test: add unit tests for security middleware (JWT, CORS, rate limit, …

[mmcintosh]

test: Security Middleware Unit Tests

Target repo: SonicJs-Org/sonicjs
Branch: test/security-middleware-unit-tests
Base: main

---

Description

Add comprehensive unit tests for all security middleware introduced in PRs #659–#663. These middleware features (JWT secret externalization, CORS origin allowlist, rate limiting, security headers) were shipped without unit test coverage. This PR adds 34 new tests to validate their behavior.

Companion to #660 (JWT), #661 (CORS), #662 (rate limiting), #663 (security headers)

Changes

New Test Files

File	Tests	What It Covers
packages/core/src/__tests__/middleware/rate-limit.test.ts	15	KV-based sliding window rate limiter: allows under limit, returns 429 when exceeded, sets X-RateLimit-* and Retry-After headers, resets on window expiration, extracts IP from cf-connecting-ip / x-forwarded-for / fallback, isolates key prefixes, gracefully continues on KV errors
packages/core/src/__tests__/middleware/security-headers.test.ts	11	All 5 security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy, Strict-Transport-Security), conditional HSTS (skipped in development, applied in production/staging/unset), correct header count per environment
packages/core/src/__tests__/middleware/cors.test.ts	10	CORS origin allowlist via CORS_ORIGINS env var: no env = reject all cross-origin, single origin, multi-origin comma-separated, preflight OPTIONS handling, X-API-Key in allowed headers, allowed HTTP methods, same-origin passthrough

Updated Test File

File	Tests Added	What It Covers
packages/core/src/__tests__/middleware/auth.test.ts	+8	JWT secret externalization: generateToken/verifyToken with custom secret, wrong secret rejection, custom-secret token vs fallback mismatch, requireAuth middleware using c.env.JWT_SECRET, optionalAuth middleware using c.env.JWT_SECRET

Testing

Unit Tests

• Added 34 new unit tests (3 new files + 8 added to existing)
• All unit tests passing (84/84 across the 4 files, 181/181 total middleware tests)

E2E Tests

• No E2E changes — these are pure unit tests
• All existing E2E tests unaffected

Technical Details

• No runtime code changes — this PR is tests only
• All tests use vitest with mock Hono contexts (no real KV/D1 bindings needed)
• CORS tests use Hono's built-in app.request() for realistic HTTP-level testing
• Rate limit tests cover the full sliding window lifecycle including expiration reset
• JWT tests verify that tokens signed with one secret are rejected by a different secret

Performance Impact

Metric	Impact
Runtime performance	None (tests only)
CI duration	+~1s (84 fast unit tests)
Test coverage	+34 tests for 4 previously untested middleware

Breaking Changes

None — no runtime code changes.

Migration Notes

No action required.

Checklist

• Code follows project coding standards
• Tests added/updated and passing
• No runtime code changes
• No breaking changes
• Single clean commit from main