test(security): add positive-path test for insecure TLS double-gate

Code review on PR #157 caught that the existing tests only assert the
SAFE/DEFAULT path and the env-var helper's UNSET behaviour. They never
exercise the positive path where BOTH gates are present and the insecure
TrustManager actually activates — the one combination that ships a
trust-all SSLContext and permissive HostnameVerifier.

This commit adds four tests to close the gap:

- envVarHelperShouldBeTrueWhenSetToTrue / ...WhenSetToOne
  Confirm isInsecureTlsEnvVarEnabled() honours both accepted values.

- shouldActivateInsecurePathWhenBothGatesArePresent
  The positive-path regression. Builds an OkHttpClient with
  insecureSkipVerify(true) AND AXONFLOW_INSECURE_TLS=true, then asserts:
    1. hostnameVerifier class name does NOT contain "OkHostnameVerifier"
       (i.e. the synthetic permissive lambda is installed),
    2. that verifier returns true for an arbitrary hostname,
    3. sslSocketFactory() is NOT the same instance as the one a
       default-path client produces (trust-all SSLContext is wired in).

- shouldKeepDefaultPathWhenOnlyEnvVarIsSet
  Complementary negative path — env var alone, without the builder
  flag, must keep OkHttp's default OkHostnameVerifier. Together with
  the existing "neither flag set" test, this proves the gate is
  symmetric: both must be present to flip behaviour.

Env-var injection is done with junit-pioneer 2.2.0's
@SetEnvironmentVariable, which scopes the variable to a single test
method via reflective access into java.base/java.util. The required
JDK 17+ --add-opens flags are added to the surefire argLine alongside
the existing -Dnet.bytebuddy.experimental=true.

Full suite: 1228/1228 green.

Author: saurabhjain1592

pom.xml

@@ -57,6 +57,7 @@
 
         <!-- Test Dependency Versions -->
         <junit.version>5.10.2</junit.version>
+        <junit-pioneer.version>2.2.0</junit-pioneer.version>
         <mockito.version>5.11.0</mockito.version>
         <wiremock.version>3.4.2</wiremock.version>
         <assertj.version>3.27.7</assertj.version>
@@ -128,6 +129,13 @@
             <version>${junit.version}</version>
             <scope>test</scope>
         </dependency>
+        <!-- junit-pioneer: provides @SetEnvironmentVariable for in-process env-var injection -->
+        <dependency>
+            <groupId>org.junit-pioneer</groupId>
+            <artifactId>junit-pioneer</artifactId>
+            <version>${junit-pioneer.version}</version>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
@@ -183,7 +191,8 @@
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>${maven-surefire-plugin.version}</version>
                 <configuration>
-                    <argLine>@{argLine} -Dnet.bytebuddy.experimental=true</argLine>
+                    <!-- add-opens flags below are required by junit-pioneer's @SetEnvironmentVariable on JDK 17+ -->
+                    <argLine>@{argLine} -Dnet.bytebuddy.experimental=true --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED</argLine>
                     <skipTests>${skipUnitTests}</skipTests>
                     <includes>
                         <include>**/*Test.java</include>

src/test/java/com/getaxonflow/sdk/util/HttpClientFactoryTest.java

@@ -22,6 +22,7 @@
 import okhttp3.OkHttpClient;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
+import org.junitpioneer.jupiter.SetEnvironmentVariable;
 
 @DisplayName("HttpClientFactory")
 class HttpClientFactoryTest {
@@ -100,4 +101,81 @@ void envVarHelperShouldBeFalseWhenUnset() {
                 + "has the env var set and the insecure path could activate")
         .isFalse();
   }
+
+  @Test
+  @DisplayName("env-var gate helper should be true when AXONFLOW_INSECURE_TLS=true")
+  @SetEnvironmentVariable(key = "AXONFLOW_INSECURE_TLS", value = "true")
+  void envVarHelperShouldBeTrueWhenSetToTrue() {
+    assertThat(HttpClientFactory.isInsecureTlsEnvVarEnabled())
+        .as("helper must return true when env var is set to 'true'")
+        .isTrue();
+  }
+
+  @Test
+  @DisplayName("env-var gate helper should be true when AXONFLOW_INSECURE_TLS=1")
+  @SetEnvironmentVariable(key = "AXONFLOW_INSECURE_TLS", value = "1")
+  void envVarHelperShouldBeTrueWhenSetToOne() {
+    assertThat(HttpClientFactory.isInsecureTlsEnvVarEnabled())
+        .as("helper must return true when env var is set to '1'")
+        .isTrue();
+  }
+
+  @Test
+  @DisplayName(
+      "should activate insecure TLS path when BOTH insecureSkipVerify(true) AND env var are set")
+  @SetEnvironmentVariable(key = "AXONFLOW_INSECURE_TLS", value = "true")
+  void shouldActivateInsecurePathWhenBothGatesArePresent() {
+    // Positive-path regression: this is the single combination where the trust-all path
+    // is intentionally activated. Both gates MUST be required; either alone is insufficient
+    // (covered by sibling tests). If either gate stops being required, this test will still
+    // pass — the gating behaviour is asserted in the negative-path tests.
+    AxonFlowConfig config =
+        AxonFlowConfig.builder().agentUrl("https://localhost:8080").insecureSkipVerify(true).build();
+
+    OkHttpClient client = HttpClientFactory.create(config);
+
+    assertThat(client).isNotNull();
+
+    // 1. Hostname verifier MUST be the permissive lambda, NOT OkHttp's default OkHostnameVerifier.
+    //    The permissive verifier in HttpClientFactory is `(hostname, session) -> true`, which is
+    //    a synthetic lambda class — its name will NOT contain "OkHostnameVerifier".
+    assertThat(client.hostnameVerifier().getClass().getName())
+        .as("permissive hostname verifier must be installed when both gates are set")
+        .doesNotContain("OkHostnameVerifier");
+
+    // 2. Functional check: the verifier must accept any hostname/session pair.
+    assertThat(client.hostnameVerifier().verify("any.host.example", null))
+        .as("permissive hostname verifier must return true for arbitrary hostnames")
+        .isTrue();
+
+    // 3. SSL socket factory must be the trust-all-configured one (i.e. NOT the JVM default
+    //    that OkHttp lazily constructs from the system trust store). We assert non-null and
+    //    that calling sslSocketFactory() does not trigger OkHttp's default construction path
+    //    by comparing against a freshly built default client.
+    AxonFlowConfig defaultConfig =
+        AxonFlowConfig.builder().agentUrl("https://localhost:8080").build();
+    OkHttpClient defaultClient = HttpClientFactory.create(defaultConfig);
+    assertThat(client.sslSocketFactory())
+        .as("insecure-path SSL socket factory must differ from the default-path factory")
+        .isNotSameAs(defaultClient.sslSocketFactory());
+  }
+
+  @Test
+  @DisplayName(
+      "should NOT activate insecure TLS path when env var is set but builder flag is false")
+  @SetEnvironmentVariable(key = "AXONFLOW_INSECURE_TLS", value = "true")
+  void shouldKeepDefaultPathWhenOnlyEnvVarIsSet() {
+    // Complementary negative path: env var alone, without insecureSkipVerify(true), must
+    // keep the default safe TrustManager and OkHostnameVerifier. The double-gate is symmetric:
+    // BOTH must be present — neither alone activates the insecure path.
+    AxonFlowConfig config =
+        AxonFlowConfig.builder().agentUrl("https://localhost:8080").build();
+
+    OkHttpClient client = HttpClientFactory.create(config);
+
+    assertThat(client).isNotNull();
+    assertThat(client.hostnameVerifier().getClass().getName())
+        .as("default hostname verifier must remain when only env var is set")
+        .contains("OkHostnameVerifier");
+  }
 }