[GangDev6707]

Summary

This PR adds deterministic unit tests for backend/src/middleware/idempotency.ts covering concurrent identical requests, failed replay / conflict scenarios, key and lock expiration behavior, public response headers, and wallet-level key namespacing.

Closes #2097

Key Test Coverage Added

1. Concurrent Identical Requests:
   • Deterministic 409 Conflict rejection when an in-flight reservation lock is held (cacheService.setNotExists returns false).
   • Race condition resilience: verifies parallel execution with simulated concurrent lock contention where exactly one request acquires lock and the competing request is cleanly rejected.
   • Lock release and cache population upon response completion, enabling legitimate subsequent replays.
2. Failed Replay & Conflict Boundaries:
   • Rejects mismatched HTTP method reuse with 409 Conflict.
   • Rejects mismatched URL path reuse with 409 Conflict.
   • Rejects mismatched request body payloads with 409 Conflict.
   • Non-caching of 5xx errors (e.g. 500, 503): ensures internal failures are retried cleanly rather than cached.
   • Fail-open error tolerance: unhandled cache lookup exceptions do not drop user requests.
3. Expired Keys & TTL Behavior:
   • Expired cache entries (24h TTL) execute cleanly as fresh requests.
   • Stale in-flight locks (30s TTL expiry) allow subsequent retries to acquire locks if a previous request terminated prematurely.
4. Public Response Headers & Payloads:
   • Asserts X-Idempotent-Replayed: false on initial execution and X-Idempotent-Replayed: true + X-Idempotency-Cache: HIT on cache replay.
   • Preserves both res.json and string payloads through res.send.
   • Caches and replays 4xx client errors deterministically.
5. Authorization Namespacing:
   • Validates that caller wallet namespaces (idemp:<actor>:<key>) isolate identical keys between distinct actors.

Verification

• npm test -- src/middleware/__tests__/idempotency.test.ts (19/19 passed, 100% green)
• npm run build (0 TypeScript errors)
• npm test (126 test suites passed, 1091 tests passing)

[github-actions]

Malware detection scan flagged this pull request

The scan found 1 indicator(s) in the PR diff. This PR is blocked until a maintainer reviews the flagged files.

• backend/src/middleware/__tests__/idempotency.test.ts — hidden-appended-config-payload (high)

This is an automated triage signal; maintainers must verify whether the finding is malicious or intentional.