fix: fix security issue in index.js

[anupamme]

Summary

Fix critical severity security issue in src/index.js.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	src/index.js:65
Assessment	Likely exploitable
Chain Complexity	3-step

Description: The application initializes an Express server via @wppconnect/server without any authentication middleware. The server exposes all functionality without requiring credentials, allowing unauthenticated access to the entire API surface including WhatsApp messaging operations.

Evidence

Exploitation scenario: An attacker can send HTTP requests to any API endpoint without authentication.

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/index.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: Protected endpoints reject unauthenticated requests

Regression test

const { initServer } = require('@wppconnect/server');
const request = require('supertest');

describe("protected endpoints reject unauthenticated requests", () => {
  let app;

  beforeAll(async () => {
    const server = await initServer({ port: 0 });
    app = server.app;
  });

  const payloads = [
    { desc: "missing token", auth: undefined },
    { desc: "expired token", auth: "Bearer [REDACTED]" },
    { desc: "malformed token", auth: "Bearer invalid.token.here" }
  ];

  test.each(payloads)("rejects %s", async ({ auth }) => {
    const res = await request(app)
      .get('/api/session')
      .set(auth ? { Authorization: auth } : {});
    
    expect([401, 403]).toContain(res.status);
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security