fix: require a validated service token for external delivery in all environments

[Bccorb]

What changed

External delivery returns OTP and magic-link secrets in the response body instead of sending them. It now requires a validated internal service token in every environment.

• canReturnExternalDelivery no longer treats a non-production NODE_ENV as sufficient. The x-seamless-auth-delivery-mode: external header must be accompanied by an x-seamless-service-token that passes the existing validateInternalServiceToken check plus the issuer, audience, and subject checks.
• canReturnSensitiveDevelopmentDetails followed the same environment-based pattern and is now gated the same way. It is reached from createAdminBootstrapInviteHandler, which returns the bootstrap invite URL and token.
• Callers affected: src/controllers/otp.ts, src/controllers/magicLinks.ts, src/controllers/registration.ts, src/controllers/bootstrap.ts.

Local development opt-in

Local development and some manual tooling relied on the environment check, so there is a replacement that cannot be reached by accident:

ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true

It is off unless set explicitly, it is ignored (with an error logged) when NODE_ENV=production, and it is documented in .env.example alongside the docs updates. I chose an explicit env opt-in over reintroducing an environment-derived default so the permissive mode is always a deliberate operator action and can never apply in production, regardless of how a deployment is configured.

Tests

Specs that exercised external delivery previously relied on the environment shortcut. They now mint a trusted service token through the new tests/factories/serviceTokenFactory, and the shared mock in tests/setup/mocks.ts rejects every token by default so any spec not opting in exercises the credentialed path. tests/unit/lib/externalDelivery.spec.ts covers the new matrix: no token, valid token, untrusted issuer or audience, the opt-in flag, and the opt-in flag being ignored in production.

Local run:

• npm run typecheck passes
• npm run lint passes
• npm run format:check passes
• npm run test:run 951 passed, 1 skipped, 87 files
• npm run coverage passes thresholds, src/lib/externalDelivery.ts at 100%

Contract note

This changes the conditions under which the external delivery response shape is returned, so callers that use the header without a service token outside production will now receive the standard response instead of a delivery payload. seamless-auth-server is the likely affected repo. Happy to survey it and propose coordinated edits as a follow-up.

Follow-up for the maintainer

Worth confirming separately that every reachable deployed environment, including staging and preview, sets NODE_ENV=production.