git init

control-plane/backend/api_test.go

@@ -0,0 +1,77 @@
+package main
+
+import (
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestStrictJSON(t *testing.T) {
+	type payload struct {
+		Name string `json:"name"`
+	}
+	for _, test := range []struct {
+		body  string
+		valid bool
+	}{
+		{`{"name":"vps"}`, true},
+		{`{"name":"vps","secret":"leak"}`, false},
+		{`{"name":"vps"}{"name":"second"}`, false},
+	} {
+		request := httptest.NewRequest("POST", "/", strings.NewReader(test.body))
+		writer := httptest.NewRecorder()
+		var value payload
+		err := decodeJSON(writer, request, &value)
+		if (err == nil) != test.valid {
+			t.Fatalf("body %q valid=%v err=%v", test.body, test.valid, err)
+		}
+	}
+}
+
+func TestLoginLimiterIsBounded(t *testing.T) {
+	limiter := NewLoginLimiter(2, time.Minute)
+	now := time.Now()
+	if !limiter.Allow("ip", now) || !limiter.Allow("ip", now) {
+		t.Fatal("initial attempts rejected")
+	}
+	if limiter.Allow("ip", now) {
+		t.Fatal("limit not enforced")
+	}
+	if !limiter.Allow("ip", now.Add(time.Minute)) {
+		t.Fatal("window did not reset")
+	}
+	limiter.maxKeys = 1
+	if limiter.Allow("second-ip", now) {
+		t.Fatal("bounded limiter accepted an untracked key")
+	}
+}
+
+func TestValidators(t *testing.T) {
+	if !validSimpleName("nginx-http-auth") || validSimpleName("jail;shutdown") {
+		t.Fatal("jail validation failed")
+	}
+	if !validServiceName("wg-quick@wg0") || validServiceName("nginx/restart") {
+		t.Fatal("service validation failed")
+	}
+}
+
+func TestPercent(t *testing.T) {
+	if percent(25, 100) != 25 || percent(1, 0) != 0 {
+		t.Fatal("invalid percentage")
+	}
+}
+
+func TestRedactLogMessage(t *testing.T) {
+	input := `Authorization: Bearer abc123 password="hunter2" token=xyz&safe=1`
+	want := `Authorization: Bearer [REDACTED] password=[REDACTED] token=[REDACTED]&safe=1`
+	if got := redactLogMessage(input); got != want {
+		t.Fatalf("redaction mismatch: got %q want %q", got, want)
+	}
+}
+
+func TestTruncateUTF8(t *testing.T) {
+	if got := truncateUTF8("привет", 5); got != "пр" {
+		t.Fatalf("unexpected UTF-8 truncation %q", got)
+	}
+}