Vitest unit test suite to cover the critical branches of the server/middleware/api-guard.ts middleware, aiming to prevent regressions in origin validation and internal-secret bypass behavior.

Changes:

• Added a dedicated server middleware test file covering route filtering, dev bypass, internal secret bypass, origin/referer enforcement, and allowed-origin validation cases.

File summaries

File	Description
tests/server/api-guard.test.ts	Introduces unit tests for api-guard middleware branch coverage (production/dev, internal secret, origin/referer, allowedOrigin validation).

Review details

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.