[EmmyLee07]

Summary

Adds deterministic route-level coverage for pool wallet ownership, privileged admin actions, and the paused-pool response contract.

Linked issue

Closes #2102

Changes

• Adds isolated Supertest/Jest coverage for lender ownership and cross-wallet denial.
• Verifies admin access to pool write routes, rejects mismatched depositor wallets, and checks the paused-pool 503 response.

Screenshots / Demo

Not applicable for this backend-only test change. Verification output:

Test Suites: 1 passed, 1 total
Tests:       7 passed, 7 total

Implementation notes

Mocks database, cache, transaction, and Soroban dependencies to keep route behavior deterministic. Exercises the existing Express middleware and pool routes without production-code changes.

Testing

• cd backend && npm test -- --runInBand src/__tests__/poolRoutes.authorization.test.ts - passed (7 tests).
• cd backend && npm run typecheck - passed.
• cd backend && npm run build - passed.
• cd backend && npm run lint - passed with 43 existing warnings; no warnings in the new test.

Acceptance criteria

• Add deterministic tests for success, failure, boundary, and authorization paths described above.
• Assert public HTTP status, message, and error-code behavior.
• CI run and confirmation.

Checklist

• Follows CONTRIBUTING guidelines and code style.
• Lint, build, typecheck, and affected tests pass locally.
• No unrelated changes.
• Docs/changelog not required for test-only coverage.
• Rebased on latest upstream main, no conflicts.
• No AI-disclosure requirement found in repository guidance.

Notes for reviewers

CI checks will run on the pull request.

[github-actions]

Malware detection scan flagged this pull request

The scan found 1 indicator(s) in the PR diff. This PR is blocked until a maintainer reviews the flagged files.

• backend/src/__tests__/poolRoutes.authorization.test.ts — hidden-appended-config-payload (high)

This is an automated triage signal; maintainers must verify whether the finding is malicious or intentional.