No dev-only auth bypass patterns

Auth bypass patterns collapse the entire authentication model to a single HTTP header, query parameter, or magic email suffix. Any client that knows the bypass — or that fuzzes common header names — gains admin privileges with no credentials. This is CWE-489 (Active Debug Code) combined with OWASP A07:2021 (Identification and Authentication Failures) and CWE-287 (Improper Authentication): code that was added for local convenience becomes a permanent privilege escalation vector. Unlike other patterns, even a NODE_ENV === 'development' guard does not neutralize the risk — environment variables are routinely misconfigured in staging and CI.

Delete the bypass entirely. There is no safe way to keep it in non-test code. In src/middleware.ts (or wherever the pattern lives), remove the conditional and replace it with a standard session check:

// Remove this:
if (req.headers['x-bypass-auth']) {
  return { user: { role: 'admin' } }
}

// Keep only this:
const session = await getSession(req)
if (!session?.user) {
  return Response.json({ error: 'Unauthorized' }, { status: 401 })
}

For local development testing, create a proper seed user in your database with a known password and log in through the real auth flow. Use test-specific accounts in *.test.ts files — never bypass logic in production source paths.