fix(auth): block PLAYWRIGHT_E2E stub session in production

[cursor]

Summary

Restores the production auth guard that commit 3244a28 dropped when extracting shouldUseStubAuthSession from src/auth.ts.

Bug

• File/function: src/lib/auth-mock-session.ts:shouldUseStubAuthSession
• Trigger: Deploy with NODE_ENV=production and PLAYWRIGHT_E2E=1 (or any accidental env copy from Playwright/E2E). Any caller of auth() then receives the fixed stub user 00000000-0000-0000-0000-000000000001 with no credentials.
• Impact: Complete authentication bypass in production — every request is the same fake session.
• Distinct from fix(builder): prevent undo from reverting multiple edits at once #40–fix(api): isolate in-memory agents by session user #53: Those cover builder races, agents/[id] missing auth, store owner isolation, execution overwrite, and setup SSRF — none cover the stub-session production footgun.

Root cause

PR #15 intentionally required NODE_ENV !== "production" and a dev/E2E flag. The Turbopack stub extraction kept only PLAYWRIGHT_E2E=1 || development, and a unit test locked in the insecure behavior.

Fix

• Hard-return false when NODE_ENV === "production".
• Keep stub for development and for Playwright (NODE_ENV=test + PLAYWRIGHT_E2E=1 per playwright.config.ts).
• Update unit tests to assert the production block and the Playwright path.

Validation

npm run test:run -- tests/lib/auth-mock-session.test.ts — 6 passed.

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-agent-kit	Ready	Preview, v0	Aug 31, 2026 11:22am