🛡️ Sentinel: Fix weak JWT_SECRET validation on L5 API

[dcplatforms]

Sentinel Security Hardening: This change hardens the JWT authentication middleware and login handlers inside services/05-driver-experience-api/index.js. In production environments, any attempt to use weak, default, or insecure secrets (such as dev_secret_change_in_production, test_secret, dev_secret, default_secret, secret) is securely blocked and results in an internal server configuration error (500). Includes a comprehensive security unit test suite in security.test.js which validates these behaviors.

---

PR created automatically by Jules for task 18418571999193488544 started by @dcplatforms

---

Note

Medium Risk
Changes authentication behavior in production misconfigurations (intentional fail-closed) and could lock out the API if secrets are not set correctly; otherwise limited to config gating and test harness wiring.

Overview
Production JWT hardening on the L5 Driver Experience API: when NODE_ENV is production, login and all authenticateToken-protected routes now refuse to run if JWT_SECRET is missing, default, or on a denylist of known weak values (dev_secret_change_in_production, secret, etc.), returning a generic 500 configuration error instead of issuing or accepting tokens.

The service is refactored so app is exported and the HTTP listener only starts under require.main === module, enabling supertest coverage without binding a port. A new security.test.js exercises health, blocked login/auth with default/weak secrets in production, and successful /auth/me with a strong secret (real jwt.verify, not mocked middleware).

Sentinel journal documents the weak-default JWT lesson and a minor title update.

^{Reviewed by Cursor Bugbot for commit 72e5f2d. Configure here.}

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 72e5f2d. Configure here.}

[cursor]

Whitespace JWT secret bypasses gate

High Severity

The isWeakSecret check incorrectly treats whitespace-only JWT_SECRET values as strong in production. This bypasses the new security hardening for authentication and login, allowing an effectively empty and forgeable JWT secret to be used.

 

^{Reviewed by Cursor Bugbot for commit 72e5f2d. Configure here.}

[cursor]

Login limiter before secret check

Medium Severity

The loginRateLimiter on POST /auth/login runs before the weak JWT_SECRET check. This means requests failing due to a weak secret configuration (returning a 500 error) still increment the rate limit, potentially leading to 429 errors that obscure the underlying configuration issue.

 

^{Reviewed by Cursor Bugbot for commit 72e5f2d. Configure here.}