# AUTH-001: Debug Authentication Bypass
#
# Authentication middleware with a debug bypass that allows skipping
# authentication checks in non-production environments.

[metadata]
id = "auth-001"
name = "Debug authentication bypass"
category = "auth"
language = "typescript"
difficulty = "hard"
source = "hand-curated"
created = "2025-02-05"
notes = "Debug bypass left in production code"

[input]
filename = "middleware.ts"
content = """
import { Request, Response, NextFunction } from 'express';

export function authMiddleware(req: Request, res: Response, next: NextFunction) {
    // Skip auth in debug mode
    if (process.env.DEBUG === 'true' || req.headers['x-debug-bypass'] === 'true') {
        return next();
    }

    const token = req.headers.authorization?.split(' ')[1];
    if (!token) {
        return res.status(401).json({ error: 'Unauthorized' });
    }

    // Verify token...
    next();
}
"""

[expected]
must_contain = [
    { subject = "auth/bypass", predicate = "debug_mode", value = true, rationale = "DEBUG env var bypasses authentication" },
    { subject = "auth/bypass", predicate = "header_based", value = true, rationale = "x-debug-bypass header can skip auth" }
]

must_not_contain = [
    { subject = "auth/verification", predicate = "always_required", value = true, rationale = "Auth can be bypassed via debug mechanisms" }
]

[scoring]
weight = 2.0
min_confidence = 0.8