Skills: route middleware, registerMiddleware(), group meta and middleware testing

[lmajano]

Updates three skills for the route middleware work across ColdBox and cbsecurity.

Changes

• coldbox/routing-development
  • New "Registering Named Middleware" section for registerMiddleware( name, target, point, force ) (ColdBox 8.3+: COLDBOX-1460 Add Router.registerMiddleware() for named closure, lambda and instance middleware coldbox-platform#719, COLDBOX-1460), including the bulk form, duplicate and force rules, and the register-before-reference rule.
  • New "Sharing Route Metadata With a Group" section for the group() meta option (8.3+: COLDBOX-1459 Route middleware: run it in BaseTestCase.execute() and let group() share meta coldbox-platform#714).
  • The group example used middleware = "cbsecurity", which is not a middleware that exists. It now uses [ "Authenticated@cbsecurity" ].
• modules/cbsecurity
  • New "Route Middleware" section: Authenticated, Authorized, JwtAuth and BasicAuth with permissions, roles and mode in the route meta() (Add route middleware: auth, Throttle, ApiKey, IP filtering, HTTPS, CSRF, Honeypot and signed URLs coldbox-modules/cbsecurity#74).
  • The "Securing API Routes" example used .withMiddleware( "JwtAuthFilter@cbsecurity" ) and .toAction(), neither of which exist. It now uses JwtAuth@cbsecurity.
• coldbox/testing-integration: execute() and get()/post() run route middleware from ColdBox 8.3, with an example.

Version labels follow the existing "ColdBox 8.2.0+" convention. Merge after the linked ColdBox and cbsecurity PRs ship, or keep the 8.3 and 3.9 labels as they are.

Not changed, but wrong

While in modules/cbsecurity/SKILL.md I saw other statements that do not match the cbsecurity source. I left them out of this PR to keep it to the middleware work:

• SecurityService@cbsecurity and getCurrentUser() (the model is CBSecurity@cbsecurity and the method is getUser())
• hasRole(), hasPermission() on the security object (it has has(), all(), none(), secure() and friends)
• firewall keys autoSecureAll and authenticate, and a boolean whiteList (the rule keys are secureList, whitelist, permissions, roles, action, and so on)
• the IUserService method list and the cfauth provider

I can send a follow-up PR that corrects those against the source if wanted.

🤖 Generated with Claude Code

https://claude.ai/code/session_01E8yy4oK5vnaVucmYLg4UtY

---

Generated by Claude Code