fix(web,agent): P1 正确性与鉴权加固，P2 抽 fsutil 并补测试（v1.2.8）

internal/agent/route_test.go

@@ -0,0 +1,65 @@
+package agent
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestValidateRoute(t *testing.T) {
+	cases := []struct {
+		name string
+		req  routeRequest
+		ok   bool
+	}{
+		{"正常", routeRequest{Domain: "a.example.com", Upstream: "127.0.0.1:8080"}, true},
+		{"非法域名", routeRequest{Domain: "bad domain", Upstream: "127.0.0.1:8080"}, false},
+		{"空上游", routeRequest{Domain: "a.example.com"}, false},
+		{"上游带分号", routeRequest{Domain: "a.example.com", Upstream: "127.0.0.1:80; rm -rf /"}, false},
+		{"相对证书目录", routeRequest{Domain: "a.example.com", Upstream: "127.0.0.1:80", TLS: true, CertDir: "certs"}, false},
+	}
+	for _, c := range cases {
+		err := validateRoute(c.req)
+		if c.ok && err != nil {
+			t.Errorf("%s：期望通过，实际 %v", c.name, err)
+		}
+		if !c.ok && err == nil {
+			t.Errorf("%s：期望报错", c.name)
+		}
+	}
+}
+
+// TestNginxRouteRendersUpstream：vhost 模板的关键行（标记、server_name、proxy_pass）。
+// 不构造 Basic Auth 场景——那条路径会往 /var/lib/fonu-agent 写 htpasswd，不适合在单测里触发。
+func TestNginxRouteRendersUpstream(t *testing.T) {
+	out := nginxRoute(routeRequest{Domain: "a.example.com", Upstream: "127.0.0.1:8080"}, "")
+	if !strings.HasPrefix(out, "# Managed by fonu-agent.") {
+		t.Errorf("缺少托管标记，其它工具无法识别该文件归属：\n%s", out)
+	}
+	if !strings.Contains(out, "server_name a.example.com;") {
+		t.Errorf("缺少 server_name：\n%s", out)
+	}
+	if !strings.Contains(out, "proxy_pass http://127.0.0.1:8080;") {
+		t.Errorf("缺少 proxy_pass 回源：\n%s", out)
+	}
+	if strings.Contains(out, "listen 443") {
+		t.Errorf("未启用 TLS 时不应监听 443：\n%s", out)
+	}
+}
+
+// TestFileSHA256 覆盖 frps 安装包的校验路径。
+func TestFileSHA256(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "payload.txt")
+	if err := os.WriteFile(path, []byte("hello"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	got, err := fileSHA256(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	const want = "2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824"
+	if got != want {
+		t.Fatalf("sha256 不符：got %s", got)
+	}
+}