From 96409c3b58e73805f381e2e8d44a170f9e11ddbf Mon Sep 17 00:00:00 2001
From: xuans <likb_blue@163.com>
Date: Sat, 3 Oct 2026 12:32:19 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=E5=85=85=E7=AE=A1=E7=90=86=E5=85=A5?=
 =?UTF-8?q?=E5=8F=A3=E9=85=8D=E7=BD=AE=E5=85=9C=E5=BA=95=E6=B5=8B=E8=AF=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../deployment/service_management_test.go     | 74 +++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 backend/internal/deployment/service_management_test.go

diff --git a/backend/internal/deployment/service_management_test.go b/backend/internal/deployment/service_management_test.go
new file mode 100644
index 0000000..1fd5e94
--- /dev/null
+++ b/backend/internal/deployment/service_management_test.go
@@ -0,0 +1,74 @@
+package deployment
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+func TestDeployRejectsManagementDomainFromNginxConfigWhenPolicyFileIsMissing(t *testing.T) {
+	client := newMemoryClient()
+	server := testServer("nginx-management-server")
+	client.runResults = []CommandResult{
+		{ExitCode: 1},
+		{ExitCode: 0, Output: []byte(`
+http {
+	server {
+		listen 443 ssl;
+		server_name odacm.cn;
+		location / {
+			proxy_pass https://127.0.0.1:8443;
+			proxy_ssl_name odacm.cn;
+			proxy_ssl_verify on;
+		}
+	}
+}
+`)},
+	}
+	service := NewService(memoryFactory{clients: map[string]*memoryClient{server.ID: client}})
+
+	report := service.Deploy(context.Background(), []Target{{Server: server, DomainName: "odacm.cn"}}, testArtifact(t))
+	if report.Status != "failed" || report.Failed != 1 {
+		t.Fatalf("missing policy must reject management domain deployment: %+v", report)
+	}
+	if report.Results[0].FailureCode != FailureManagementConflict {
+		t.Fatalf("unexpected failure code for missing policy: %+v", report.Results[0])
+	}
+	if len(client.commands) != 2 || client.commands[0][0] != "test" || client.commands[1][0] != "nginx" {
+		t.Fatalf("unexpected missing-policy probe commands: %v", client.commands)
+	}
+}
+
+func TestNginxServerBlockIsManagedRequiresAllProtectionDirectives(t *testing.T) {
+	base := `server {
+	server_name odacm.cn;
+	proxy_pass https://127.0.0.1:8443;
+	proxy_ssl_name odacm.cn;
+	proxy_ssl_verify on;
+}`
+	cases := map[string]struct {
+		config string
+		want   bool
+	}{
+		"complete": {config: base, want: true},
+		"missing_verify": {
+			config: strings.Replace(base, "proxy_ssl_verify on;", "", 1),
+		},
+		"wrong_upstream": {
+			config: strings.Replace(base, "https://127.0.0.1:8443", "https://127.0.0.1:9443", 1),
+		},
+		"wrong_sni": {
+			config: strings.Replace(base, "proxy_ssl_name odacm.cn", "proxy_ssl_name other.example", 1),
+		},
+		"wrong_server_name": {
+			config: strings.Replace(base, "server_name odacm.cn", "server_name other.example", 1),
+		},
+	}
+	for name, testCase := range cases {
+		t.Run(name, func(t *testing.T) {
+			if got := nginxContainsManagedServer(testCase.config, "odacm.cn"); got != testCase.want {
+				t.Fatalf("managed server detection mismatch: got=%t want=%t", got, testCase.want)
+			}
+		})
+	}
+}