release: NX9-WG v1.0.0

crates/nx9-wg-api/tests/test_client_profiles.rs

@@ -79,6 +79,10 @@ async fn setup_test_app() -> (axum::Router, AppState, String, Interface, Peer) {
         updated_at: now,
     };
     store.create_peer(&peer).await.unwrap();
+    store
+        .set_setting("server_endpoint", "vpn.example.com", false)
+        .await
+        .unwrap();
 
     let state = AppState::new(store);
     let app = nx9_wg_api::routes::build_api_router(state.clone());
@@ -88,7 +92,7 @@ async fn setup_test_app() -> (axum::Router, AppState, String, Interface, Peer) {
 
 #[tokio::test]
 async fn test_client_profiles_endpoints() {
-    let (app, _state, session_id, _iface, peer) = setup_test_app().await;
+    let (app, state, session_id, interface, peer) = setup_test_app().await;
 
     // 1. List client profiles
     let req = Request::builder()
@@ -181,4 +185,67 @@ async fn test_client_profiles_endpoints() {
         .unwrap();
     let qr_json: serde_json::Value = serde_json::from_slice(&body).unwrap();
     assert!(qr_json["svg"].as_str().unwrap().contains("<svg"));
+
+    // 7. Delete server_endpoint setting and verify config export fails with actionable error
+    state.store.delete_setting("server_endpoint").await.unwrap();
+    let req = Request::builder()
+        .uri(format!("/api/v1/peers/{}/config", peer.id))
+        .header("Cookie", format!("nx9_session={session_id}"))
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let err_json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(
+        err_json["error"]["message"]
+            .as_str()
+            .unwrap()
+            .contains("No reachable WireGuard server endpoint is configured")
+    );
+
+    // 8. With query server_endpoint parameter, export succeeds even without DB setting
+    let req = Request::builder()
+        .uri(format!(
+            "/api/v1/peers/{}/config?server_endpoint=custom.vpn.io:51820",
+            peer.id
+        ))
+        .header("Cookie", format!("nx9_session={session_id}"))
+        .body(Body::empty())
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::OK);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let conf_str = String::from_utf8(body.to_vec()).unwrap();
+    assert!(conf_str.contains("Endpoint = custom.vpn.io:51820"));
+
+    // 9. Overlapping server-side AllowedIPs rejection
+    let overlap_peer = serde_json::json!({
+        "name": "overlapping-peer",
+        "peer_type": "road_warrior",
+        "address_v4": "10.0.0.2/32"
+    });
+    let req = Request::builder()
+        .method("POST")
+        .uri(format!("/api/v1/interfaces/{}/peers", interface.id))
+        .header("Cookie", format!("nx9_session={session_id}"))
+        .header("Content-Type", "application/json")
+        .body(Body::from(serde_json::to_vec(&overlap_peer).unwrap()))
+        .unwrap();
+    let res = app.clone().oneshot(req).await.unwrap();
+    assert_eq!(res.status(), StatusCode::UNPROCESSABLE_ENTITY);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let err_json: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(
+        err_json["error"]["message"]
+            .as_str()
+            .unwrap()
+            .contains("overlaps with active peer")
+    );
 }