Add core server Controller base, auth hook, and buildServer

test/core/server/authHook.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from 'vitest';
+import Fastify from 'fastify';
+import { registerAuthHook } from '../../../src/core/server/authHook';
+
+function buildApp(secretKey: string) {
+  const app = Fastify();
+  registerAuthHook(app, secretKey);
+  app.get('/health', async () => ({ status: 'ok' }));
+  app.get('/recommendations', async () => ({ items: [] }));
+  return app;
+}
+
+describe('registerAuthHook', () => {
+  it('allows all requests through when secretKey is empty', async () => {
+    const app = buildApp('');
+    const res = await app.inject({ method: 'GET', url: '/recommendations' });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it('always exempts /health even when a secret is configured', async () => {
+    const app = buildApp('s3cret');
+    const res = await app.inject({ method: 'GET', url: '/health' });
+    expect(res.statusCode).toBe(200);
+  });
+
+  it('rejects requests without a matching bearer token', async () => {
+    const app = buildApp('s3cret');
+    const res = await app.inject({ method: 'GET', url: '/recommendations' });
+    expect(res.statusCode).toBe(401);
+  });
+
+  it('allows requests with the correct bearer token', async () => {
+    const app = buildApp('s3cret');
+    const res = await app.inject({
+      method: 'GET',
+      url: '/recommendations',
+      headers: { authorization: 'Bearer s3cret' },
+    });
+    expect(res.statusCode).toBe(200);
+  });
+});