test: add unit test suite for KYC, plan query filters, and JWT middlewares

[owohdora-stack]

Summary

Closes #959

Implements comprehensive request tests in tests/ covering KYC API endpoints, plan query filters, and JWT middlewares. All tests follow existing patterns (lazy DB pool, tower oneshot requests, no real DB required).

Changes

Plan Query Filter Tests (tests/api_tests.rs)

• test_get_plans_filter_by_beneficiary_only — GET with ?beneficiary=
• test_get_plans_filter_by_both_owner_and_beneficiary — GET with ?owner=&beneficiary=
• test_get_plans_all_no_filters — GET with no query params
• test_get_plans_owner_filter_caches_on_miss — populated cache returns cached data with correct JSON structure

KYC API Endpoint Tests (tests/kyc_api_tests.rs — new)

Test	Endpoint	What it verifies
test_get_kyc_status_requires_wallet_address	GET /api/kyc/status	Missing query param → 400
test_get_kyc_status_with_address_hits_db	GET /api/kyc/status	With param reaches handler (500 = DB error, not auth)
test_get_kyc_status_is_public	GET /api/kyc/status	No auth required
test_submit_kyc_rejects_empty_body	POST /api/kyc/submit	Empty body → 400
test_submit_kyc_with_valid_body_hits_db	POST /api/kyc/submit	Valid body reaches handler
test_upload_kyc_document_returns_ok	POST /api/kyc/upload	Returns 200
test_upload_kyc_document_returns_expected_structure	POST /api/kyc/upload	Returns {document_id, url}
test_is_kyc_required_returns_true	GET /api/kyc/required	Returns {required: true, reason}
test_get_kyc_requirements_returns_ok	GET /api/kyc/requirements	Returns 200
test_get_kyc_requirements_returns_expected_structure	GET /api/kyc/requirements	Contains all expected fields
test_kyc_endpoints_do_not_require_auth	All KYC endpoints	None return 401

JWT Middleware Tests (tests/jwt_auth_tests.rs — new)

Test	Scenario	Expected
test_jwt_missing_authorization_header	No Authorization header	401
test_jwt_invalid_header_format	Authorization: NotBearer …	401
test_jwt_empty_bearer_token	Authorization: Bearer	401
test_jwt_invalid_token_payload	Bearer invalid.jwt.token	401
test_jwt_valid_token_with_non_admin_role	Valid JWT with role: "user"	401
test_jwt_valid_admin_token_passes_middleware	Valid JWT with role: "admin"	Passes middleware (≠ 401)
test_jwt_token_signed_with_wrong_secret_rejected	Token signed with different secret	401
test_jwt_expired_token_rejected	Token with exp in the past	401

Verification

All 84 tests pass (34 unit + 20 api + 8 jwt + 11 kyc_api + 6 kyc_webhook + 5 middleware):

cargo test

[drips-wave]

@owohdora-stack Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[ONEONUORA]

@owohdora-stack
Run cargo clippy --all-targets --all-features -- -D warnings

[ONEONUORA]

@owohdora-stack
Update on this PR

[owohdora-stack]

@ONEONUORA @Caneryy Please can any maintainer approve workflow on this pr?

[ONEONUORA]

@owohdora-stack
Run cargo fmt --all -- --check