chore: establish local platform baseline

internal/externalprobe/probe_test.go

@@ -0,0 +1,75 @@
+package externalprobe
+
+import (
+	"context"
+	"crypto/x509"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestJWKSRequiresSuccessfulDocumentWithKeys(t *testing.T) {
+	tests := []struct {
+		name    string
+		status  int
+		body    string
+		wantErr bool
+	}{
+		{name: "valid", status: http.StatusOK, body: `{"keys":[{"kty":"RSA","kid":"one"}]}`},
+		{name: "empty", status: http.StatusOK, body: `{"keys":[]}`, wantErr: true},
+		{name: "invalid", status: http.StatusOK, body: `{`, wantErr: true},
+		{name: "unavailable", status: http.StatusServiceUnavailable, body: `{}`, wantErr: true},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+				writer.WriteHeader(test.status)
+				_, _ = writer.Write([]byte(test.body))
+			}))
+			defer server.Close()
+			check, err := JWKS(server.URL, server.Client())
+			if err != nil {
+				t.Fatal(err)
+			}
+			err = check(context.Background())
+			if (err != nil) != test.wantErr {
+				t.Fatalf("check() error=%v, wantErr=%v", err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestTLSReachabilityValidatesCertificate(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {}))
+	defer server.Close()
+	roots := x509.NewCertPool()
+	roots.AddCert(server.Certificate())
+	check, err := TLSReachability(server.URL, roots)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	if err = check(ctx); err != nil {
+		t.Fatalf("TLS check failed: %v", err)
+	}
+
+	untrusted, err := TLSReachability(server.URL, x509.NewCertPool())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = untrusted(context.Background()); err == nil || !strings.Contains(err.Error(), "TLS") {
+		t.Fatalf("untrusted TLS check error=%v", err)
+	}
+}
+
+func TestRunnerRejectsInvalidDefinitions(t *testing.T) {
+	if _, err := NewRunner(0, time.Second, nil, nil); err == nil {
+		t.Fatal("zero interval should be rejected")
+	}
+	if _, err := NewRunner(time.Second, time.Second, map[string]CheckFunc{"": func(context.Context) error { return nil }}, nil); err == nil {
+		t.Fatal("empty probe name should be rejected")
+	}
+}