From 5e4e2f5fafe749ce89703b3d953e44bb1cbd62d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= <github@jeremydev.ovh>
Date: Fri, 21 Aug 2026 10:14:55 +0200
Subject: [PATCH] fix(security): lock HMAC dev bypass strictly to false in
 production

---
 .../Http/Middlewares/VerifyHmacSignature.php  |  2 +-
 .../Api/V1/VerifyHmacSignatureTest.php        | 35 +++++++++++++++++++
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/src/Presentation/Api/V1/Http/Middlewares/VerifyHmacSignature.php b/src/Presentation/Api/V1/Http/Middlewares/VerifyHmacSignature.php
index 0d3208f..0f50cb5 100644
--- a/src/Presentation/Api/V1/Http/Middlewares/VerifyHmacSignature.php
+++ b/src/Presentation/Api/V1/Http/Middlewares/VerifyHmacSignature.php
@@ -98,7 +98,7 @@ final readonly class VerifyHmacSignature
 
     private function shouldBypassHmac(): bool
     {
-        if (! App::environment('local', 'testing')) {
+        if (App::isProduction() || ! App::environment('local', 'testing')) {
             return false;
         }
 
diff --git a/tests/Feature/Api/V1/VerifyHmacSignatureTest.php b/tests/Feature/Api/V1/VerifyHmacSignatureTest.php
index 0854843..ac9fea5 100644
--- a/tests/Feature/Api/V1/VerifyHmacSignatureTest.php
+++ b/tests/Feature/Api/V1/VerifyHmacSignatureTest.php
@@ -370,4 +370,39 @@ describe('VerifyHmacSignature Middleware Feature Tests', function (): void {
                 'detail' => 'Authentication failed.',
             ]);
     });
+
+    it('bypasses HMAC authentication in local/testing when dev bypass is explicitly enabled', function (): void {
+        // GIVEN
+        /** @var \Tests\TestCase $this */
+        Config::set('auth.hmac.allow_dev_bypass', true);
+
+        // WHEN
+        $response = $this->getJson('/api/v1/test-hmac-auth');
+
+        // THEN
+        $response->assertStatus(200)
+            ->assertJson([
+                'message' => 'ok',
+                'client'  => 'Arcadia Dev Test Client',
+            ]);
+    });
+
+    it('strictly rejects HMAC bypass in production environment even if allow_dev_bypass is enabled', function (): void {
+        // GIVEN
+        /** @var \Tests\TestCase $this */
+        Config::set('auth.hmac.allow_dev_bypass', true);
+        app()['env'] = 'production';
+
+        // WHEN
+        $response = $this->getJson('/api/v1/test-hmac-auth');
+
+        // THEN
+        $response->assertStatus(401)
+            ->assertHeader('Content-Type', 'application/problem+json')
+            ->assertJson([
+                'status' => 401,
+                'title'  => 'Unauthorized',
+                'detail' => 'Missing or invalid client identifier in the request headers.',
+            ]);
+    });
 });