feat(backend): add unit tests for auth middleware and endpoints #369

[sweetesty]

📌 Pull Request

🔗 Related Issue
Closes #369

📝 Description

• Adds comprehensive unit tests for the auth middleware and challenge/verify endpoints to catch authentication bugs before they silently expose stream data or lock out legitimate users
• Necessary because backend/src/middleware/auth.ts and the POST /v1/auth/challenge and POST /v1/auth/verify endpoints had zero test coverage

🚀 Changes Made

• Testing — created backend/tests/auth.test.ts:
  • test_challenge_returns_nonce_for_valid_stellar_address
  • test_verify_valid_signature_returns_jwt
  • test_verify_expired_nonce_returns_401
  • test_verify_invalid_signature_returns_401
  • test_verify_wrong_address_returns_401
  • test_auth_middleware_accepts_valid_jwt
  • test_auth_middleware_rejects_expired_jwt
  • test_auth_middleware_rejects_missing_header
  • test_sse_subscribe_without_token_returns_401
  • All 9 tests use mocked Stellar signature verification — no real Stellar RPC required
  • Suite is fully compatible with CI

🧪 Testing & Validation

• Tested locally
• No runtime errors
• Existing features work as expected
• Edge cases handled (expired nonces, invalid signatures, wrong addresses, missing auth headers, expired JWTs)
• All 9 tests passing ✅

⚠️ Breaking Changes

• No breaking changes

📋 Contributor Checklist (MANDATORY)

• I was assigned to this issue
• My code follows the project structure and conventions
• I have tested my changes thoroughly
• I did not introduce unnecessary dependencies
• I have linked the issue (Closes Write unit tests for auth middleware and challenge/verify endpoints #369)
• This PR is ready for review

💡 Notes for Reviewer

• Key areas to review: mock setup for Stellar signature verification, nonce expiry simulation, JWT validation edge cases
• Known limitations: None — all cases covered with mocks, no external RPC dependency