Add projects

backend/internal/config/codex_live_test.go

@@ -0,0 +1,119 @@
+package config
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"gopkg.in/yaml.v3"
+)
+
+func TestCodexLiveMediaRelayConfigParsesAndValidates(t *testing.T) {
+	var cfg Config
+	raw := []byte(`codex:
+  live-media-relay:
+    enabled: true
+    max-sessions: 64
+    disable-private-remote-ips: true
+    public-ip: "203.0.113.10"
+    udp-port-min: 40000
+    udp-port-max: 40150
+    ice-servers:
+      - urls: ["stun:stun.example.com:3478"]
+      - urls: ["turn:turn.example.com:3478?transport=udp"]
+        username: "relay-user"
+        credential: "relay-secret"
+`)
+	if errUnmarshal := yaml.Unmarshal(raw, &cfg); errUnmarshal != nil {
+		t.Fatalf("unmarshal Codex Live media relay config: %v", errUnmarshal)
+	}
+	relay := cfg.Codex.LiveMediaRelay
+	if !relay.Enabled || relay.MaxSessions != 64 || !relay.DisablePrivateRemoteIPs || relay.PublicIP != "203.0.113.10" {
+		t.Fatalf("parsed media relay = %#v", relay)
+	}
+	if relay.UDPPortMin != 40000 || relay.UDPPortMax != 40150 {
+		t.Fatalf("parsed UDP range = %d-%d", relay.UDPPortMin, relay.UDPPortMax)
+	}
+	if len(relay.ICEServers) != 2 || relay.ICEServers[1].Credential != "relay-secret" {
+		t.Fatalf("parsed ICE servers = %#v", relay.ICEServers)
+	}
+	if errValidate := relay.Validate(); errValidate != nil {
+		t.Fatalf("Validate() error = %v", errValidate)
+	}
+	encoded, errMarshal := json.Marshal(relay)
+	if errMarshal != nil {
+		t.Fatalf("marshal media relay config: %v", errMarshal)
+	}
+	for _, sensitive := range []string{"relay-secret", "credential", "relay-user", "username"} {
+		if strings.Contains(string(encoded), sensitive) {
+			t.Fatalf("JSON media relay config leaked TURN field %q: %s", sensitive, encoded)
+		}
+	}
+}
+
+func TestCodexLiveMediaRelayConfigMigratesLegacyPrivateIPSetting(t *testing.T) {
+	for name, raw := range map[string]string{
+		"legacy allow true":  "allow-private-remote-ips: true\n",
+		"legacy allow false": "allow-private-remote-ips: false\n",
+		"new default":        "enabled: true\n",
+	} {
+		t.Run(name, func(t *testing.T) {
+			var relay CodexLiveMediaRelayConfig
+			if errUnmarshal := yaml.Unmarshal([]byte(raw), &relay); errUnmarshal != nil {
+				t.Fatalf("unmarshal media relay config: %v", errUnmarshal)
+			}
+			wantDisabled := name == "legacy allow false"
+			if relay.DisablePrivateRemoteIPs != wantDisabled {
+				t.Fatalf("disable-private-remote-ips = %t, want %t", relay.DisablePrivateRemoteIPs, wantDisabled)
+			}
+		})
+	}
+
+	var relay CodexLiveMediaRelayConfig
+	errUnmarshal := yaml.Unmarshal([]byte("allow-private-remote-ips: true\ndisable-private-remote-ips: false\n"), &relay)
+	if errUnmarshal == nil {
+		t.Fatal("accepted conflicting private IP settings")
+	}
+}
+
+func TestCodexLiveMediaRelayConfigRejectsInvalidValues(t *testing.T) {
+	for name, relay := range map[string]CodexLiveMediaRelayConfig{
+		"negative session limit": {
+			Enabled:     true,
+			MaxSessions: -1,
+		},
+		"invalid public IP": {
+			Enabled:  true,
+			PublicIP: "not-an-ip",
+		},
+		"partial UDP range": {
+			Enabled:    true,
+			UDPPortMin: 40000,
+		},
+		"reversed UDP range": {
+			Enabled:    true,
+			UDPPortMin: 40100,
+			UDPPortMax: 40000,
+		},
+		"undersized UDP range": {
+			Enabled:     true,
+			MaxSessions: 2,
+			UDPPortMin:  40000,
+			UDPPortMax:  40002,
+		},
+		"missing ICE URLs": {
+			Enabled:    true,
+			ICEServers: []CodexLiveICEServer{{Username: "user"}},
+		},
+		"unsupported ICE URL": {
+			Enabled:    true,
+			ICEServers: []CodexLiveICEServer{{URLs: []string{"https://example.com"}}},
+		},
+	} {
+		t.Run(name, func(t *testing.T) {
+			if errValidate := relay.Validate(); errValidate == nil {
+				t.Fatal("Validate() accepted invalid media relay config")
+			}
+		})
+	}
+}