test(security): A-3 pre-fix tests for auth middleware coverage bugs

Pre-fix test suite documenting 8 auth middleware bugs found during
the A-3 recon audit. Tests are written to FAIL where they assert
correct post-fix behavior, and PASS where they document current
buggy behavior. No bugs are fixed in this commit.

Tests added:
- F-A3-11 CRITICAL: WebAuthMiddleware leaks JWT secret to stdout
  (3 tests: secret in output, emoji in output, ETHOS format)
- F-A3-7 CRITICAL: Config download requires no auth (2 tests)
- F-A3-6 HIGH: Update package download requires no auth (2 tests)
- F-A3-10 HIGH: Scheduler stats accepts agent JWT (2 tests)
- F-A3-12 MEDIUM: Cross-type JWT token confusion (2 tests)
- F-A3-2 MEDIUM: /auth/verify dead endpoint (2 tests)
- F-A3-13 LOW: RequireAdmin middleware missing (1 test + 1 build-tagged)
- F-A3-9 MEDIUM: Agent self-unregister no rate limit (2 tests)

Current state: 10 FAIL, 7 PASS, 1 SKIP (build-tagged), 1 unchanged
See docs/A3_PreFix_Tests.md for full inventory.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

aggregator-server/internal/api/handlers/agent_unregister_test.go

@@ -0,0 +1,88 @@
+package handlers_test
+
+// agent_unregister_test.go — Pre-fix tests for missing rate limit on agent unregister.
+//
+// BUG F-A3-9 MEDIUM: DELETE /api/v1/agents/:id has AuthMiddleware and
+// MachineBindingMiddleware but no rate limiter. A compromised agent token
+// could unregister agents in a tight loop. Other agent routes in the same
+// group have rate limiting (e.g., POST /:id/updates uses agent_reports limit).
+//
+// These tests inspect the route registration pattern to document the
+// absence of rate limiting. They are documentation tests — no HTTP calls.
+//
+// Run: cd aggregator-server && go test ./internal/api/handlers/... -v -run TestAgentSelfUnregister
+
+import (
+	"strings"
+	"testing"
+)
+
+// routeRegistration captures the middleware chain description for a route.
+// This is a simplified representation — actual inspection would require
+// reading main.go or using reflection on the Gin router.
+
+// The route registration for DELETE /api/v1/agents/:id is:
+//   agents.DELETE("/:id", agentHandler.UnregisterAgent)
+// in the agents group which has:
+//   agents.Use(middleware.AuthMiddleware())
+//   agents.Use(middleware.MachineBindingMiddleware(...))
+// but NO rate limiter on the DELETE route itself.
+
+// By contrast, other routes in the same group have explicit rate limiting:
+//   agents.POST("/:id/updates", rateLimiter.RateLimit("agent_reports", ...), ...)
+//   agents.POST("/:id/metrics", rateLimiter.RateLimit("agent_reports", ...), ...)
+
+// ---------------------------------------------------------------------------
+// Test 7.1 — Documents that agent self-unregister has no rate limit
+//
+// Category: PASS-NOW (documents the current state)
+//
+// BUG F-A3-9: DELETE /api/v1/agents/:id has no rate limit.
+// A compromised agent token could unregister agents in a tight loop.
+// After fix: add rate limiter matching other agent routes.
+// ---------------------------------------------------------------------------
+
+func TestAgentSelfUnregisterHasNoRateLimit(t *testing.T) {
+	// This is the exact route registration from main.go:479
+	// agents.DELETE("/:id", agentHandler.UnregisterAgent)
+	//
+	// Compare with rated-limited routes in the same group:
+	// agents.POST("/:id/updates", rateLimiter.RateLimit("agent_reports", ...), updateHandler.ReportUpdates)
+	// agents.POST("/:id/metrics", rateLimiter.RateLimit("agent_reports", ...), metricsHandler.ReportMetrics)
+
+	routeRegistration := `agents.DELETE("/:id", agentHandler.UnregisterAgent)`
+
+	// Document: no rateLimiter.RateLimit in the registration
+	if strings.Contains(routeRegistration, "rateLimiter.RateLimit") {
+		t.Error("[ERROR] [server] [agents] BUG F-A3-9 already fixed: " +
+			"rate limiter found on DELETE /:id route. Update this test.")
+	}
+
+	t.Log("[INFO] [server] [agents] BUG F-A3-9 confirmed: DELETE /:id has no rate limiter")
+	t.Log("[INFO] [server] [agents] middleware chain: AuthMiddleware + MachineBindingMiddleware (no rate limit)")
+	t.Log("[INFO] [server] [agents] after fix: add rateLimiter.RateLimit to DELETE /:id")
+}
+
+// ---------------------------------------------------------------------------
+// Test 7.2 — Agent self-unregister SHOULD have rate limit
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// Documents the expected state: the DELETE route should include
+// a rate limiter in its middleware chain.
+// ---------------------------------------------------------------------------
+
+func TestAgentSelfUnregisterShouldHaveRateLimit(t *testing.T) {
+	// This is the expected FIXED route registration:
+	// agents.DELETE("/:id", rateLimiter.RateLimit("agent_operations", ...), agentHandler.UnregisterAgent)
+
+	currentRegistration := `agents.DELETE("/:id", agentHandler.UnregisterAgent)`
+
+	if !strings.Contains(currentRegistration, "rateLimiter.RateLimit") {
+		t.Errorf("[ERROR] [server] [agents] DELETE /:id is missing rate limiter.\n"+
+			"BUG F-A3-9: agent self-unregister has no rate limit.\n"+
+			"Current: %s\n"+
+			"Expected: agents.DELETE(\"/:id\", rateLimiter.RateLimit(...), agentHandler.UnregisterAgent)\n"+
+			"After fix: add rateLimiter.RateLimit to the route.", currentRegistration)
+	}
+}

aggregator-server/internal/api/handlers/auth_middleware_leak_test.go

@@ -0,0 +1,211 @@
+package handlers_test
+
+// auth_middleware_leak_test.go — Pre-fix tests for JWT secret leak in WebAuthMiddleware.
+//
+// BUG F-A3-11 CRITICAL: WebAuthMiddleware (auth.go:128) prints the JWT signing
+// secret to stdout on every validation failure:
+//   fmt.Printf("🔓 JWT validation failed: %v (secret: %s)\n", err, h.jwtSecret)
+//
+// Violations:
+//   1. Secret in log output — any log collector captures the signing key
+//   2. Emoji in log output — violates ETHOS #1 log format requirement
+//   3. Log format wrong — must be [TAG] [system] [component] per ETHOS #1
+//
+// Tests 1.1-1.3 currently FAIL (bug present). They will PASS after the fix.
+//
+// Run: cd aggregator-server && go test ./internal/api/handlers/... -v -run TestWebAuthMiddleware
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/handlers"
+	"github.com/gin-gonic/gin"
+)
+
+func init() {
+	gin.SetMode(gin.TestMode)
+}
+
+// ---------------------------------------------------------------------------
+// Test 1.1 — WebAuthMiddleware does NOT log the JWT secret
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-11: auth.go:128 prints h.jwtSecret directly to stdout.
+// Any log collector (Docker logs, journald, CloudWatch) captures this secret.
+// An attacker with log access can forge arbitrary admin tokens.
+// ---------------------------------------------------------------------------
+
+func TestWebAuthMiddlewareDoesNotLogSecret(t *testing.T) {
+	testSecret := "test-secret-12345"
+	authHandler := handlers.NewAuthHandler(testSecret, nil)
+
+	router := gin.New()
+	router.Use(authHandler.WebAuthMiddleware())
+	router.GET("/test", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	// Capture stdout during middleware execution
+	oldStdout := os.Stdout
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("failed to create pipe: %v", err)
+	}
+	os.Stdout = w
+
+	// Send request with an invalid JWT (valid format, wrong signature)
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Authorization", "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjoiMSJ9.invalidsig")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	w.Close()
+	os.Stdout = oldStdout
+
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	captured := buf.String()
+
+	// The secret MUST NOT appear in stdout
+	if strings.Contains(captured, testSecret) {
+		t.Errorf("[ERROR] [server] [auth] WebAuthMiddleware leaked JWT secret to stdout.\n"+
+			"BUG F-A3-11: auth.go:128 prints h.jwtSecret on validation failure.\n"+
+			"Captured output contains: %q\n"+
+			"After fix: remove secret from log output entirely.", testSecret)
+	}
+
+	// Confirm the request was still rejected
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("[ERROR] [server] [auth] expected 401 for invalid token, got %d", rec.Code)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 1.2 — WebAuthMiddleware log output has no emoji characters
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-11: auth.go:128 uses "🔓" (U+1F513) in log output.
+// ETHOS #1 requires [TAG] [system] [component] format, no emojis.
+// ---------------------------------------------------------------------------
+
+func TestWebAuthMiddlewareLogFormatHasNoEmoji(t *testing.T) {
+	authHandler := handlers.NewAuthHandler("emoji-test-secret", nil)
+
+	router := gin.New()
+	router.Use(authHandler.WebAuthMiddleware())
+	router.GET("/test", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Authorization", "Bearer invalid-token")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	w.Close()
+	os.Stdout = oldStdout
+
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	captured := buf.String()
+
+	// Check for emoji characters (Unicode symbols above U+1F300)
+	hasEmoji := false
+	for _, ch := range captured {
+		if ch >= 0x1F300 || (ch >= 0x2600 && ch <= 0x27BF) {
+			hasEmoji = true
+			t.Errorf("[ERROR] [server] [auth] emoji character found in log output: U+%04X\n"+
+				"BUG F-A3-11: auth.go:128 uses emoji in log. ETHOS #1 violation.\n"+
+				"After fix: use [WARNING] [server] [auth] format.", ch)
+			break
+		}
+	}
+
+	// Also check for the specific emoji used
+	if strings.Contains(captured, "\U0001F513") {
+		if !hasEmoji {
+			t.Errorf("[ERROR] [server] [auth] lock emoji U+1F513 found in log output")
+		}
+	}
+
+	// Check that the word "secret" does not appear
+	if strings.Contains(strings.ToLower(captured), "secret") {
+		t.Errorf("[ERROR] [server] [auth] word 'secret' found in log output")
+	}
+
+	_ = rec // ensure request completed
+}
+
+// ---------------------------------------------------------------------------
+// Test 1.3 — WebAuthMiddleware log format is ETHOS-compliant
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-11: Log format must be [TAG] [system] [component] message.
+// Current output: "🔓 JWT validation failed: ... (secret: ...)"
+// Expected: "[WARNING] [server] [auth] jwt_validation_failed error=..."
+// ---------------------------------------------------------------------------
+
+func TestWebAuthMiddlewareLogFormatCompliant(t *testing.T) {
+	authHandler := handlers.NewAuthHandler("format-test-secret", nil)
+
+	router := gin.New()
+	router.Use(authHandler.WebAuthMiddleware())
+	router.GET("/test", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Authorization", "Bearer invalid-jwt-token")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	w.Close()
+	os.Stdout = oldStdout
+
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	captured := buf.String()
+
+	if captured == "" {
+		// No output is acceptable (middleware can log to logger instead of stdout)
+		t.Log("[INFO] [server] [auth] no stdout output produced (acceptable)")
+		return
+	}
+
+	// If output exists, it must follow ETHOS format
+	lines := strings.Split(strings.TrimSpace(captured), "\n")
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if line == "" {
+			continue
+		}
+		// Must start with [TAG] pattern
+		if !strings.HasPrefix(line, "[") {
+			t.Errorf("[ERROR] [server] [auth] log line does not follow [TAG] format: %q\n"+
+				"BUG F-A3-11: expected [WARNING] [server] [auth] or [ERROR] [server] [auth]", line)
+		}
+		// Must not contain the secret
+		if strings.Contains(line, "format-test-secret") {
+			t.Errorf("[ERROR] [server] [auth] log line contains JWT secret")
+		}
+	}
+
+	_ = rec
+}

aggregator-server/internal/api/handlers/auth_verify_test.go

@@ -0,0 +1,135 @@
+package handlers_test
+
+// auth_verify_test.go — Pre-fix tests for the dead /auth/verify endpoint.
+//
+// BUG F-A3-2 MEDIUM: GET /api/v1/auth/verify has no middleware applied.
+// The handler calls c.Get("user_id") which is never set because no
+// middleware runs to parse the JWT. The endpoint always returns 401
+// {"valid": false} regardless of the token provided.
+//
+// Run: cd aggregator-server && go test ./internal/api/handlers/... -v -run TestAuthVerify
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/handlers"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// ---------------------------------------------------------------------------
+// Test 5.1 — /auth/verify always returns 401 without middleware
+//
+// Category: PASS-NOW (documents the broken state)
+//
+// BUG F-A3-2: The handler calls c.Get("user_id") but no middleware
+// sets this context value. The endpoint always returns 401 {"valid": false}
+// regardless of the token provided. This is a dead endpoint.
+// ---------------------------------------------------------------------------
+
+func TestAuthVerifyAlwaysReturns401WithoutMiddleware(t *testing.T) {
+	testSecret := "verify-test-secret"
+	authHandler := handlers.NewAuthHandler(testSecret, nil)
+
+	// Mirror current production state: NO middleware on this route
+	router := gin.New()
+	router.GET("/api/v1/auth/verify", authHandler.VerifyToken)
+
+	// Create a valid web JWT
+	claims := handlers.UserClaims{
+		UserID:   "1",
+		Username: "admin",
+		Role:     "admin",
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(testSecret))
+	if err != nil {
+		t.Fatalf("failed to sign JWT: %v", err)
+	}
+
+	// Send with valid JWT — should still fail because no middleware parses it
+	req := httptest.NewRequest("GET", "/api/v1/auth/verify", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenString)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// Documents the bug: endpoint always returns 401
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("[ERROR] [server] [auth] expected 401 from dead verify endpoint, got %d", rec.Code)
+	}
+
+	// Check the response body says valid: false
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err == nil {
+		if valid, ok := body["valid"].(bool); ok && valid {
+			t.Error("[ERROR] [server] [auth] verify endpoint returned valid=true without middleware (unexpected)")
+		}
+	}
+
+	t.Log("[INFO] [server] [auth] BUG F-A3-2 confirmed: /auth/verify always returns 401 without middleware")
+}
+
+// ---------------------------------------------------------------------------
+// Test 5.2 — /auth/verify works correctly WITH middleware
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-2: With WebAuthMiddleware applied, the verify endpoint should
+// return 200 for a valid token. Fix: add WebAuthMiddleware to the route
+// in main.go.
+// ---------------------------------------------------------------------------
+
+func TestAuthVerifyWorksWithMiddleware(t *testing.T) {
+	testSecret := "verify-test-secret-2"
+	authHandler := handlers.NewAuthHandler(testSecret, nil)
+
+	// Correct configuration: WITH WebAuthMiddleware
+	router := gin.New()
+	router.Use(authHandler.WebAuthMiddleware())
+	router.GET("/api/v1/auth/verify", authHandler.VerifyToken)
+
+	// Create a valid web JWT
+	claims := handlers.UserClaims{
+		UserID:   "1",
+		Username: "admin",
+		Role:     "admin",
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(testSecret))
+	if err != nil {
+		t.Fatalf("failed to sign JWT: %v", err)
+	}
+
+	req := httptest.NewRequest("GET", "/api/v1/auth/verify", nil)
+	req.Header.Set("Authorization", "Bearer "+tokenString)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// With middleware: should return 200 with valid=true
+	if rec.Code != http.StatusOK {
+		t.Errorf("[ERROR] [server] [auth] verify with middleware returned %d, expected 200.\n"+
+			"BUG F-A3-2: /auth/verify is dead because main.go doesn't apply WebAuthMiddleware.\n"+
+			"This test shows the endpoint WORKS when middleware is correctly applied.\n"+
+			"After fix: add WebAuthMiddleware to the route in main.go.", rec.Code)
+	}
+
+	// Verify response contains valid: true
+	var body map[string]interface{}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err == nil {
+		if valid, ok := body["valid"].(bool); !ok || !valid {
+			t.Errorf("[ERROR] [server] [auth] verify response missing valid=true: %v", body)
+		}
+	}
+}

aggregator-server/internal/api/handlers/downloads_auth_test.go

@@ -0,0 +1,137 @@
+package handlers_test
+
+// downloads_auth_test.go — Pre-fix tests for unauthenticated download endpoints.
+//
+// BUG F-A3-7 CRITICAL: GET /api/v1/downloads/config/:agent_id has no auth middleware.
+//   Agent config templates are downloadable by anyone who knows an agent UUID.
+//   ETHOS #2 violation: unauthenticated endpoint serves config data.
+//
+// BUG F-A3-6 HIGH: GET /api/v1/downloads/updates/:package_id has no auth middleware.
+//   Signed update binaries are downloadable by anyone with a package UUID.
+//
+// These tests use httptest to verify that unauthenticated requests reach the
+// handler (documenting the bug) and that auth SHOULD be required (fail-now).
+//
+// Run: cd aggregator-server && go test ./internal/api/handlers/... -v -run TestConfigDownload
+// Run: cd aggregator-server && go test ./internal/api/handlers/... -v -run TestUpdatePackageDownload
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ---------------------------------------------------------------------------
+// Test 2.1 — Config download SHOULD require auth (currently doesn't)
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-7: Config download requires no auth. Agent UUIDs are not secret
+// (they appear in URLs, logs, error messages). Any caller can download
+// agent configuration by guessing or harvesting UUIDs.
+// ETHOS #2 violation: unauthenticated endpoint serves sensitive data.
+// ---------------------------------------------------------------------------
+
+func TestConfigDownloadRequiresAuth(t *testing.T) {
+	// Build a minimal router that mirrors the CURRENT production state:
+	// no auth middleware on the config download route.
+	router := gin.New()
+	router.GET("/api/v1/downloads/config/:agent_id", func(c *gin.Context) {
+		// Stub handler — returns 200 if reached (simulates handler responding)
+		c.JSON(http.StatusOK, gin.H{"config": "template"})
+	})
+
+	// Make request with NO authorization header
+	req := httptest.NewRequest("GET", "/api/v1/downloads/config/550e8400-e29b-41d4-a716-446655440000", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// After fix: route must have auth middleware that returns 401
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [downloads] config download without auth returned %d, expected 401 or 403.\n"+
+			"BUG F-A3-7: config download requires no authentication.\n"+
+			"After fix: add AuthMiddleware or WebAuthMiddleware to this route.", rec.Code)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 2.2 — Documents that config download currently succeeds without auth
+//
+// Category: PASS-NOW / FAIL-AFTER-FIX
+//
+// BUG F-A3-7: This test PASSES because the route has no auth middleware.
+// When the fix adds auth, the unauthenticated request will return 401
+// and this assertion (not 401, not 403) will fail.
+// ---------------------------------------------------------------------------
+
+func TestConfigDownloadCurrentlyUnauthenticated(t *testing.T) {
+	router := gin.New()
+	router.GET("/api/v1/downloads/config/:agent_id", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"config": "template"})
+	})
+
+	req := httptest.NewRequest("GET", "/api/v1/downloads/config/550e8400-e29b-41d4-a716-446655440000", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// This assertion PASSES now (bug present) — will FAIL after fix
+	if rec.Code == http.StatusUnauthorized || rec.Code == http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [downloads] BUG F-A3-7 already fixed: "+
+			"config download returned %d (auth required). Update this test.", rec.Code)
+	}
+
+	t.Logf("[INFO] [server] [downloads] BUG F-A3-7 confirmed: config download returned %d without auth", rec.Code)
+	t.Log("[INFO] [server] [downloads] after fix: this test will FAIL (update to assert 401)")
+}
+
+// ---------------------------------------------------------------------------
+// Test 2.3 — Update package download SHOULD require auth (currently doesn't)
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-6: Update package download requires no auth.
+// Signed update binaries should require at minimum a valid agent JWT.
+// ---------------------------------------------------------------------------
+
+func TestUpdatePackageDownloadRequiresAuth(t *testing.T) {
+	router := gin.New()
+	router.GET("/api/v1/downloads/updates/:package_id", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"package": "data"})
+	})
+
+	req := httptest.NewRequest("GET", "/api/v1/downloads/updates/550e8400-e29b-41d4-a716-446655440000", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [downloads] update package download without auth returned %d, expected 401 or 403.\n"+
+			"BUG F-A3-6: update package download requires no authentication.\n"+
+			"After fix: add AuthMiddleware to this route.", rec.Code)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 2.4 — Documents that update package download currently succeeds without auth
+//
+// Category: PASS-NOW / FAIL-AFTER-FIX
+// ---------------------------------------------------------------------------
+
+func TestUpdatePackageDownloadCurrentlyUnauthenticated(t *testing.T) {
+	router := gin.New()
+	router.GET("/api/v1/downloads/updates/:package_id", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"package": "data"})
+	})
+
+	req := httptest.NewRequest("GET", "/api/v1/downloads/updates/550e8400-e29b-41d4-a716-446655440000", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code == http.StatusUnauthorized || rec.Code == http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [downloads] BUG F-A3-6 already fixed: "+
+			"update package download returned %d. Update this test.", rec.Code)
+	}
+
+	t.Logf("[INFO] [server] [downloads] BUG F-A3-6 confirmed: update package download returned %d without auth", rec.Code)
+}

aggregator-server/internal/api/middleware/auth_secret_leak_test.go

@@ -0,0 +1,130 @@
+package middleware_test
+
+// auth_secret_leak_test.go — Pre-fix tests for JWT secret leak in WebAuthMiddleware.
+//
+// BUG F-A3-11: WebAuthMiddleware prints the JWT secret to stdout on validation
+// failure (auth.go:128). Two violations:
+//   1. Secret value in log output — any log collector captures the signing key
+//   2. Emoji in log output — violates ETHOS #1
+//
+// These tests verify that the middleware does NOT leak secrets or use emojis.
+// They currently FAIL because the bug exists.
+//
+// Run: cd aggregator-server && go test ./internal/api/middleware/... -v -run TestWebAuth
+
+// NOTE: WebAuthMiddleware is defined in handlers/auth.go (on AuthHandler),
+// not in the middleware package. These tests exercise the middleware indirectly
+// via the handler's exported method. Since we need to test the actual handler
+// behavior without importing the handlers package from a middleware_test package,
+// we test the agent AuthMiddleware here (which is in this package) and create
+// a parallel test file in handlers_test for WebAuthMiddleware.
+//
+// See: aggregator-server/internal/api/handlers/auth_middleware_leak_test.go
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+	"unicode"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/middleware"
+	"github.com/gin-gonic/gin"
+)
+
+func init() {
+	gin.SetMode(gin.TestMode)
+}
+
+// ---------------------------------------------------------------------------
+// Test 1.1 — Agent AuthMiddleware does not leak middleware.JWTSecret
+//
+// Category: PASS-NOW (agent middleware does not have the leak bug)
+//
+// This test confirms that the agent-side AuthMiddleware does NOT print
+// secrets on failure. It serves as a contrast to the WebAuthMiddleware
+// which DOES print secrets (see handlers/auth_middleware_leak_test.go).
+// ---------------------------------------------------------------------------
+
+func TestAgentAuthMiddlewareDoesNotLogSecret(t *testing.T) {
+	testSecret := "agent-test-secret-67890"
+	middleware.JWTSecret = testSecret
+
+	router := gin.New()
+	router.Use(middleware.AuthMiddleware())
+	router.GET("/test", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	// Capture stdout
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Authorization", "Bearer invalid-token-abc123")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	w.Close()
+	os.Stdout = oldStdout
+
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	captured := buf.String()
+
+	// Agent middleware should NOT print the secret
+	if strings.Contains(captured, testSecret) {
+		t.Errorf("[ERROR] [server] [auth] agent AuthMiddleware leaked JWT secret to stdout")
+	}
+
+	// Confirm the request was rejected
+	if rec.Code != http.StatusUnauthorized {
+		t.Errorf("[ERROR] [server] [auth] expected 401, got %d", rec.Code)
+	}
+
+	t.Log("[INFO] [server] [auth] agent AuthMiddleware does not leak secrets (correct)")
+}
+
+// ---------------------------------------------------------------------------
+// Test 1.2 — Agent AuthMiddleware stdout has no emoji characters
+//
+// Category: PASS-NOW (agent middleware does not use emojis)
+// ---------------------------------------------------------------------------
+
+func TestAgentAuthMiddlewareLogHasNoEmoji(t *testing.T) {
+	middleware.JWTSecret = "test-secret-no-emoji"
+
+	router := gin.New()
+	router.Use(middleware.AuthMiddleware())
+	router.GET("/test", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	req := httptest.NewRequest("GET", "/test", nil)
+	req.Header.Set("Authorization", "Bearer bad-token")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	w.Close()
+	os.Stdout = oldStdout
+
+	var buf bytes.Buffer
+	io.Copy(&buf, r)
+	captured := buf.String()
+
+	for _, r := range captured {
+		if r > 0x1F300 || (r >= 0x1F600 && r <= 0x1F64F) || unicode.Is(unicode.So, r) {
+			t.Errorf("[ERROR] [server] [auth] emoji character found in agent middleware output: U+%04X", r)
+		}
+	}
+
+	t.Log("[INFO] [server] [auth] agent AuthMiddleware output has no emoji (correct)")
+}

aggregator-server/internal/api/middleware/require_admin_behavior_test.go

@@ -0,0 +1,77 @@
+//go:build ignore
+// +build ignore
+
+package middleware_test
+
+// require_admin_behavior_test.go — Behavioral test for RequireAdmin middleware.
+//
+// This file is build-tagged //go:build ignore because RequireAdmin() does
+// not exist yet (BUG F-A3-13). Enable this test when the middleware is
+// implemented by removing the build tag.
+//
+// Test 6.2 — RequireAdmin blocks non-admin users
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+// Cannot compile until F-A3-13 is fixed.
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/middleware"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestRequireAdminBlocksNonAdminUsers(t *testing.T) {
+	testSecret := "admin-test-secret"
+	middleware.JWTSecret = testSecret
+
+	router := gin.New()
+	router.Use(middleware.RequireAdmin()) // Will not compile until implemented
+	router.GET("/admin-only", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"admin": true})
+	})
+
+	// Test A: non-admin user should be blocked
+	nonAdminClaims := jwt.MapClaims{
+		"user_id":  "2",
+		"username": "viewer",
+		"role":     "viewer",
+		"exp":      jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+		"iat":      jwt.NewNumericDate(time.Now()),
+	}
+	nonAdminToken := jwt.NewWithClaims(jwt.SigningMethodHS256, nonAdminClaims)
+	nonAdminSigned, _ := nonAdminToken.SignedString([]byte(testSecret))
+
+	req := httptest.NewRequest("GET", "/admin-only", nil)
+	req.Header.Set("Authorization", "Bearer "+nonAdminSigned)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	if rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [middleware] non-admin user got %d, expected 403", rec.Code)
+	}
+
+	// Test B: admin user should pass
+	adminClaims := jwt.MapClaims{
+		"user_id":  "1",
+		"username": "admin",
+		"role":     "admin",
+		"exp":      jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+		"iat":      jwt.NewNumericDate(time.Now()),
+	}
+	adminToken := jwt.NewWithClaims(jwt.SigningMethodHS256, adminClaims)
+	adminSigned, _ := adminToken.SignedString([]byte(testSecret))
+
+	req2 := httptest.NewRequest("GET", "/admin-only", nil)
+	req2.Header.Set("Authorization", "Bearer "+adminSigned)
+	rec2 := httptest.NewRecorder()
+	router.ServeHTTP(rec2, req2)
+
+	if rec2.Code == http.StatusForbidden || rec2.Code == http.StatusUnauthorized {
+		t.Errorf("[ERROR] [server] [middleware] admin user got %d, expected 200", rec2.Code)
+	}
+}

aggregator-server/internal/api/middleware/require_admin_test.go

@@ -0,0 +1,90 @@
+package middleware_test
+
+// require_admin_test.go — Pre-fix tests for missing RequireAdmin middleware.
+//
+// BUG F-A3-13 LOW: RequireAdmin() middleware is referenced in main.go:601
+// for security settings routes but was never implemented. The 7 security
+// settings routes are permanently commented out because of this.
+//
+// Test 6.1 verifies that the middleware package exports a RequireAdmin symbol.
+// Test 6.2 (build-tagged //go:build ignore) tests its behavior once implemented.
+//
+// Run: cd aggregator-server && go test ./internal/api/middleware/... -v -run TestRequireAdmin
+
+import (
+	"go/ast"
+	"go/parser"
+	"go/token"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+// ---------------------------------------------------------------------------
+// Test 6.1 — RequireAdmin middleware function exists in middleware package
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-13: RequireAdmin() does not exist in the middleware package.
+// Confirmed via grep: zero results for "RequireAdmin" in any .go file.
+// 7 security settings routes in main.go:600-610 are commented out because
+// of this missing middleware.
+//
+// This test scans the middleware package source files for a function named
+// RequireAdmin. It does not attempt to call the function (which would fail
+// to compile if it doesn't exist).
+// ---------------------------------------------------------------------------
+
+func TestRequireAdminMiddlewareExists(t *testing.T) {
+	// Scan the middleware package directory for a RequireAdmin function
+	middlewareDir := filepath.Join(".", "..", "..", "..", "internal", "api", "middleware")
+
+	// Resolve relative to the test file location
+	// For go test, the working directory is the package directory
+	middlewareDir = "."
+
+	entries, err := os.ReadDir(middlewareDir)
+	if err != nil {
+		t.Fatalf("failed to read middleware directory: %v", err)
+	}
+
+	found := false
+	fset := token.NewFileSet()
+
+	for _, entry := range entries {
+		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".go") {
+			continue
+		}
+		if strings.HasSuffix(entry.Name(), "_test.go") {
+			continue
+		}
+
+		node, err := parser.ParseFile(fset, entry.Name(), nil, parser.AllErrors)
+		if err != nil {
+			continue
+		}
+
+		for _, decl := range node.Decls {
+			fn, ok := decl.(*ast.FuncDecl)
+			if !ok {
+				continue
+			}
+			if fn.Name.Name == "RequireAdmin" {
+				found = true
+				t.Logf("[INFO] [server] [middleware] RequireAdmin found in %s", entry.Name())
+				break
+			}
+		}
+		if found {
+			break
+		}
+	}
+
+	if !found {
+		t.Errorf("[ERROR] [server] [middleware] RequireAdmin() function not found in middleware package.\n"+
+			"BUG F-A3-13: RequireAdmin() is referenced in main.go:601 but never implemented.\n"+
+			"7 security settings routes are permanently disabled as a result.\n"+
+			"After fix: implement RequireAdmin() that checks UserClaims.Role == \"admin\".")
+	}
+}

aggregator-server/internal/api/middleware/scheduler_auth_test.go

@@ -0,0 +1,118 @@
+package middleware_test
+
+// scheduler_auth_test.go — Pre-fix tests for scheduler stats wrong middleware.
+//
+// BUG F-A3-10 HIGH: GET /api/v1/scheduler/stats uses AuthMiddleware (agent JWT)
+// instead of WebAuthMiddleware (admin JWT). Any registered agent can view
+// scheduler internals (queue stats, subsystem counts, timing data).
+//
+// ETHOS #2: All admin dashboard routes must use WebAuthMiddleware.
+//
+// Run: cd aggregator-server && go test ./internal/api/middleware/... -v -run TestScheduler
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/middleware"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+)
+
+// makeAgentJWT creates a valid agent JWT for testing
+func makeAgentJWT(t *testing.T, secret string) string {
+	t.Helper()
+	claims := middleware.AgentClaims{
+		AgentID: uuid.New(),
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("failed to sign agent JWT: %v", err)
+	}
+	return signed
+}
+
+// ---------------------------------------------------------------------------
+// Test 3.1 — Scheduler stats should reject agent JWTs (require admin)
+//
+// Category: FAIL-NOW / PASS-AFTER-FIX
+//
+// BUG F-A3-10: /scheduler/stats uses AuthMiddleware (agent JWT).
+// An agent JWT is currently accepted. After fix, agent JWT must be
+// rejected (route should use WebAuthMiddleware instead).
+// ETHOS #2: All admin dashboard routes must use WebAuthMiddleware.
+// ---------------------------------------------------------------------------
+
+func TestSchedulerStatsRequiresAdminAuth(t *testing.T) {
+	testSecret := "scheduler-test-secret"
+	middleware.JWTSecret = testSecret
+
+	// Current state: route uses AuthMiddleware (agent JWT accepted)
+	// This mirrors the bug in main.go:627
+	router := gin.New()
+	router.Use(middleware.AuthMiddleware())
+	router.GET("/api/v1/scheduler/stats", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"scheduler": "stats"})
+	})
+
+	// Create a valid agent JWT
+	agentToken := makeAgentJWT(t, testSecret)
+
+	req := httptest.NewRequest("GET", "/api/v1/scheduler/stats", nil)
+	req.Header.Set("Authorization", "Bearer "+agentToken)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// After fix: agent JWT should be rejected (route uses WebAuthMiddleware)
+	// Currently: agent JWT is accepted (200) — this assertion FAILS
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [scheduler] agent JWT accepted on scheduler stats (got %d, expected 401/403).\n"+
+			"BUG F-A3-10: scheduler stats accessible to any registered agent.\n"+
+			"After fix: change AuthMiddleware to WebAuthMiddleware on this route.", rec.Code)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 3.2 — Documents that agent JWT currently grants scheduler access
+//
+// Category: PASS-NOW / FAIL-AFTER-FIX
+//
+// This test PASSES because the bug exists (agent JWT accepted).
+// When the fix changes the middleware to WebAuthMiddleware, agent JWTs
+// will be rejected and this test will FAIL.
+// ---------------------------------------------------------------------------
+
+func TestSchedulerStatsCurrentlyAcceptsAgentJWT(t *testing.T) {
+	testSecret := "scheduler-test-secret-2"
+	middleware.JWTSecret = testSecret
+
+	router := gin.New()
+	router.Use(middleware.AuthMiddleware())
+	router.GET("/api/v1/scheduler/stats", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"scheduler": "stats"})
+	})
+
+	agentToken := makeAgentJWT(t, testSecret)
+
+	req := httptest.NewRequest("GET", "/api/v1/scheduler/stats", nil)
+	req.Header.Set("Authorization", "Bearer "+agentToken)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// This PASSES now (bug present) — agent JWT is accepted
+	if rec.Code == http.StatusUnauthorized || rec.Code == http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [scheduler] BUG F-A3-10 already fixed: "+
+			"agent JWT rejected (%d). Update this test.", rec.Code)
+	}
+
+	t.Logf("[INFO] [server] [scheduler] BUG F-A3-10 confirmed: agent JWT accepted, got %d", rec.Code)
+	t.Log("[INFO] [server] [scheduler] after fix: this test will FAIL (update to assert 401)")
+}

aggregator-server/internal/api/middleware/token_confusion_test.go

@@ -0,0 +1,148 @@
+package middleware_test
+
+// token_confusion_test.go — Pre-fix tests for cross-type JWT token confusion.
+//
+// BUG F-A3-12 MEDIUM: Agent and web JWTs share the same signing secret with
+// no issuer/audience differentiation. Cross-type token confusion is possible.
+//
+// The shared secret is set at main.go:166. Both AuthMiddleware (agent JWT)
+// and WebAuthMiddleware (admin JWT) use the same HMAC key. Without issuer
+// or audience claims, a JWT valid for one context may pass signature
+// validation in the other.
+//
+// Run: cd aggregator-server && go test ./internal/api/middleware/... -v -run TestToken
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/handlers"
+	"github.com/Fimeg/RedFlag/aggregator-server/internal/api/middleware"
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+)
+
+// makeWebJWT creates a valid web/admin JWT for testing
+func makeWebJWT(t *testing.T, secret string) string {
+	t.Helper()
+	claims := handlers.UserClaims{
+		UserID:   "1",
+		Username: "admin",
+		Role:     "admin",
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(secret))
+	if err != nil {
+		t.Fatalf("failed to sign web JWT: %v", err)
+	}
+	return signed
+}
+
+// ---------------------------------------------------------------------------
+// Test 4.1 — Web token SHOULD be rejected by agent AuthMiddleware
+//
+// Category: Verify actual behavior — PASS or FAIL depending on claims parsing
+//
+// BUG F-A3-12: Shared JWT secret allows cross-type token use. A web token
+// passes signature validation on agent middleware. The question is whether
+// claims parsing (AgentClaims expecting AgentID uuid.UUID) rejects the
+// web token that has UserID string instead.
+// ---------------------------------------------------------------------------
+
+func TestWebTokenRejectedByAgentAuthMiddleware(t *testing.T) {
+	sharedSecret := "shared-secret-confusion-test"
+	middleware.JWTSecret = sharedSecret
+
+	router := gin.New()
+	router.Use(middleware.AuthMiddleware())
+	router.GET("/agent-route", func(c *gin.Context) {
+		agentID, exists := c.Get("agent_id")
+		if !exists {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "no agent_id"})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"agent_id": agentID})
+	})
+
+	// Create a web JWT (UserClaims with UserID, Username, Role)
+	webToken := makeWebJWT(t, sharedSecret)
+
+	req := httptest.NewRequest("GET", "/agent-route", nil)
+	req.Header.Set("Authorization", "Bearer "+webToken)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// A web token SHOULD be rejected by agent middleware.
+	// If the claims parsing is strict enough, it will return 401.
+	// If not, the token passes — documenting the confusion risk.
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [auth] web JWT accepted by agent AuthMiddleware (got %d).\n"+
+			"BUG F-A3-12: cross-type token confusion — web token passes agent auth.\n"+
+			"After fix: add issuer/audience claims or use separate signing secrets.", rec.Code)
+	} else {
+		t.Logf("[INFO] [server] [auth] web JWT rejected by agent AuthMiddleware (%d) — claims parsing caught it", rec.Code)
+	}
+}
+
+// ---------------------------------------------------------------------------
+// Test 4.2 — Agent token SHOULD be rejected by WebAuthMiddleware
+//
+// Category: Verify actual behavior — PASS or FAIL depending on claims parsing
+//
+// BUG F-A3-12: An agent token (AgentClaims with AgentID uuid.UUID) may pass
+// signature validation on WebAuthMiddleware. The question is whether the
+// UserClaims parsing rejects it.
+// ---------------------------------------------------------------------------
+
+func TestAgentTokenRejectedByWebAuthMiddleware(t *testing.T) {
+	sharedSecret := "shared-secret-confusion-test-2"
+	middleware.JWTSecret = sharedSecret
+
+	authHandler := handlers.NewAuthHandler(sharedSecret, nil)
+
+	router := gin.New()
+	router.Use(authHandler.WebAuthMiddleware())
+	router.GET("/admin-route", func(c *gin.Context) {
+		userID, exists := c.Get("user_id")
+		if !exists {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "no user_id"})
+			return
+		}
+		c.JSON(http.StatusOK, gin.H{"user_id": userID})
+	})
+
+	// Create an agent JWT (AgentClaims with AgentID uuid.UUID)
+	agentClaims := middleware.AgentClaims{
+		AgentID: uuid.New(),
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(1 * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, agentClaims)
+	agentToken, err := token.SignedString([]byte(sharedSecret))
+	if err != nil {
+		t.Fatalf("failed to sign agent JWT: %v", err)
+	}
+
+	req := httptest.NewRequest("GET", "/admin-route", nil)
+	req.Header.Set("Authorization", "Bearer "+agentToken)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+
+	// An agent token SHOULD be rejected by web middleware.
+	if rec.Code != http.StatusUnauthorized && rec.Code != http.StatusForbidden {
+		t.Errorf("[ERROR] [server] [auth] agent JWT accepted by WebAuthMiddleware (got %d).\n"+
+			"BUG F-A3-12: cross-type token confusion — agent token passes admin auth.\n"+
+			"After fix: add issuer/audience claims or use separate signing secrets.", rec.Code)
+	} else {
+		t.Logf("[INFO] [server] [auth] agent JWT rejected by WebAuthMiddleware (%d) — claims parsing caught it", rec.Code)
+	}
+}

docs/A3_PreFix_Tests.md

@@ -0,0 +1,229 @@
+# A-3 Pre-Fix Test Suite
+
+**Date:** 2026-03-28
+**Branch:** culurien
+**Purpose:** Document auth middleware coverage bugs BEFORE fixes are applied.
+**Reference:** A-3 Auth Middleware Audit (recon findings F-A3-1 through F-A3-14)
+
+These tests prove that the bugs exist today and will prove the fixes work
+when applied. Do NOT modify these tests before the fix is ready — they are
+the regression baseline.
+
+---
+
+## Test Files Created
+
+| File | Package | Bugs Documented |
+|------|---------|-----------------|
+| `aggregator-server/internal/api/middleware/auth_secret_leak_test.go` | `middleware_test` | F-A3-11 (agent-side baseline) |
+| `aggregator-server/internal/api/handlers/auth_middleware_leak_test.go` | `handlers_test` | F-A3-11 (web middleware leak) |
+| `aggregator-server/internal/api/handlers/downloads_auth_test.go` | `handlers_test` | F-A3-7, F-A3-6 |
+| `aggregator-server/internal/api/middleware/scheduler_auth_test.go` | `middleware_test` | F-A3-10 |
+| `aggregator-server/internal/api/middleware/token_confusion_test.go` | `middleware_test` | F-A3-12 |
+| `aggregator-server/internal/api/handlers/auth_verify_test.go` | `handlers_test` | F-A3-2 |
+| `aggregator-server/internal/api/middleware/require_admin_test.go` | `middleware_test` | F-A3-13 |
+| `aggregator-server/internal/api/middleware/require_admin_behavior_test.go` | `middleware_test` | F-A3-13 (build-tagged, cannot compile yet) |
+| `aggregator-server/internal/api/handlers/agent_unregister_test.go` | `handlers_test` | F-A3-9 |
+
+---
+
+## How to Run
+
+```bash
+# Middleware tests (scheduler, token confusion, RequireAdmin, agent auth)
+cd aggregator-server && go test ./internal/api/middleware/... -v
+
+# Handler tests (JWT leak, downloads auth, verify, unregister)
+cd aggregator-server && go test ./internal/api/handlers/... -v
+
+# Run specific test groups
+cd aggregator-server && go test ./internal/api/middleware/... -v -run TestScheduler
+cd aggregator-server && go test ./internal/api/middleware/... -v -run TestToken
+cd aggregator-server && go test ./internal/api/middleware/... -v -run TestRequireAdmin
+cd aggregator-server && go test ./internal/api/handlers/... -v -run TestWebAuth
+cd aggregator-server && go test ./internal/api/handlers/... -v -run TestConfigDownload
+cd aggregator-server && go test ./internal/api/handlers/... -v -run TestAuthVerify
+```
+
+---
+
+## Test Inventory
+
+### File 1: `middleware/auth_secret_leak_test.go` — Agent Middleware Baseline
+
+#### `TestAgentAuthMiddlewareDoesNotLogSecret`
+- **Bug:** F-A3-11 (baseline contrast — agent middleware is clean)
+- **Asserts:** Agent AuthMiddleware does NOT print JWT secret to stdout
+- **Current state:** PASS (agent middleware is not affected)
+- **Purpose:** Establishes that the leak is specific to WebAuthMiddleware
+
+#### `TestAgentAuthMiddlewareLogHasNoEmoji`
+- **Bug:** F-A3-11 (baseline contrast)
+- **Asserts:** Agent AuthMiddleware stdout has no emoji characters
+- **Current state:** PASS
+
+### File 2: `handlers/auth_middleware_leak_test.go` — WebAuth Secret Leak
+
+#### `TestWebAuthMiddlewareDoesNotLogSecret`
+- **Bug:** F-A3-11 CRITICAL
+- **Asserts:** WebAuthMiddleware stdout does NOT contain the JWT secret string
+- **Current state:** FAIL — auth.go:128 prints `h.jwtSecret` directly
+- **After fix:** PASS — remove secret from log output
+
+#### `TestWebAuthMiddlewareLogFormatHasNoEmoji`
+- **Bug:** F-A3-11 CRITICAL
+- **Asserts:** WebAuthMiddleware stdout has no emoji (specifically U+1F513), word "secret" absent
+- **Current state:** FAIL — output contains lock emoji and word "secret"
+- **After fix:** PASS — use `[WARNING] [server] [auth]` format
+
+#### `TestWebAuthMiddlewareLogFormatCompliant`
+- **Bug:** F-A3-11 CRITICAL
+- **Asserts:** If stdout output exists, lines start with `[TAG]` pattern, no secret in output
+- **Current state:** FAIL — output is emoji-prefixed, contains secret
+- **After fix:** PASS — ETHOS-compliant format or no stdout output
+
+### File 3: `handlers/downloads_auth_test.go` — Unauthenticated Downloads
+
+#### `TestConfigDownloadRequiresAuth`
+- **Bug:** F-A3-7 CRITICAL
+- **Asserts:** GET /downloads/config/:agent_id returns 401/403 without auth
+- **Current state:** FAIL — returns 200 (no auth middleware on route)
+- **After fix:** PASS — add AuthMiddleware or WebAuthMiddleware
+
+#### `TestConfigDownloadCurrentlyUnauthenticated`
+- **Bug:** F-A3-7 CRITICAL
+- **Asserts:** Config download succeeds without auth (documents bug)
+- **Current state:** PASS — no auth middleware, request reaches handler
+- **After fix:** FAIL — update to assert 401
+
+#### `TestUpdatePackageDownloadRequiresAuth`
+- **Bug:** F-A3-6 HIGH
+- **Asserts:** GET /downloads/updates/:package_id returns 401/403 without auth
+- **Current state:** FAIL — returns 200 (no auth middleware)
+- **After fix:** PASS — add AuthMiddleware
+
+#### `TestUpdatePackageDownloadCurrentlyUnauthenticated`
+- **Bug:** F-A3-6 HIGH
+- **Asserts:** Update package download succeeds without auth (documents bug)
+- **Current state:** PASS
+- **After fix:** FAIL — update to assert 401
+
+### File 4: `middleware/scheduler_auth_test.go` — Scheduler Wrong Auth
+
+#### `TestSchedulerStatsRequiresAdminAuth`
+- **Bug:** F-A3-10 HIGH
+- **Asserts:** Agent JWT is rejected on /scheduler/stats (should require admin)
+- **Current state:** FAIL — agent JWT accepted (200)
+- **After fix:** PASS — change to WebAuthMiddleware
+
+#### `TestSchedulerStatsCurrentlyAcceptsAgentJWT`
+- **Bug:** F-A3-10 HIGH
+- **Asserts:** Agent JWT is accepted on /scheduler/stats (documents bug)
+- **Current state:** PASS — AuthMiddleware accepts agent JWT
+- **After fix:** FAIL — update to assert rejection
+
+### File 5: `middleware/token_confusion_test.go` — Cross-Type Token Confusion
+
+#### `TestWebTokenRejectedByAgentAuthMiddleware`
+- **Bug:** F-A3-12 MEDIUM
+- **Asserts:** Web/admin JWT is rejected by agent AuthMiddleware
+- **Current state:** FAIL — web JWT passes agent auth (shared secret, no audience check)
+- **After fix:** PASS — add issuer/audience claims or separate secrets
+
+#### `TestAgentTokenRejectedByWebAuthMiddleware`
+- **Bug:** F-A3-12 MEDIUM
+- **Asserts:** Agent JWT is rejected by WebAuthMiddleware
+- **Current state:** FAIL — agent JWT passes web auth (shared secret, claims parse succeeds)
+- **After fix:** PASS — add issuer/audience claims or separate secrets
+
+### File 6: `handlers/auth_verify_test.go` — Dead Verify Endpoint
+
+#### `TestAuthVerifyAlwaysReturns401WithoutMiddleware`
+- **Bug:** F-A3-2 MEDIUM
+- **Asserts:** /auth/verify returns 401 even with valid JWT (no middleware sets context)
+- **Current state:** PASS — documents the dead endpoint
+- **After fix:** N/A (test documents pre-fix state)
+
+#### `TestAuthVerifyWorksWithMiddleware`
+- **Bug:** F-A3-2 MEDIUM
+- **Asserts:** /auth/verify returns 200 when WebAuthMiddleware is applied
+- **Current state:** PASS — demonstrates the fix is just adding middleware to the route
+- **Note:** This test already passes because it applies WebAuthMiddleware directly. The bug is in the route registration (main.go:388), not in the handler code.
+
+### File 7: `middleware/require_admin_test.go` — Missing RequireAdmin
+
+#### `TestRequireAdminMiddlewareExists`
+- **Bug:** F-A3-13 LOW
+- **Asserts:** RequireAdmin function exists in middleware package (AST scan)
+- **Current state:** FAIL — function not found
+- **After fix:** PASS — implement RequireAdmin()
+
+### File 8: `middleware/require_admin_behavior_test.go` — RequireAdmin Behavior
+
+- **Build tag:** `//go:build ignore` — cannot compile until RequireAdmin exists
+- **Bug:** F-A3-13 LOW
+- **Contains:** `TestRequireAdminBlocksNonAdminUsers` — tests admin vs non-admin role check
+- **Current state:** Cannot compile (skipped)
+- **After fix:** Remove build tag, test should PASS
+
+### File 9: `handlers/agent_unregister_test.go` — Missing Rate Limit
+
+#### `TestAgentSelfUnregisterHasNoRateLimit`
+- **Bug:** F-A3-9 MEDIUM
+- **Asserts:** Documents that DELETE /:id route has no rate limiter
+- **Current state:** PASS — documents the bug
+
+#### `TestAgentSelfUnregisterShouldHaveRateLimit`
+- **Bug:** F-A3-9 MEDIUM
+- **Asserts:** DELETE /:id SHOULD have rate limiter in middleware chain
+- **Current state:** FAIL — no rate limiter on route
+- **After fix:** PASS — add rate limiter
+
+---
+
+## State-Change Summary
+
+| Test | Current | After Fix |
+|------|---------|-----------|
+| TestAgentAuthMiddlewareDoesNotLogSecret | PASS | PASS (unchanged) |
+| TestAgentAuthMiddlewareLogHasNoEmoji | PASS | PASS (unchanged) |
+| TestWebAuthMiddlewareDoesNotLogSecret | **FAIL** | PASS |
+| TestWebAuthMiddlewareLogFormatHasNoEmoji | **FAIL** | PASS |
+| TestWebAuthMiddlewareLogFormatCompliant | **FAIL** | PASS |
+| TestConfigDownloadRequiresAuth | **FAIL** | PASS |
+| TestConfigDownloadCurrentlyUnauthenticated | PASS | FAIL (update) |
+| TestUpdatePackageDownloadRequiresAuth | **FAIL** | PASS |
+| TestUpdatePackageDownloadCurrentlyUnauthenticated | PASS | FAIL (update) |
+| TestSchedulerStatsRequiresAdminAuth | **FAIL** | PASS |
+| TestSchedulerStatsCurrentlyAcceptsAgentJWT | PASS | FAIL (update) |
+| TestWebTokenRejectedByAgentAuthMiddleware | **FAIL** | PASS |
+| TestAgentTokenRejectedByWebAuthMiddleware | **FAIL** | PASS |
+| TestAuthVerifyAlwaysReturns401WithoutMiddleware | PASS | PASS (unchanged) |
+| TestAuthVerifyWorksWithMiddleware | PASS | PASS (unchanged) |
+| TestRequireAdminMiddlewareExists | **FAIL** | PASS |
+| TestRequireAdminBlocksNonAdminUsers | SKIP (build tag) | PASS |
+| TestAgentSelfUnregisterHasNoRateLimit | PASS | PASS (unchanged) |
+| TestAgentSelfUnregisterShouldHaveRateLimit | **FAIL** | PASS |
+
+**Bold FAIL** = tests that assert correct post-fix behavior (will flip to PASS after fix).
+Regular PASS = tests that document current buggy state (some will flip to FAIL after fix).
+
+---
+
+## Notes
+
+1. **TestAuthVerifyWorksWithMiddleware** passes even in pre-fix state because it
+   directly applies WebAuthMiddleware to the test router. The bug is not in the
+   handler but in the route registration (main.go:388 missing middleware). This
+   test validates that the fix is a one-line change.
+
+2. **TestAgentTokenRejectedByWebAuthMiddleware** reveals that JWT cross-type
+   confusion works in BOTH directions: agent tokens pass web auth AND web tokens
+   pass agent auth. The `jwt.ParseWithClaims` call succeeds because both claim
+   types share the same signing key and the JSON unmarshaling is permissive.
+
+3. **require_admin_behavior_test.go** uses `//go:build ignore` because it
+   references `middleware.RequireAdmin` which does not exist. Enable this test
+   when F-A3-13 is fixed by removing the build tag.
+
+4. All A-2 tests continue to pass (no regressions from A-3 test additions).