From 04965eb89df0c1cb25348fddf2c1bc1adc1a0344 Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Mon, 4 May 2026 20:58:50 +0000
Subject: [PATCH] fix(auth): restore unconditional Better-Auth fallback, add
 unknown-path test

Remove startsWith('/auth') guard that caused non-auth paths to hang with
no response. Better-Auth already handles /health and /auth/health are
explicitly short-circuited before the handler. Add test asserting unknown
paths receive a terminal response within 1s.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 auth/src/__tests__/health.test.ts | 17 +++++++++++++++++
 auth/src/index.ts                 |  7 ++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/auth/src/__tests__/health.test.ts b/auth/src/__tests__/health.test.ts
index 356e4b4..efb66fd 100644
--- a/auth/src/__tests__/health.test.ts
+++ b/auth/src/__tests__/health.test.ts
@@ -97,4 +97,21 @@ describe('Auth health endpoint', () => {
     equal(status, 503);
     equal(body, '{"status":"error","db":"unreachable"}');
   });
+
+  it('returns a terminal response for unknown paths (no hang)', async () => {
+    const poolMock = { connect: async () => ({ query: async () => {}, release: () => {} }) };
+    const { port, close } = await startHealthServer(poolMock);
+
+    const result = await new Promise<{ status: number }>((resolve) => {
+      const req = http.get(`http://localhost:${port}/`, (res) => {
+        res.resume();
+        res.on('end', () => resolve({ status: res.statusCode ?? 0 }));
+      });
+      req.on('error', () => resolve({ status: 0 }));
+      setTimeout(() => resolve({ status: -1 }), 1000);
+    });
+    close();
+
+    equal(result.status !== -1, true, 'Unknown path must return a terminal response within 1s');
+  });
 });
\ No newline at end of file
diff --git a/auth/src/index.ts b/auth/src/index.ts
index c5d2f88..71448e1 100644
--- a/auth/src/index.ts
+++ b/auth/src/index.ts
@@ -28,11 +28,8 @@ const server = createServer(async (req, res) => {
     return;
   }
 
-  // All /auth/* routes handled by Better-Auth
-  if (req.url?.startsWith("/auth")) {
-    await handler(req, res);
-    return;
-  }
+  // All other routes handled by Better-Auth (returns 404 for unknown paths)
+  await handler(req, res);
 });
 
 server.listen(port, "0.0.0.0", () => {