feat: establish NekoNest Cloud control and relay

relay/internal/config/config_test.go

@@ -0,0 +1,59 @@
+package config
+
+import (
+	"crypto/ed25519"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"testing"
+	"time"
+)
+
+func TestParseOriginsRejectsPathsAndWildcards(t *testing.T) {
+	if _, err := parseOrigins("https://pwa.example.cn,https://other.example.cn"); err != nil {
+		t.Fatal(err)
+	}
+	for _, raw := range []string{"*", "https://pwa.example.cn/path", "http://pwa.example.cn"} {
+		if _, err := parseOrigins(raw); err == nil {
+			t.Fatalf("parseOrigins(%q) succeeded", raw)
+		}
+	}
+}
+
+func TestParseSnapshotKeysPinsLifetime(t *testing.T) {
+	publicKey, _, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Now().UTC().Truncate(time.Second)
+	records := []snapshotKeyConfig{{
+		KID:          "key-1",
+		PublicKeyJWK: json.RawMessage(`{"kty":"OKP","crv":"Ed25519","kid":"key-1","x":"` + base64.RawURLEncoding.EncodeToString(publicKey) + `"}`),
+		NotBefore:    now.Add(-time.Hour).Format(time.RFC3339Nano),
+		RetainUntil:  now.Add(time.Hour).Format(time.RFC3339Nano),
+	}}
+	raw, _ := json.Marshal(records)
+	keys, err := parseSnapshotKeys(string(raw), now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(keys) != 1 {
+		t.Fatalf("keys = %d", len(keys))
+	}
+}
+
+func TestParseInternalEndpointsRequiresOpaqueReferencesAndOrigins(t *testing.T) {
+	endpoints, err := parseInternalEndpoints(`{"cn-east-a":"https://relay-a.internal.example"}`)
+	if err != nil || endpoints["cn-east-a"] != "https://relay-a.internal.example" {
+		t.Fatalf("endpoints=%#v err=%v", endpoints, err)
+	}
+	for _, raw := range []string{
+		`{"../escape":"https://relay.example"}`,
+		`{"node":"https://relay.example/path"}`,
+		`{"node":"http://relay.example"}`,
+	} {
+		if _, err := parseInternalEndpoints(raw); err == nil {
+			t.Fatalf("accepted invalid endpoint map %s", raw)
+		}
+	}
+}