feat: establish NekoNest Cloud control and relay

relay/internal/forwarder/forwarder_test.go

@@ -0,0 +1,41 @@
+package forwarder
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+)
+
+func TestForwardAssertionBindsMethodPathAndTarget(t *testing.T) {
+	secret := []byte("0123456789abcdef0123456789abcdef")
+	now := time.Unix(1_786_536_000, 0)
+	forwarder, err := New(Config{
+		NodeID: "node_source", Secret: secret,
+		Endpoints: map[string]string{}, HTTPClient: http.DefaultClient,
+		WebSocketDialer: nil, Now: func() time.Time { return now },
+		ClientCertFile: "missing", ClientKeyFile: "missing", CAFile: "missing",
+	})
+	if err == nil {
+		// A nil WebSocket dialer intentionally requires real mTLS files.
+		t.Fatal("forwarder accepted a partial injected transport")
+	}
+	forwarder = &Forwarder{nodeID: "node_source", secret: secret, now: func() time.Time { return now }}
+	request := httptest.NewRequest(http.MethodPost, "https://relay.example/ws/daemon?generation=2", nil)
+	forwarder.sign(request.Header, request.Method, request.URL.RequestURI(), "node_target")
+	if err := VerifyIncoming(request, "node_target", secret, now); err != nil {
+		t.Fatal(err)
+	}
+	request.URL.Path = "/ws/phone"
+	if err := VerifyIncoming(request, "node_target", secret, now); err == nil {
+		t.Fatal("forward assertion survived path substitution")
+	}
+}
+
+func TestEndpointReferenceCannotSelectArbitraryURL(t *testing.T) {
+	forwarder := &Forwarder{endpoints: map[string]*url.URL{}}
+	if _, err := forwarder.endpoint("https://evil.example"); err == nil {
+		t.Fatal("unconfigured URL was accepted as an endpoint reference")
+	}
+}