feat(tls): manage ACME domain and add desktop client settings

backend/internal/tlsservice/tlsservice_test.go

@@ -0,0 +1,72 @@
+package tlsservice
+
+import (
+	"net"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestDomainValidationAndRestart(t *testing.T) {
+	for _, domain := range []string{"test-link.appx365.com", "a.b"} {
+		if !ValidDomain(domain) {
+			t.Errorf("valid domain rejected: %s", domain)
+		}
+	}
+	for _, domain := range []string{"", "localhost", "127.0.0.1", "-a.example.com", "a..example.com", "a.example.com:80", "*.example.com", "a.example.com/evil"} {
+		if ValidDomain(domain) {
+			t.Errorf("invalid domain accepted: %s", domain)
+		}
+	}
+
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	dir := t.TempDir()
+	if err := Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	if err := ConfigureDomain(dir, "Test-Link.Appx365.Com"); err != nil {
+		t.Fatal(err)
+	}
+	status := Status()
+	if status.Enabled || status.Domain != "" || status.ConfiguredDomain != "test-link.appx365.com" || !status.RestartRequired {
+		t.Fatalf("saved domain must wait for restart: %+v", status)
+	}
+	info, err := os.Stat(filepath.Join(dir, "tls-domain"))
+	if err != nil || info.Mode().Perm() != 0o600 {
+		t.Fatalf("domain config permissions: %v, %v", info, err)
+	}
+	t.Setenv("VPN_TLS_DOMAIN", "other.example.com")
+	if err := ConfigureDomain(dir, "test-link.appx365.com"); err == nil {
+		t.Fatal("environment-managed domain must not be overwritten")
+	}
+}
+
+func TestFailedHTTPSBindReleasesHTTPPort(t *testing.T) {
+	t.Setenv("VPN_TLS_DOMAIN", "test-link.appx365.com")
+	occupied, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer occupied.Close()
+	httpPort, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	httpAddr := httpPort.Addr().String()
+	httpPort.Close()
+	t.Setenv("VPN_TLS_HTTP_ADDR", httpAddr)
+	t.Setenv("VPN_TLS_HTTPS_ADDR", occupied.Addr().String())
+	if err := Start(http.NotFoundHandler(), t.TempDir()); err == nil || !strings.Contains(err.Error(), "HTTPS") {
+		t.Fatalf("expected HTTPS port conflict: %v", err)
+	}
+	rebound, err := net.Listen("tcp", httpAddr)
+	if err != nil {
+		t.Fatalf("HTTP listener leaked after HTTPS bind failed: %v", err)
+	}
+	rebound.Close()
+	if Status().Enabled {
+		t.Fatal("failed start reported active TLS")
+	}
+}