fix: fix security issue in index.js

[anupamme]

Summary

Fix critical severity security issue in src/index.js.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	src/index.js:48
Assessment	Likely exploitable

Description: The application does not implement any authorization controls. The initServer() function at src/index.js:48 initializes the @wppconnect/server without role-based access control. All users have equal access to all functionality including WhatsApp operations and potential S3 integrations.

Evidence

Exploitation scenario: Any user who gains access to the application can perform all operations including administrative functions.

Scanner confirmation: multi_agent_ai rule V-003 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This is a Node.js library - vulnerabilities affect downstream consumers who use this package.

Changes

• src/index.js

Behavior Preservation

The change is scoped to 1 file on the vulnerable path.

Security Invariant

Property: The security boundary is maintained under adversarial input

Regression test

const { initServer } = require('../src/index');

describe("initServer enforces authorization controls for all operations", () => {
  const testCases = [
    { name: "missing auth config", options: { } },
    { name: "empty auth config", options: { auth: { } } },
    { name: "null auth config", options: { auth: null } },
    { name: "valid config with RBAC", options: { auth: { roles: ['admin', 'user'], defaultRole: 'user' } } },
  ];

  test.each(testCases)("requires authorization config: $name", async ({ name, options }) => {
    const result = initServer(options);
    
    // Security invariant: server must not initialize without proper authorization controls
    const hasAuthControls = result && 
      result.app && 
      result.app.locals && 
      result.app.locals.authConfig &&
      result.app.locals.authConfig.roles &&
      result.app.locals.authConfig.roles.length > 0;
    
    if (name.includes("valid")) {
      expect(hasAuthControls).toBe(true);
    } else {
      // Server should either fail to initialize or have default auth controls applied
      const isSecure = hasAuthControls || result === null || result === undefined;
      expect(isSecure).toBe(true);
    }
  });
});

This test guards against regressions — it's useful independent of the code change above.

---

Automated security fix by OrbisAI Security