feat(tls): manage ACME domain and add desktop client settings

client/src-tauri/src/server.rs

@@ -0,0 +1,117 @@
+use std::time::Duration;
+
+use reqwest::{redirect::Policy, Url};
+use serde::{Deserialize, Serialize};
+
+#[derive(Deserialize)]
+struct HealthResponse {
+    ok: bool,
+}
+
+#[derive(Serialize)]
+pub struct ServerHealth {
+    address: String,
+    reachable: bool,
+}
+
+fn health_url(input: &str) -> Result<Url, String> {
+    let mut url = Url::parse(input.trim())
+        .map_err(|_| "请输入完整的服务端地址（含 http:// 或 https://）".to_string())?;
+    if url.scheme() != "https" && url.scheme() != "http" {
+        return Err("服务端地址须以 http:// 或 https:// 开头".to_string());
+    }
+    if url.host_str().is_none()
+        || !url.username().is_empty()
+        || url.password().is_some()
+        || url.query().is_some()
+        || url.fragment().is_some()
+        || url.path() != "/"
+    {
+        return Err("请填写服务端根地址，不包含账号、路径、查询参数或片段".to_string());
+    }
+    url.set_path("/api/health");
+    Ok(url)
+}
+
+#[tauri::command]
+pub async fn check_server(base_url: String) -> Result<ServerHealth, String> {
+    let url = health_url(&base_url)?;
+    let client = reqwest::Client::builder()
+        .timeout(Duration::from_secs(5))
+        .redirect(Policy::none())
+        .build()
+        .map_err(|err| format!("无法创建网络客户端：{err}"))?;
+    let response = client
+        .get(url.clone())
+        .send()
+        .await
+        .map_err(|err| format!("连接服务端失败：{err}"))?;
+    if !response.status().is_success() {
+        return Err(format!("服务端健康检查返回 HTTP {}", response.status()));
+    }
+    let body: HealthResponse = response
+        .json()
+        .await
+        .map_err(|_| "服务端响应不是有效的 opsx-vpn 健康结果".to_string())?;
+    if !body.ok {
+        return Err("服务端报告未就绪".to_string());
+    }
+    let mut root = url;
+    root.set_path("");
+    Ok(ServerHealth {
+        address: root.as_str().trim_end_matches('/').to_string(),
+        reachable: true,
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{check_server, health_url};
+    use std::io::{Read, Write};
+    use std::net::TcpListener;
+
+    #[test]
+    fn accepts_http_and_https_server_addresses() {
+        assert_eq!(
+            health_url("https://vpn.example.com:443").unwrap().as_str(),
+            "https://vpn.example.com/api/health"
+        );
+        assert!(health_url("http://127.0.0.1:18080/").is_ok());
+        assert!(health_url("http://localhost:18080").is_ok());
+        assert_eq!(
+            health_url("http://121.4.111.208:18080").unwrap().as_str(),
+            "http://121.4.111.208:18080/api/health"
+        );
+    }
+
+    #[test]
+    fn rejects_unsupported_schemes_and_non_root_addresses() {
+        for input in [
+            "ftp://vpn.example.com",
+            "https://user:pass@vpn.example.com",
+            "https://vpn.example.com/admin",
+            "https://vpn.example.com/?token=abc",
+            "file:///etc/passwd",
+        ] {
+            assert!(health_url(input).is_err(), "accepted {input}");
+        }
+    }
+
+    #[test]
+    fn checks_the_existing_health_contract_over_http() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind local test listener");
+        let address = listener.local_addr().unwrap();
+        let server = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().unwrap();
+            let mut request = [0; 512];
+            let read = stream.read(&mut request).unwrap();
+            assert!(String::from_utf8_lossy(&request[..read]).starts_with("GET /api/health "));
+            stream.write_all(b"HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nContent-Length: 11\r\nConnection: close\r\n\r\n{\"ok\":true}").unwrap();
+        });
+        let result =
+            tauri::async_runtime::block_on(check_server(format!("http://{address}"))).unwrap();
+        assert!(result.reachable);
+        assert_eq!(result.address, format!("http://{address}"));
+        server.join().unwrap();
+    }
+}