初版功能完成

internal/identity/identity_test.go

@@ -0,0 +1,84 @@
+package identity
+
+import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"remlink/internal/model"
+)
+
+type testProtector struct{}
+
+func (testProtector) Protect(value []byte) ([]byte, error) {
+	result := append([]byte("protected:"), value...)
+	for left, right := 0, len(result)-1; left < right; left, right = left+1, right-1 {
+		result[left], result[right] = result[right], result[left]
+	}
+	return result, nil
+}
+
+func (testProtector) Unprotect(value []byte) ([]byte, error) {
+	result := append([]byte(nil), value...)
+	for left, right := 0, len(result)-1; left < right; left, right = left+1, right-1 {
+		result[left], result[right] = result[right], result[left]
+	}
+	return bytes.TrimPrefix(result, []byte("protected:")), nil
+}
+
+func TestIdentityRoundTripWithoutPlaintextSecrets(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "Engineer", "identity.json")
+	store, err := NewStore(path, testProtector{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := New(model.NodeTypeEngineer, "Engineer-A", "http://203.0.113.1:8080/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	value.NodeToken = "plain-node-token-that-must-not-appear"
+	value.ConfigVersion = 7
+	value.OwnedRoutes = []string{"192.168.13.0/24"}
+	if err := store.Save(value); err != nil {
+		t.Fatal(err)
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(raw, []byte(value.NodeToken)) || bytes.Contains(raw, []byte(value.PrivateKey.String())) {
+		t.Fatalf("identity file contains a plaintext secret: %s", raw)
+	}
+	loaded, err := store.Load()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if loaded.NodeID != value.NodeID || loaded.PrivateKey != value.PrivateKey || loaded.NodeToken != value.NodeToken ||
+		loaded.ConfigVersion != 7 || len(loaded.OwnedRoutes) != 1 {
+		t.Fatalf("loaded identity differs: %+v", loaded)
+	}
+
+	value.NodeName = "Engineer-Renamed"
+	if err := store.Save(value); err != nil {
+		t.Fatalf("replace identity: %v", err)
+	}
+	loaded, err = store.Load()
+	if err != nil || loaded.NodeName != value.NodeName {
+		t.Fatalf("replaced identity = %+v, %v", loaded, err)
+	}
+}
+
+func TestIdentityValidation(t *testing.T) {
+	if _, err := New(model.NodeType("server"), "x", "http://example.test"); err == nil {
+		t.Fatal("invalid Node type accepted")
+	}
+	if _, err := New(model.NodeTypeSite, "x", "not-a-url"); err == nil {
+		t.Fatal("invalid Server URL accepted")
+	}
+	for _, raw := range []string{"http://user:secret@example.test", "http://example.test/api", "http://example.test?redirect=elsewhere"} {
+		if _, err := New(model.NodeTypeSite, "x", raw); err == nil {
+			t.Errorf("unsafe Server URL %q accepted", raw)
+		}
+	}
+}