test(auth): cover token cap eviction and malformed pairing codes

[cursor]

Summary

Adds focused unit coverage for high-risk auth store and pairing validation paths in auth_pair / auth_validate_token.

Risky behavior now covered

• 16-token store cap: when pairing would exceed 16 tokens, the oldest token is evicted and the new token is accepted; store size stays at 16.
• Malformed pairing codes: short, long, non-digit, and empty codes are rejected without issuing a token; a valid pending code still pairs afterward.
• Bearer length mismatch: a stored token with an extra suffix does not validate (exact-length compare).

Test files added/updated

• tests/test_auth.c — test_auth_pair_evicts_oldest_at_cap, test_auth_pair_rejects_malformed_code, test_auth_validate_token_rejects_length_mismatch

Why this reduces regression risk

These paths sit on the gateway auth boundary. An unbounded token file is a DoS vector; loose code/token checks are auth-bypass risk. The new tests pin the cap and validation without changing production code.

Validation

make test_auth && ./build/test_auth

Result: test_auth: all tests passed

Notes

• No production behavior changes.
• Gateway LWS gaps (http_lws.c WS bearer, http_dispatch_body 413, parse_memory_limit_arg) remain blocked without libwebsockets / export for unit tests.

  

[cursor]

PR Summary

Low Risk
Test-only changes; no runtime auth behavior is modified.

Overview
Extends tests/test_auth.c with regression tests for gateway auth pairing and token validation—no production code changes.

New coverage pins auth_pair rejecting malformed codes (wrong length, non-digits, empty) without issuing a token, while a valid pending code still pairs afterward. test_auth_pair_evicts_oldest_at_cap seeds a full 16-token store and asserts pairing evicts the oldest entry, keeps size at 16, and accepts the new token. test_auth_validate_token_rejects_length_mismatch ensures bearer checks require exact 32-char hex (suffixes fail).

Helpers write_token_array / read_token_array_size (via cJSON) support the cap test; constants align with TOKEN_LEN and the 16-token cap in auth.c.

^{Reviewed by Cursor Bugbot for commit f8c1225. Bugbot is set up for automated code reviews on this repo. Configure here.}