Expand test coverage across server, agent, and web; fix bugs found during audit.

Adds hundreds of unit/integration/e2e tests, fixes WS bcrypt auth, config merge, fleet analytics, agent schedule/log tail, and documents stale PROBLEMS items. Updates PROBLEMS.md, README, and test scripts; ignores local spread-kits and coverage dirs.

agent/deploy/natpunch_test.go

@@ -0,0 +1,164 @@
+package deploy
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestXMLEscape(t *testing.T) {
+	got := xmlEscape(`a&b<c>d`)
+	want := "a&amp;b&lt;c&gt;d"
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+}
+
+func TestIntSliceStr(t *testing.T) {
+	got := intSliceStr([]int{22, 445, 5985})
+	want := []string{"22", "445", "5985"}
+	if len(got) != len(want) {
+		t.Fatalf("len %d != %d", len(got), len(want))
+	}
+	for i := range want {
+		if got[i] != want[i] {
+			t.Fatalf("[%d] got %q want %q", i, got[i], want[i])
+		}
+	}
+}
+
+func TestGetSubnet(t *testing.T) {
+	if got := getSubnet("192.168.1.42"); got != "192.168.1" {
+		t.Fatalf("got %q", got)
+	}
+	if getSubnet("bad") != "" {
+		t.Fatal("invalid ip should return empty")
+	}
+	if getSubnet("10.0.0.1") != "10.0.0" {
+		t.Fatalf("got %q", getSubnet("10.0.0.1"))
+	}
+}
+
+func TestCloseUPnPInvalidPort(t *testing.T) {
+	_, err := CloseUPnP(0)
+	if err == nil || !strings.Contains(err.Error(), "external port required") {
+		t.Fatalf("expected port error, got %v", err)
+	}
+}
+
+func TestResolveWANControlURL(t *testing.T) {
+	const igdXML = `<?xml version="1.0"?>
+<root>
+  <device>
+    <serviceList>
+      <service>
+        <serviceType>urn:schemas-upnp-org:service:WANIPConnection:1</serviceType>
+        <controlURL>/ctl/IPConn</controlURL>
+      </service>
+    </serviceList>
+  </device>
+</root>`
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, igdXML)
+	}))
+	defer srv.Close()
+
+	got, err := resolveWANControlURL(srv.URL + "/igd.xml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := srv.URL + "/ctl/IPConn"
+	if got != want {
+		t.Fatalf("got %q want %q", got, want)
+	}
+}
+
+func TestResolveWANControlURLAbsolute(t *testing.T) {
+	const igdXML = `<?xml version="1.0"?>
+<root>
+  <service>
+    <serviceType>urn:schemas-upnp-org:service:WANPPPConnection:1</serviceType>
+    <controlURL>http://192.168.0.1:49152/ctl/IPConn</controlURL>
+  </service>
+</root>`
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, igdXML)
+	}))
+	defer srv.Close()
+
+	got, err := resolveWANControlURL(srv.URL + "/desc.xml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != "http://192.168.0.1:49152/ctl/IPConn" {
+		t.Fatalf("got %q", got)
+	}
+}
+
+func TestResolveWANControlURLMissingService(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `<root><service><controlURL>/x</controlURL></service></root>`)
+	}))
+	defer srv.Close()
+
+	_, err := resolveWANControlURL(srv.URL)
+	if err == nil || !strings.Contains(err.Error(), "WANIPConnection service not found") {
+		t.Fatalf("expected service error, got %v", err)
+	}
+}
+
+func TestResolveWANControlURLMissingControlURL(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `<root><serviceType>urn:schemas-upnp-org:service:WANIPConnection:1</serviceType></root>`)
+	}))
+	defer srv.Close()
+
+	_, err := resolveWANControlURL(srv.URL)
+	if err == nil || !strings.Contains(err.Error(), "controlURL not found") {
+		t.Fatalf("expected controlURL error, got %v", err)
+	}
+}
+
+func TestUpnpGetExternalIP(t *testing.T) {
+	const soapResp = `<?xml version="1.0"?>
+<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/">
+  <s:Body>
+    <u:GetExternalIPAddressResponse xmlns:u="urn:schemas-upnp-org:service:WANIPConnection:1">
+      <NewExternalIPAddress>203.0.113.10</NewExternalIPAddress>
+    </u:GetExternalIPAddressResponse>
+  </s:Body>
+</s:Envelope>`
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			http.Error(w, "method", http.StatusMethodNotAllowed)
+			return
+		}
+		fmt.Fprint(w, soapResp)
+	}))
+	defer srv.Close()
+
+	ip, err := upnpGetExternalIP(srv.URL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if ip != "203.0.113.10" {
+		t.Fatalf("got %q", ip)
+	}
+}
+
+func TestUpnpSOAPErrorResponse(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `<errorCode>718</errorCode>`)
+	}))
+	defer srv.Close()
+
+	_, err := upnpSOAP(srv.URL, "AddPortMapping", "<body/>")
+	if err == nil || !strings.Contains(err.Error(), "AddPortMapping failed") {
+		t.Fatalf("expected SOAP error, got %v", err)
+	}
+}