test(security): Tier 1 unit tests for untested security-critical modules

[Hans1132]

Context

Follow-up to a test-coverage analysis of the codebase. The suite is strong on the IRIS scoring/accuracy path and a handful of security primitives, but several large, security-sensitive modules had zero dedicated unit tests. This PR closes the Tier 1 (highest-risk) gaps. Tests only — no production behavior changes.

What's added (+40 tests, all offline)

File	Module under test	Why it matters
tests/validation/address.test.js (10)	src/validation/address.js	Gates chain routing for the whole scan pipeline; covers base58 charset/length boundaries + the PublicKey off-curve try/catch branch
tests/enrichment/token-extensions.test.js (12)	src/enrichment/token-extensions.js	Token-2022 binary TLV parser — PermanentDelegate (CRITICAL) / TransferHook (HIGH) detection, unset-delegate downgrade, truncated/garbage-buffer fuzz (must not throw or over-read)
tests/enrichment/goplus.test.js (8)	src/enrichment/goplus.js	Circuit-breaker state machine (closed→open→half_open→closed), toBool/toFloat normalization, is_malicious heuristic, timeout path
tests/crypto/sign-timeout.test.js (5)	src/crypto/sign.js	Report-signing SPOF — semaphore released on every exit path; a burst of failures cannot deadlock the pool
tests/monitor/webhook-auth.test.js (5)	src/monitor/webhook-receiver.js	Helius webhook auth gate (missing/wrong/Bearer-prefixed secret all rejected)

All external dependencies (db, fetch, child_process spawn) are mocked/stubbed — no network, no secrets. Wired into the npm test chain in package.json.

Note for review

• The analysis flagged a suspected "pagination overrun" in lib/helius-poller.js. I verified it is not a bug — totalPages++ runs before the fetch as the sharp-edge note requires. The real gap there (untested pagination) is queued for Tier 2, not this PR.
• sign-timeout uses real python3 stub scripts (with a skip-guard if absent), matching the prod pipeline.
• Tiers 2 (pollers / bitquery / rugcheck / solana-tracker) and 3 (auth open-redirect fuzz, mailer XSS, report-generator) remain as follow-ups.

Verification

npm ci   # fresh container has no node_modules
node tests/validation/address.test.js          # 10 pass
node tests/enrichment/token-extensions.test.js  # 12 pass
node tests/enrichment/goplus.test.js            #  8 pass
node tests/crypto/sign-timeout.test.js          #  5 pass
node tests/monitor/webhook-auth.test.js         #  5 pass

https://claude.ai/code/session_013zuzbRSW4G4L1CrReKpLpf

---

Generated by Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 54bf4c0a-d68f-4887-9731-b5767bb9cc9f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/test-coverage-analysis-7PEb8

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}