feat: add declarative sing-box egress control plane

tests/test_doctor.py

@@ -0,0 +1,63 @@
+from __future__ import annotations
+
+import json
+import subprocess
+import tempfile
+import unittest
+from dataclasses import replace
+from pathlib import Path
+
+from vpn_egressctl.doctor import Doctor
+from vpn_egressctl.renderer_1_13_19 import render_bytes
+from vpn_egressctl.uri import parse_hysteria2_uri
+
+from tests.helpers import FakeRunner, make_policy
+
+
+class DoctorTests(unittest.TestCase):
+    def prepare(self, directory: str, uri: str):
+        root = Path(directory)
+        policy = make_policy(root)
+        endpoint = parse_hysteria2_uri(uri)
+        Path(policy.runtime.uri_path).parent.mkdir(parents=True)
+        Path(policy.runtime.uri_path).write_text(uri + "\n", encoding="utf-8")
+        Path(policy.sing_box.config_path).write_bytes(render_bytes(policy, endpoint))
+        return policy
+
+    def test_endpoint_exclusion_is_an_error(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            policy = self.prepare(directory, "hy2://auth@example.com")
+            policy = replace(
+                policy,
+                network=replace(
+                    policy.network,
+                    route_exclude_address=policy.network.route_exclude_address + ("8.8.8.8/32",),
+                ),
+            )
+            doctor = Doctor(
+                policy,
+                runner=FakeRunner(),
+                resolver=lambda *args: [(None, None, None, None, ("8.8.8.8", 443))],
+            )
+            checks = doctor.run()
+        selected = [check for check in checks if check.name == "endpoint-exclusion"]
+        self.assertEqual(selected[0].level, "ERROR")
+
+    def test_insecure_tls_is_reported_without_secret(self) -> None:
+        secret = "NEVER-LOG-ME"
+        with tempfile.TemporaryDirectory() as directory:
+            policy = self.prepare(directory, f"hy2://{secret}@example.com?insecure=1")
+            doctor = Doctor(
+                policy,
+                runner=FakeRunner(),
+                resolver=lambda *args: [(None, None, None, None, ("8.8.4.4", 443))],
+            )
+            checks = doctor.run()
+        output = json.dumps([check.message for check in checks])
+        self.assertNotIn(secret, output)
+        selected = [check for check in checks if check.name == "tls-insecure"]
+        self.assertEqual(selected[0].level, "WARN")
+
+
+if __name__ == "__main__":
+    unittest.main()