chore: initial commit

2026-10-23 18:35:44 +08:00
commit f6921b7b23
69 changed files with 12148 additions and 0 deletions
@@ -0,0 +1,66 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoad(t *testing.T) {
+	for _, tt := range []struct {
+		name, body string
+		wantErr    bool
+	}{
+		{"valid", "admin:\n  password: a-long-test-password\n", false},
+		{"short", "admin:\n  password: short\n", true},
+		{"multiple documents", "admin:\n  password: a-long-test-password\n---\nadmin:\n  password: ignored-password\n", true},
+		{"placeholder", "admin:\n  password: CHANGE-ME-use-a-long-random-password\n", true},
+		{"unknown", "admin:\n  password: a-long-test-password\nunknown: true\n", true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			path := filepath.Join(t.TempDir(), "config.yaml")
+			if err := os.WriteFile(path, []byte(tt.body), 0600); err != nil {
+				t.Fatal(err)
+			}
+			c, err := Load(path)
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("error=%v, wantErr=%v", err, tt.wantErr)
+			}
+			if err == nil && (c.Server.Listen != "127.0.0.1:8080" || c.Storage.Path != "./data/router.db") {
+				t.Fatal("defaults missing")
+			}
+		})
+	}
+}
+
+func TestSecurityConfig(t *testing.T) {
+	for _, tt := range []struct {
+		body    string
+		invalid bool
+	}{
+		{"", false},
+		{"limits:\n  requests_per_minute: 0\n", true},
+		{"limits:\n  per_key_concurrency: -1\n", true},
+		{"limits:\n  global_concurrency: 0\n", true},
+		{"limits:\n  requests_per_minute: nope\n", true},
+		{"server:\n  trusted_proxies: [not-a-cidr]\n", true},
+		{"server:\n  trusted_proxies: [0.0.0.0/0]\n", true},
+		{"server:\n  trusted_proxies: ['::/0']\n", true},
+		{"server:\n  trusted_proxies: [10.0.0.0/8, '::1/128']\n", false},
+		{"storage:\n  log_retention_days: -1\n", true},
+	} {
+		t.Run(tt.body, func(t *testing.T) {
+			p := filepath.Join(t.TempDir(), "config.yaml")
+			if err := os.WriteFile(p, []byte("admin:\n  password: a-long-test-password\n"+tt.body), 0600); err != nil {
+				t.Fatal(err)
+			}
+			c, err := Load(p)
+			if (err != nil) != tt.invalid {
+				t.Fatalf("error=%v", err)
+			}
+			if err == nil && (c.Limits.RequestsPerMinute != 120 || c.Limits.PerKeyConcurrency != 8 || c.Limits.GlobalConcurrency != 64 || c.Storage.LogRetentionDays != 0) {
+				t.Fatal("security defaults missing")
+			}
+		})
+	}
+}