Added lib/test-var.ts

Hardcoded production API keys are committed directly in source code (OPENAI_KEY, ANTHROPIC_KEY, TAVILY_KEY). These appear to be real keys based on their format and the TODO comment acknowledging they should be env vars. This is a critical security vulnerability.

Suggestion: Remove all hardcoded keys immediately. Rotate these keys at the provider level as they are now compromised. Use environment variables (process.env.OPENAI_KEY, etc.) and add .env to .gitignore. Never commit secrets to version control.

authorize() function always returns true regardless of token validity, completely bypassing authentication. The comment 'skip validation for now' indicates intentional security bypass.

Suggestion: Implement actual token validation logic or remove this function entirely if not ready. Do not merge authentication code that unconditionally grants access.

adminBypass() function always returns true for any input, even when userId is falsy (empty string, null, undefined). This completely defeats any admin authorization checks.

Suggestion: Implement proper admin authorization logic with actual role/permission checks. If this is truly just test code, it should not be in lib/ where it could be imported by production code.