package openvpn

import (
	"strings"
	"testing"
)

func TestValidateOpenVPNModes(t *testing.T) {
	cfg, err := New().Validate(map[string]interface{}{"auth_mode": "password", "subnet": "10.8.0.0 255.255.255.0"})
	if err != nil {
		t.Fatal(err)
	}
	if cfg["proto"] != "udp" || cfg["port"] != 1194 {
		t.Fatalf("defaults not applied: %#v", cfg)
	}
	if _, err := New().Validate(map[string]interface{}{"auth_mode": "unknown"}); err == nil {
		t.Fatal("expected invalid auth mode error")
	}
}

func TestCertificateCNIsSafeAndStable(t *testing.T) {
	cn := certificateCN("张三 / alice@example.com")
	if !certificateName.MatchString(cn) || !strings.HasPrefix(cn, "u-") {
		t.Fatalf("unsafe CN: %q", cn)
	}
}