fake-auth doesn't work when route-level middleware is applied

[Altai-man]

It works with server-side before middleware, because server-side ones are omitted...
But when route-level one silently "overwrites" fake-auth, it might be confusing to the user. If not fix, can't we at least raise a warning in this case, saying that "Try to apply your middleware on server-level"?

[jnthn]

But when route-level one silently "overwrites" fake-auth, it might be confusing to the user. If not fix, can't we at least raise a warning in this case

Not sure how we'd be able to detect this situation. Also, one might actually want to test the auth logic too, so we don't really want to rule out that possibility. Probably it's worth updating the documentation for fake-auth to note this case, however.

saying that "Try to apply your middleware on server-level"?

There's no need to apply the auth middleware on the server level; just write a route block with the routes to test, and include it into one adding the auth middleware.