refactor(nginx): 抽取共享 Nginx 模板包并发布 v1.5.1

2026-09-28 15:37:14 +08:00
parent faf43293e5
commit 1ada58af02
17 changed files with 437 additions and 130 deletions
@@ -0,0 +1,104 @@
+package nginxtmpl
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSSLDirectives(t *testing.T) {
+	base := SSLDirectives(TLSConfig{CertPath: "/certs/fullchain.pem", KeyPath: "/certs/privkey.pem"})
+	for _, want := range []string{
+		"ssl_certificate /certs/fullchain.pem;",
+		"ssl_certificate_key /certs/privkey.pem;",
+		"ssl_protocols TLSv1.2 TLSv1.3;",
+	} {
+		if !strings.Contains(base, want) {
+			t.Fatalf("默认 TLS 缺少 %q：%s", want, base)
+		}
+	}
+	only13 := SSLDirectives(TLSConfig{CertPath: "/c", KeyPath: "/k", TLS13Only: true})
+	if !strings.Contains(only13, "ssl_protocols TLSv1.3;") || strings.Contains(only13, "TLSv1.2") {
+		t.Fatalf("TLS 1.3 only 输出不正确：%s", only13)
+	}
+}
+
+func TestServerSecurityHeaders(t *testing.T) {
+	if got := ServerSecurityHeaders(SecurityHeaders{Enabled: true, HTTPS: false}); got != "" {
+		t.Fatalf("HTTP 不应输出 HSTS：%s", got)
+	}
+	if got := ServerSecurityHeaders(SecurityHeaders{Enabled: false, HTTPS: true}); got != "" {
+		t.Fatalf("关闭安全头时不应输出：%s", got)
+	}
+	got := ServerSecurityHeaders(SecurityHeaders{Enabled: true, HTTPS: true})
+	for _, want := range []string{
+		`Strict-Transport-Security "max-age=31536000; includeSubDomains"`,
+		`X-Content-Type-Options "nosniff"`,
+		`X-Frame-Options "SAMEORIGIN"`,
+		`Referrer-Policy "strict-origin-when-cross-origin"`,
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("安全头缺少 %q：%s", want, got)
+		}
+	}
+}
+
+func TestAccessDirectives(t *testing.T) {
+	got := AccessDirectives(AccessControl{
+		Deny:      []string{"8.8.8.8", " "},
+		ChinaDeny: "        if ($is_china = 0) { return 403; }\n",
+		Allow:     []string{"192.168.1.0/24"},
+	}, "        ")
+	want := "        deny 8.8.8.8;\n        if ($is_china = 0) { return 403; }\n        allow 192.168.1.0/24;\n        deny all;\n"
+	if got != want {
+		t.Fatalf("AccessDirectives() = %q, 期望 %q", got, want)
+	}
+	if got := AccessDirectives(AccessControl{}, "        "); got != "" {
+		t.Fatalf("空参数不应输出指令：%q", got)
+	}
+}
+
+func TestLimitDirectives(t *testing.T) {
+	got := LimitDirectives(LimitConfig{Zone: "fonu_rule_7", Rate: 10, Burst: 20, Conn: 30}, "        ")
+	for _, want := range []string{
+		"limit_conn fonu_rule_7_conn 30;",
+		"limit_req zone=fonu_rule_7_req burst=20 nodelay;",
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("限流指令缺少 %q：%s", want, got)
+		}
+	}
+	noBurst := LimitDirectives(LimitConfig{Zone: "z", Rate: 5}, "    ")
+	if !strings.Contains(noBurst, "limit_req zone=z_req nodelay;") {
+		t.Fatalf("无 burst 时输出不正确：%s", noBurst)
+	}
+}
+
+func TestZoneDirectives(t *testing.T) {
+	if got := RateLimitZone("fonu_app_req", 10); got != "limit_req_zone $binary_remote_addr zone=fonu_app_req:10m rate=10r/s;\n" {
+		t.Fatalf("RateLimitZone() = %q", got)
+	}
+	if got := ConnLimitZone("fonu_app_conn"); got != "limit_conn_zone $binary_remote_addr zone=fonu_app_conn:10m;\n" {
+		t.Fatalf("ConnLimitZone() = %q", got)
+	}
+	if got := RateLimitZone("", 10); got != "" {
+		t.Fatalf("空 zone 不应输出：%q", got)
+	}
+}
+
+func TestZoneName(t *testing.T) {
+	if got := ZoneName("fonu", "App.Example.com"); got != "fonu_app_example_com" {
+		t.Fatalf("ZoneName() = %q, 期望 fonu_app_example_com", got)
+	}
+}
+
+func TestUpgradeHeaders(t *testing.T) {
+	got := UpgradeHeaders("        ", "$connection_upgrade")
+	for _, want := range []string{
+		"proxy_set_header Upgrade $http_upgrade;",
+		"proxy_set_header Connection $connection_upgrade;",
+	} {
+		if !strings.Contains(got, want) {
+			t.Fatalf("WebSocket 头缺少 %q：%s", want, got)
+		}
+	}
+}