fix(security): lock HMAC dev bypass strictly to false in production

src/Presentation/Api/V1/Http/Middlewares/VerifyHmacSignature.php

@@ -98,7 +98,7 @@ final readonly class VerifyHmacSignature
 
     private function shouldBypassHmac(): bool
     {
-        if (! App::environment('local', 'testing')) {
+        if (App::isProduction() || ! App::environment('local', 'testing')) {
             return false;
         }
 

tests/Feature/Api/V1/VerifyHmacSignatureTest.php

@@ -370,4 +370,39 @@ describe('VerifyHmacSignature Middleware Feature Tests', function (): void {
                 'detail' => 'Authentication failed.',
             ]);
     });
+
+    it('bypasses HMAC authentication in local/testing when dev bypass is explicitly enabled', function (): void {
+        // GIVEN
+        /** @var \Tests\TestCase $this */
+        Config::set('auth.hmac.allow_dev_bypass', true);
+
+        // WHEN
+        $response = $this->getJson('/api/v1/test-hmac-auth');
+
+        // THEN
+        $response->assertStatus(200)
+            ->assertJson([
+                'message' => 'ok',
+                'client'  => 'Arcadia Dev Test Client',
+            ]);
+    });
+
+    it('strictly rejects HMAC bypass in production environment even if allow_dev_bypass is enabled', function (): void {
+        // GIVEN
+        /** @var \Tests\TestCase $this */
+        Config::set('auth.hmac.allow_dev_bypass', true);
+        app()['env'] = 'production';
+
+        // WHEN
+        $response = $this->getJson('/api/v1/test-hmac-auth');
+
+        // THEN
+        $response->assertStatus(401)
+            ->assertHeader('Content-Type', 'application/problem+json')
+            ->assertJson([
+                'status' => 401,
+                'title'  => 'Unauthorized',
+                'detail' => 'Missing or invalid client identifier in the request headers.',
+            ]);
+    });
 });