feat(hololake): render bounded release front door config

product-source/hololake-native-desktop/scripts/foundation.test.mjs

@@ -63,6 +63,7 @@ test('release activation remains explicitly human controlled', () => {
   assert.equal(publicRoute.proxyRequestUriPolicy, 'PRESERVE_FULL_PUBLIC_PATH')
   assert.equal(publicRoute.frontDoorLoopbackPort, null)
   assert.equal(publicRoute.deployed, false)
+  assert.equal(foundation.release_front_door_bounded_config_renderer_implemented, true)
   assert.equal(foundation.release_pipeline_automatic_upload_allowed, false)
   assert.equal(
     foundation.release_production_activation_state,

product-source/hololake-native-desktop/scripts/release-front-door.test.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { renderFrontDoorSnippet } from '../server/release-broadcast/render-front-door.mjs'
+
+test('front-door renderer refuses an unassigned or privileged loopback port', () => {
+  assert.throws(() => renderFrontDoorSnippet(null), /PORT_REQUIRED/)
+  assert.throws(() => renderFrontDoorSnippet(443), /PORT_REQUIRED|PORT_INVALID/)
+  assert.throws(() => renderFrontDoorSnippet('not-a-port'), /PORT_REQUIRED/)
+})
+
+test('rendered proxy preserves the public path and strips request authority', () => {
+  const snippet = renderFrontDoorSnippet(23940)
+  assert.match(snippet, /location \^~ \/hololake\/releases\//)
+  assert.match(snippet, /proxy_pass http:\/\/127\.0\.0\.1:23940;/)
+  assert.doesNotMatch(snippet, /proxy_pass http:\/\/127\.0\.0\.1:23940\//)
+  assert.match(snippet, /limit_except GET HEAD \{ deny all; \}/)
+  assert.match(snippet, /proxy_pass_request_body off;/)
+  assert.match(snippet, /proxy_set_header Authorization "";/)
+  assert.match(snippet, /proxy_set_header Cookie "";/)
+  assert.match(snippet, /proxy_set_header X-Forwarded-For "";/)
+})