fix: align DOCUMENT_ENGINE_API_AUTH_TOKEN docs/tests and fail-closed auth for the HTTP transport

[jdrhyne]

What

Two fixes from the MCP portfolio review's desk audit of this server:

1. Env-var documentation bug — .env.example named DOCUMENT_ENGINE_AUTH_TOKEN, but the code reads DOCUMENT_ENGINE_API_AUTH_TOKEN; the integration tests gated on the wrong name too and didn't apply their computed skip flag. All aligned; integration tests now skip cleanly without an engine.
2. HTTP transport hardening (fail-closed) — the optional MCP_TRANSPORT=http endpoint had no inbound auth and could bind beyond loopback. Now:
   • MCP_HOST defaults to 127.0.0.1.
   • Binding to a non-loopback host requires a non-blank MCP_HTTP_AUTH_TOKEN; otherwise the server refuses to start with an error naming the variable.
   • When configured, every /mcp request must carry Authorization: Bearer <token> (SHA-256 digests compared with timingSafeEqual); anything else gets 401 before JSON parsing. /health and /dashboard are unaffected; stdio transport (the default) is untouched.

Tests

pnpm test: 210 passed, 43 integration skipped (no engine). pnpm run lint and pnpm run build clean. New: test/httpSecurity.test.ts (middleware + loopback detection + fail-closed startup), test/environment.test.ts additions.

https://claude.ai/code/session_0168QbHA5yAyXyYLUfPxvSoQ

[Copilot]

Pull request overview

Aligns Document Engine configuration and hardens HTTP transport authentication.

Changes:

• Corrects authentication environment-variable references and integration-test skipping.
• Adds fail-closed HTTP bearer authentication and loopback detection.
• Documents and tests the new security behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.env.example	Corrects token variable and host default.
README.md	Documents HTTP security requirements.
docs/configuration.md	Expands HTTP transport configuration guidance.
src/index.ts	Applies authentication middleware to /mcp.
src/utils/Environment.ts	Validates HTTP security configuration.
src/utils/HttpSecurity.ts	Implements loopback checks and bearer authentication.
test/environment.test.ts	Tests environment validation changes.
test/httpSecurity.test.ts	Tests HTTP security behavior.
test/integration.test.ts	Corrects integration gating and documentation.
test/integration/layers.test.ts	Corrects layer integration gating.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.