feat: configure HTTP/HTTPS public entry and managed certificates

backend/internal/identityprovider/issuer_test.go

@@ -0,0 +1,57 @@
+package identityprovider
+
+import (
+	"net/http"
+	"testing"
+
+	"vpn-platform/backend/internal/tlsservice"
+)
+
+func TestIssuerHTTPPublicBase(t *testing.T) {
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	t.Setenv("VPN_TLS_MODE", "")
+	dir := t.TempDir()
+	if err := tlsservice.ConfigureMode(dir, "nginx"); err != nil {
+		t.Fatal(err)
+	}
+	if err := tlsservice.ConfigurePublicEntry(dir, "http", "vpn.example.com", 8080); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
+	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
+	if err := tlsservice.Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	base, err := issuer()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if base != "http://vpn.example.com:8080/id" {
+		t.Fatalf("issuer = %q", base)
+	}
+}
+
+func TestIssuerHTTPSOmitsDefaultPort(t *testing.T) {
+	// PublicBaseURL unit coverage is primary; here ensure issuer refuses https without Valid cert.
+	t.Setenv("VPN_TLS_DOMAIN", "")
+	t.Setenv("VPN_TLS_SCHEME", "")
+	t.Setenv("VPN_TLS_PORT", "")
+	t.Setenv("VPN_TLS_MODE", "")
+	dir := t.TempDir()
+	if err := tlsservice.ConfigureMode(dir, "nginx"); err != nil {
+		t.Fatal(err)
+	}
+	if err := tlsservice.ConfigurePublicEntry(dir, "https", "vpn.example.com", 0); err != nil {
+		t.Fatal(err)
+	}
+	t.Setenv("VPN_TLS_HTTP_ADDR", "127.0.0.1:0")
+	t.Setenv("VPN_TLS_HTTPS_ADDR", "127.0.0.1:0")
+	if err := tlsservice.Start(http.NotFoundHandler(), dir); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := issuer(); err == nil {
+		t.Fatal("https issuer must require Valid certificate")
+	}
+}