feat(backend): bypass sig validation

[sabineschaller]

Changes proposed in this pull request

• bypass sig validation using same flag as auth server (see feat(auth): fix httpsig bypass env #735)

Context

Checklist

• Related issues linked using fixes #number
• Tests added/updated
• Documentation added
• Make sure that all checks pass

[wilsonianb]

You could add tests that bypassSignatureValidation:

• works with invalid signature
• doesn't work with invalid token

[wilsonianb]

I think the check should be moved below to wrap:

rafiki/packages/backend/src/open_payments/auth/middleware.ts

Lines 48 to 55 in e796ded

	try {
	if (!(await verifySigAndChallenge(grant.key.jwk, ctx))) {
	ctx.throw(401, 'Invalid signature')
	}
	} catch (e) {
	ctx.status = 401
	ctx.throw(401, `Invalid signature`)
	}

[mkurapov]

Log might be handy when signature validation is being bypassed, could also do an early return to avoid nesting

[wilsonianb]

could also do an early return to avoid nesting

I think we do still want the ctx.grant = grant below