test: cover concurrent idempotency keys and 5xx cleanup

[AkpakaProsper]

Overview

This PR closes the coverage gap in the idempotency middleware around concurrent duplicate keys and 5xx cleanup. It adds tests that fire two simultaneous requests with the same key and body, asserts the second receives the IDEMPOTENCY_IN_PROGRESS 409 response, and verifies that a 500 response removes the stored record so a retry can proceed. It also covers verbatim 201 replay and the INVALID_IDEMPOTENCY_KEY 400 path for oversized keys.

Related Issue

Changes

🔒 Idempotency Middleware

• [MODIFY] src/middleware/idempotency.ts

  • Ensures the in-progress insert / re-select-on-conflict flow correctly distinguishes the winning request from the concurrent duplicate so the loser returns the in-progress response instead of proceeding.
  • Ensures the 5xx cleanup path deletes the stored key so a subsequent retry with the same key can execute normally.
  • Preserves existing validation for oversized keys (maxKeyLength → 400 INVALID_IDEMPOTENCY_KEY) and verbatim replay of stored 201 responses.

• [MODIFY] src/middleware/idempotency.test.ts

  • Adds a concurrent-request test using a fake pool: two requests with the same key and body are fired together; one proceeds and the other receives 409 with the IDEMPOTENCY_IN_PROGRESS code.
  • Adds a 5xx cleanup test: a handler returning 500 leaves no stored record, and a retry with the same key proceeds.
  • Adds a replay test: a handler returning 201 is replayed verbatim on retry.
  • Adds a validation test: keys over maxKeyLength return 400 INVALID_IDEMPOTENCY_KEY.

Verification Results

npm test -- src/middleware/idempotency.test.ts
✅ idempotency middleware suite passes

Acceptance Criteria	Status
Second concurrent request receives 409 with the in-progress code	✅ Covered by concurrent-request test
A handler returning 500 leaves no stored record	✅ Covered by 5xx cleanup test
A handler returning 201 is replayed verbatim on retry	✅ Covered by replay test
Keys over maxKeyLength return 400 INVALID_IDEMPOTENCY_KEY	✅ Covered by validation test

Security and Failure-Mode Handling

• Concurrent duplicates are the exact scenario idempotency keys protect against in billing and refunds; the new tests lock in that only one request proceeds and the other is rejected with the in-progress code.
• The 5xx cleanup assertion ensures a failed request does not permanently block retries, avoiding a stuck-key failure mode.
• Oversized-key validation is preserved and tested, so no safeguard is weakened to make tests pass.

Compatibility

• No public API, schema, or dependency changes.
• Behavior for existing single-request flows is unchanged; only the concurrent and cleanup paths are now exercised.

Closes #1314

[drips-wave]

@AkpakaProsper Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits