Refine WireGuard client routing and authentication UI

backend/internal/service/wireguard/wireguard_test.go

@@ -83,6 +83,32 @@ func TestValidateRejectsUnsafeNATAndInvalidPeerAddress(t *testing.T) {
 	}
 }
 
+func TestValidateWireGuardAuthMode(t *testing.T) {
+	for _, mode := range []string{"", "password"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "auth_mode": mode}); err != nil {
+			t.Fatalf("legacy/password mode %q rejected: %v", mode, err)
+		}
+	}
+	for _, mode := range []string{"oidc", "unknown"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "auth_mode": mode}); err == nil {
+			t.Fatalf("unsupported authentication mode %q accepted", mode)
+		}
+	}
+}
+
+func TestValidateLatencyProbeTarget(t *testing.T) {
+	for _, target := range []string{"10.88.0.1:22", "[2001:db8::1]:443", ""} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "latency_probe": target}); err != nil {
+			t.Fatalf("valid target %q rejected: %v", target, err)
+		}
+	}
+	for _, target := range []string{"example.com:443", "10.88.0.1:0", "10.88.0.1:65536", "invalid"} {
+		if _, err := New().Validate(map[string]interface{}{"address": "10.8.0.1/24", "latency_probe": target}); err == nil {
+			t.Fatalf("invalid target %q accepted", target)
+		}
+	}
+}
+
 func TestNATOnlyAppliesToWireGuardSubnet(t *testing.T) {
 	conf := renderServerConfig(map[string]interface{}{
 		"address": "10.88.0.1/24", "listen_port": 51820,