feat(hololake): render bounded release front door config

product-source/hololake-native-desktop/scripts/release-front-door.test.mjs

@@ -0,0 +1,22 @@
+import assert from 'node:assert/strict'
+import test from 'node:test'
+
+import { renderFrontDoorSnippet } from '../server/release-broadcast/render-front-door.mjs'
+
+test('front-door renderer refuses an unassigned or privileged loopback port', () => {
+  assert.throws(() => renderFrontDoorSnippet(null), /PORT_REQUIRED/)
+  assert.throws(() => renderFrontDoorSnippet(443), /PORT_REQUIRED|PORT_INVALID/)
+  assert.throws(() => renderFrontDoorSnippet('not-a-port'), /PORT_REQUIRED/)
+})
+
+test('rendered proxy preserves the public path and strips request authority', () => {
+  const snippet = renderFrontDoorSnippet(23940)
+  assert.match(snippet, /location \^~ \/hololake\/releases\//)
+  assert.match(snippet, /proxy_pass http:\/\/127\.0\.0\.1:23940;/)
+  assert.doesNotMatch(snippet, /proxy_pass http:\/\/127\.0\.0\.1:23940\//)
+  assert.match(snippet, /limit_except GET HEAD \{ deny all; \}/)
+  assert.match(snippet, /proxy_pass_request_body off;/)
+  assert.match(snippet, /proxy_set_header Authorization "";/)
+  assert.match(snippet, /proxy_set_header Cookie "";/)
+  assert.match(snippet, /proxy_set_header X-Forwarded-For "";/)
+})