test: add poll-responses, NIP-98, and bot-auth test suites

- poll-responses.test.ts: 10 tests covering lifecycle, timeout, duplicate rejection
- nip98.test.ts: 7 tests covering valid token, expiry, method, signature, tags
- bot-auth.test.ts: 5 tests covering header auth, query params, invalid credentials

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/bot-auth.test.ts

@@ -0,0 +1,107 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'
+import { createHash } from 'crypto'
+import { Hono } from 'hono'
+
+// Mock the db module before importing authenticateBot
+const mockSelect = vi.fn()
+vi.mock('../db/index.js', () => ({
+  db: {
+    select: (...args: unknown[]) => {
+      const result = mockSelect(...args)
+      return {
+        from: () => ({
+          where: () => ({
+            limit: () => result,
+          }),
+        }),
+      }
+    },
+  },
+  schema: {
+    bots: {
+      id: 'id',
+      name: 'name',
+      secretHash: 'secretHash',
+      webhookUrl: 'webhookUrl',
+    },
+  },
+}))
+
+// Import after mock setup
+const { authenticateBot } = await import('./bot-auth.js')
+
+const TEST_SECRET = 'my-bot-secret-key'
+const TEST_HASH = createHash('sha256').update(TEST_SECRET).digest('hex')
+const TEST_BOT = {
+  id: 'bot-123',
+  name: 'TestBot',
+  secretHash: TEST_HASH,
+  webhookUrl: 'https://example.com/webhook',
+}
+
+function createApp() {
+  const app = new Hono()
+  app.get('/test', async (c) => {
+    const result = await authenticateBot(c)
+    if (result instanceof Response) return result
+    return c.json({ botId: result.botId, botName: result.botName })
+  })
+  return app
+}
+
+describe('authenticateBot', () => {
+  beforeEach(() => {
+    mockSelect.mockReset()
+  })
+
+  it('authenticates via Authorization header', async () => {
+    mockSelect.mockReturnValue([TEST_BOT])
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { Authorization: `Bot bot-123:${TEST_SECRET}` },
+    })
+    expect(res.status).toBe(200)
+    const body = await res.json() as { botId: string; botName: string }
+    expect(body.botId).toBe('bot-123')
+    expect(body.botName).toBe('TestBot')
+  })
+
+  it('authenticates via query params', async () => {
+    mockSelect.mockReturnValue([TEST_BOT])
+    const app = createApp()
+    const res = await app.request(`/test?bot_id=bot-123&secret=${TEST_SECRET}`)
+    expect(res.status).toBe(200)
+    const body = await res.json() as { botId: string }
+    expect(body.botId).toBe('bot-123')
+  })
+
+  it('returns 401 when no credentials provided', async () => {
+    const app = createApp()
+    const res = await app.request('/test')
+    expect(res.status).toBe(401)
+    const body = await res.json() as { error: string }
+    expect(body.error).toContain('Authentication required')
+  })
+
+  it('returns 401 for invalid bot_id (not found)', async () => {
+    mockSelect.mockReturnValue([])
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { Authorization: `Bot unknown:${TEST_SECRET}` },
+    })
+    expect(res.status).toBe(401)
+    const body = await res.json() as { error: string }
+    expect(body.error).toContain('Invalid bot_id or secret')
+  })
+
+  it('returns 401 for wrong secret', async () => {
+    mockSelect.mockReturnValue([TEST_BOT])
+    const app = createApp()
+    const res = await app.request('/test', {
+      headers: { Authorization: 'Bot bot-123:wrong-secret' },
+    })
+    expect(res.status).toBe(401)
+    const body = await res.json() as { error: string }
+    expect(body.error).toContain('Invalid bot_id or secret')
+  })
+})