feat: add comprehensive integration tests for auto-mode-service

- Created git-test-repo helper for managing test git repositories
- Added 13 integration tests covering:
  - Worktree operations (create, error handling, non-worktree mode)
  - Feature execution (status updates, model selection, duplicate prevention)
  - Auto loop (start/stop, pending features, max concurrency, events)
  - Error handling (provider errors, continue after failures)
- Integration tests use real git operations with temporary repos
- All 416 tests passing with 72.65% overall coverage
- Service coverage improved: agent-service 58%, auto-mode-service 44%, feature-loader 66%

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/server/tests/unit/lib/auth.test.ts

@@ -0,0 +1,116 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { createMockExpressContext } from "../../utils/mocks.js";
+
+/**
+ * Note: auth.ts reads AUTOMAKER_API_KEY at module load time.
+ * We need to reset modules and reimport for each test to get fresh state.
+ */
+describe("auth.ts", () => {
+  beforeEach(() => {
+    vi.resetModules();
+  });
+
+  describe("authMiddleware - no API key", () => {
+    it("should call next() when no API key is set", async () => {
+      delete process.env.AUTOMAKER_API_KEY;
+
+      const { authMiddleware } = await import("@/lib/auth.js");
+      const { req, res, next } = createMockExpressContext();
+
+      authMiddleware(req, res, next);
+
+      expect(next).toHaveBeenCalled();
+      expect(res.status).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("authMiddleware - with API key", () => {
+    it("should reject request without API key header", async () => {
+      process.env.AUTOMAKER_API_KEY = "test-secret-key";
+
+      const { authMiddleware } = await import("@/lib/auth.js");
+      const { req, res, next } = createMockExpressContext();
+
+      authMiddleware(req, res, next);
+
+      expect(res.status).toHaveBeenCalledWith(401);
+      expect(res.json).toHaveBeenCalledWith({
+        success: false,
+        error: "Authentication required. Provide X-API-Key header.",
+      });
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    it("should reject request with invalid API key", async () => {
+      process.env.AUTOMAKER_API_KEY = "test-secret-key";
+
+      const { authMiddleware } = await import("@/lib/auth.js");
+      const { req, res, next } = createMockExpressContext();
+      req.headers["x-api-key"] = "wrong-key";
+
+      authMiddleware(req, res, next);
+
+      expect(res.status).toHaveBeenCalledWith(403);
+      expect(res.json).toHaveBeenCalledWith({
+        success: false,
+        error: "Invalid API key.",
+      });
+      expect(next).not.toHaveBeenCalled();
+    });
+
+    it("should call next() with valid API key", async () => {
+      process.env.AUTOMAKER_API_KEY = "test-secret-key";
+
+      const { authMiddleware } = await import("@/lib/auth.js");
+      const { req, res, next} = createMockExpressContext();
+      req.headers["x-api-key"] = "test-secret-key";
+
+      authMiddleware(req, res, next);
+
+      expect(next).toHaveBeenCalled();
+      expect(res.status).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("isAuthEnabled", () => {
+    it("should return false when no API key is set", async () => {
+      delete process.env.AUTOMAKER_API_KEY;
+
+      const { isAuthEnabled } = await import("@/lib/auth.js");
+      expect(isAuthEnabled()).toBe(false);
+    });
+
+    it("should return true when API key is set", async () => {
+      process.env.AUTOMAKER_API_KEY = "test-key";
+
+      const { isAuthEnabled } = await import("@/lib/auth.js");
+      expect(isAuthEnabled()).toBe(true);
+    });
+  });
+
+  describe("getAuthStatus", () => {
+    it("should return disabled status when no API key", async () => {
+      delete process.env.AUTOMAKER_API_KEY;
+
+      const { getAuthStatus } = await import("@/lib/auth.js");
+      const status = getAuthStatus();
+
+      expect(status).toEqual({
+        enabled: false,
+        method: "none",
+      });
+    });
+
+    it("should return enabled status when API key is set", async () => {
+      process.env.AUTOMAKER_API_KEY = "test-key";
+
+      const { getAuthStatus } = await import("@/lib/auth.js");
+      const status = getAuthStatus();
+
+      expect(status).toEqual({
+        enabled: true,
+        method: "api_key",
+      });
+    });
+  });
+});