feat: add secure Pi-hole DNS management

internal/pihole/client_test.go

@@ -0,0 +1,109 @@
+package pihole
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+)
+
+func TestClientManagesLocalDNSHostsWithShortLivedSessions(t *testing.T) {
+	t.Parallel()
+	var mu sync.Mutex
+	hosts := []string{"192.168.1.10 nas.lan"}
+	logouts := 0
+	api := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/api/auth" && r.Method == http.MethodPost {
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"session":{"valid":true,"sid":"test-sid","validity":1800,"message":"ok","totp":false}}`))
+			return
+		}
+		if r.URL.Path == "/api/auth" && r.Method == http.MethodDelete {
+			if r.Header.Get("X-FTL-SID") != "test-sid" {
+				http.Error(w, "missing sid", http.StatusUnauthorized)
+				return
+			}
+			mu.Lock()
+			logouts++
+			mu.Unlock()
+			w.WriteHeader(http.StatusNoContent)
+			return
+		}
+		if r.Header.Get("X-FTL-SID") != "test-sid" {
+			http.Error(w, "missing sid", http.StatusUnauthorized)
+			return
+		}
+		mu.Lock()
+		defer mu.Unlock()
+		switch {
+		case r.URL.Path == "/api/config/dns/hosts" && r.Method == http.MethodGet:
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = w.Write([]byte(`{"config":{"dns":{"hosts":["` + strings.Join(hosts, `","`) + `"]}}}`))
+		case strings.HasPrefix(r.URL.Path, "/api/config/dns/hosts/") && r.Method == http.MethodPut:
+			hosts = append(hosts, strings.TrimPrefix(r.URL.Path, "/api/config/dns/hosts/"))
+			w.WriteHeader(http.StatusCreated)
+		case strings.HasPrefix(r.URL.Path, "/api/config/dns/hosts/") && r.Method == http.MethodDelete:
+			value := strings.TrimPrefix(r.URL.Path, "/api/config/dns/hosts/")
+			for index, host := range hosts {
+				if host == value {
+					hosts = append(hosts[:index], hosts[index+1:]...)
+					w.WriteHeader(http.StatusNoContent)
+					return
+				}
+			}
+			http.NotFound(w, r)
+		default:
+			http.Error(w, "unexpected request", http.StatusBadRequest)
+		}
+	}))
+	defer api.Close()
+
+	client, err := New(api.URL, false)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx := context.Background()
+	listed, err := client.ListHosts(ctx, "app-password")
+	if err != nil || len(listed) != 1 || listed[0] != "192.168.1.10 nas.lan" {
+		t.Fatalf("hosts not listed: %#v err=%v", listed, err)
+	}
+	if err := client.AddHost(ctx, "app-password", "192.168.1.20 printer.lan"); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.ReplaceHost(ctx, "app-password", "192.168.1.20 printer.lan", "192.168.1.21 printer.lan"); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.DeleteHost(ctx, "app-password", "192.168.1.21 printer.lan"); err != nil {
+		t.Fatal(err)
+	}
+	if err := client.DeleteHosts(ctx, "app-password", []string{"192.168.1.10 nas.lan", "192.168.1.99 already-gone.lan"}); err != nil {
+		t.Fatal(err)
+	}
+	mu.Lock()
+	defer mu.Unlock()
+	if logouts != 5 {
+		t.Fatalf("expected one logout per operation, got %d", logouts)
+	}
+	if len(hosts) != 0 {
+		t.Fatalf("batch deletion left hosts behind: %#v", hosts)
+	}
+}
+
+func TestNewValidatesAndNormalizesPiHoleURL(t *testing.T) {
+	t.Parallel()
+	client, err := New("https://pi.hole/", false)
+	if err != nil || client.BaseURL() != "https://pi.hole/api" {
+		t.Fatalf("unexpected normalized URL %q err=%v", client.BaseURL(), err)
+	}
+	client, err = New("http://pihole.local/custom", false)
+	if err != nil || client.BaseURL() != "http://pihole.local/custom/api" {
+		t.Fatalf("custom path not normalized: %q err=%v", client.BaseURL(), err)
+	}
+	for _, invalid := range []string{"pi.hole", "ftp://pi.hole", "https://user:pass@pi.hole", "https://pi.hole?sid=secret"} {
+		if _, err := New(invalid, false); err == nil {
+			t.Errorf("invalid URL accepted: %s", invalid)
+		}
+	}
+}