@@ -998,5 +1003,6 @@
+
{% endblock %}
diff --git a/templates/pro/partials/modals/route-edit.njk b/templates/pro/partials/modals/route-edit.njk
index 5773aaab..027d1fc8 100644
--- a/templates/pro/partials/modals/route-edit.njk
+++ b/templates/pro/partials/modals/route-edit.njk
@@ -23,10 +23,16 @@
-
+
+ {{ t('routes.prefix_hint') }}
+
+
+
diff --git a/tests/api.test.js b/tests/api.test.js
index 50d860a1..beb8156c 100644
--- a/tests/api.test.js
+++ b/tests/api.test.js
@@ -4,6 +4,7 @@ const { describe, it, before, after } = require('node:test');
const assert = require('node:assert/strict');
const { execFileSync } = require('node:child_process');
const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
let agent, csrf;
let hasWg = false;
@@ -13,6 +14,7 @@ before(async () => {
const ctx = await setup();
agent = ctx.agent;
csrf = ctx.csrfToken;
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('example.com','verified')").run();
});
after(() => teardown());
diff --git a/tests/api_route_external.test.js b/tests/api_route_external.test.js
index ea82ec0e..cb64b037 100644
--- a/tests/api_route_external.test.js
+++ b/tests/api_route_external.test.js
@@ -12,6 +12,7 @@
const { test, beforeEach, afterEach } = require('node:test');
const assert = require('node:assert/strict');
const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
let agent, csrf;
@@ -19,6 +20,7 @@ beforeEach(async () => {
await setup();
agent = getAgent();
csrf = getCsrf();
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('example.com','verified')").run();
});
afterEach(teardown);
diff --git a/tests/api_route_external_block.test.js b/tests/api_route_external_block.test.js
index f757514e..e4857bbb 100644
--- a/tests/api_route_external_block.test.js
+++ b/tests/api_route_external_block.test.js
@@ -2,9 +2,10 @@
const { test, beforeEach, afterEach } = require('node:test');
const assert = require('node:assert/strict');
const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+const { getDb } = require('../src/db/connection');
let agent, csrf;
-beforeEach(async () => { await setup(); agent = getAgent(); csrf = getCsrf(); });
+beforeEach(async () => { await setup(); agent = getAgent(); csrf = getCsrf(); getDb().prepare("INSERT INTO domains (domain, status) VALUES ('example.com','verified')").run(); });
afterEach(teardown);
const MINIMAL = { domain: 'block-api.example.com', target_ip: '93.184.216.34', target_port: 80 };
diff --git a/tests/api_routes_registry.test.js b/tests/api_routes_registry.test.js
new file mode 100644
index 00000000..535de11d
--- /dev/null
+++ b/tests/api_routes_registry.test.js
@@ -0,0 +1,63 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+process.env.GC_SECRET = process.env.GC_SECRET || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown, getAgent, getCsrf } = require('./helpers/setup');
+
+let agent, csrf, getDb;
+beforeEach(async () => { await setup(); agent = getAgent(); csrf = getCsrf(); getDb = require('../src/db/connection').getDb; });
+afterEach(teardown);
+
+test('create with unverified public base → 400 field error', async () => {
+ const res = await agent.post('/api/v1/routes').set('X-CSRF-Token', csrf)
+ .send({ domain: 'nas.domaincaster.com', target_ip: '1.1.1.1', target_port: 80, route_type: 'http' });
+ assert.equal(res.status, 400);
+ assert.ok(res.body.fields && res.body.fields.domain);
+});
+
+test('create with verified public base → 201', async () => {
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('domaincaster.com','verified')").run();
+ const res = await agent.post('/api/v1/routes').set('X-CSRF-Token', csrf)
+ .send({ domain: 'nas.domaincaster.com', target_ip: '1.1.1.1', target_port: 80, route_type: 'http' });
+ assert.equal(res.status, 201);
+});
+
+test('create with non-public TLD (carve-out) → 201 without verify', async () => {
+ const res = await agent.post('/api/v1/routes').set('X-CSRF-Token', csrf)
+ .send({ domain: 'nas.gc.internal', target_ip: '1.1.1.1', target_port: 80, route_type: 'http' });
+ assert.equal(res.status, 201);
+});
+
+test('update non-domain field on a legacy unverified-base route → ok (grandfathering)', async () => {
+ // seed a legacy route directly (bypasses policy), unverified public base
+ getDb().prepare("INSERT INTO routes (domain, target_ip, target_port, route_type, enabled) VALUES ('legacy.example.com','10.0.0.3',80,'http',1)").run();
+ const id = getDb().prepare("SELECT id FROM routes WHERE domain='legacy.example.com'").get().id;
+ const res = await agent.put('/api/v1/routes/' + id).set('X-CSRF-Token', csrf).send({ target_port: 81 });
+ assert.equal(res.status, 200);
+});
+
+test('update changing domain to unverified public base → 400', async () => {
+ getDb().prepare("INSERT INTO routes (domain, target_ip, target_port, route_type, enabled) VALUES ('a.gc.internal','10.0.0.3',80,'http',1)").run();
+ const id = getDb().prepare("SELECT id FROM routes WHERE domain='a.gc.internal'").get().id;
+ const res = await agent.put('/api/v1/routes/' + id).set('X-CSRF-Token', csrf).send({ domain: 'b.unverified.com' });
+ assert.equal(res.status, 400);
+ assert.ok(res.body.fields.domain);
+});
+
+test('routes list flags public routes with unverified base', async () => {
+ getDb().prepare("INSERT INTO routes (domain, target_ip, target_port, route_type, enabled) VALUES ('x.unverified.com','10.0.0.4',80,'http',1)").run();
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('verified.com','verified')").run();
+ getDb().prepare("INSERT INTO routes (domain, target_ip, target_port, route_type, enabled) VALUES ('y.verified.com','10.0.0.5',80,'http',1)").run();
+ getDb().prepare("INSERT INTO routes (domain, target_ip, target_port, route_type, enabled) VALUES ('z.gc.internal','10.0.0.6',80,'http',1)").run();
+ const res = await agent.get('/api/v1/routes').expect(200);
+ const by = Object.fromEntries(res.body.routes.map(r => [r.domain, r]));
+ assert.equal(by['x.unverified.com'].baseUnverified, true);
+ assert.equal(by['y.verified.com'].baseUnverified, false);
+ assert.equal(by['z.gc.internal'].baseUnverified, false); // non-public → never flagged
+ // domainIsPublic is a first-class flag (drives Task 6 edit-modal path detection):
+ assert.equal(by['x.unverified.com'].domainIsPublic, true);
+ assert.equal(by['y.verified.com'].domainIsPublic, true);
+ assert.equal(by['z.gc.internal'].domainIsPublic, false);
+});
diff --git a/tests/route_domain_assemble.test.js b/tests/route_domain_assemble.test.js
new file mode 100644
index 00000000..d2ee173d
--- /dev/null
+++ b/tests/route_domain_assemble.test.js
@@ -0,0 +1,22 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const { assembleRouteDomain, isValidPrefix } = require('../public/js/routeDomain');
+
+test('assembleRouteDomain joins prefix + base; empty prefix = apex', () => {
+ assert.equal(assembleRouteDomain('nas', 'domaincaster.com'), 'nas.domaincaster.com');
+ assert.equal(assembleRouteDomain('', 'domaincaster.com'), 'domaincaster.com');
+ assert.equal(assembleRouteDomain(' NAS ', 'Domaincaster.com'), 'nas.domaincaster.com');
+ assert.equal(assembleRouteDomain('a.b', 'example.com'), 'a.b.example.com');
+ assert.equal(assembleRouteDomain('nas', ''), '');
+});
+
+test('isValidPrefix: empty ok; labels validated', () => {
+ assert.equal(isValidPrefix(''), true);
+ assert.equal(isValidPrefix('nas'), true);
+ assert.equal(isValidPrefix('a.b'), true);
+ assert.equal(isValidPrefix('bad_label'), false);
+ assert.equal(isValidPrefix('-bad'), false);
+});
diff --git a/tests/route_domain_policy.test.js b/tests/route_domain_policy.test.js
new file mode 100644
index 00000000..788c8096
--- /dev/null
+++ b/tests/route_domain_policy.test.js
@@ -0,0 +1,59 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const { setup, teardown } = require('./helpers/setup');
+
+let policy, getDb;
+beforeEach(async () => {
+ await setup();
+ // setup.js (module-level) resets GC_BASE_URL to 'http://localhost:3000'.
+ // Override AFTER setup() so managementHost() resolves to admin.example.com.
+ // Purge both config and the policy module from require.cache so the
+ // policy captures the fresh baseUrl when it first requires config.
+ process.env.GC_BASE_URL = 'https://admin.example.com';
+ delete require.cache[require.resolve('../config/default')];
+ delete require.cache[require.resolve('../src/services/routeDomainPolicy')];
+ policy = require('../src/services/routeDomainPolicy');
+ getDb = require('../src/db/connection').getDb;
+});
+afterEach(teardown);
+
+test('public TLD requires a verified base', () => {
+ assert.equal(policy.checkDomainPolicy('nas.domaincaster.com', {}).error, 'public_domain_use_verified');
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('domaincaster.com','verified')").run();
+ assert.equal(policy.checkDomainPolicy('nas.domaincaster.com', {}).error, null);
+});
+
+test('non-public TLD is carved out (no verify needed)', () => {
+ assert.equal(policy.checkDomainPolicy('nas.gc.internal', {}).error, null);
+ assert.equal(policy.checkDomainPolicy('printer.lan', {}).error, null);
+});
+
+test('unchanged domain is skipped (grandfathering)', () => {
+ // public, unverified, but unchanged → no error
+ assert.equal(policy.checkDomainPolicy('old.example.com', { currentDomain: 'old.example.com' }).error, null);
+});
+
+test('collision with management host is rejected (strict, public base seeded)', () => {
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('example.com','verified')").run();
+ // base example.com is verified → only the collision path can fail. Management host = admin.example.com.
+ assert.equal(policy.checkDomainPolicy('admin.example.com', { routeType: 'http' }).error, 'domain_collision');
+ // a different verified-base host does NOT collide:
+ assert.equal(policy.checkDomainPolicy('nas.example.com', { routeType: 'http' }).error, null);
+ // trailing dot / casing still collides (normalized):
+ assert.equal(policy.checkDomainPolicy('ADMIN.example.com.', { routeType: 'http' }).error, 'domain_collision');
+});
+
+test('collision with portal host is rejected when C is present', () => {
+ getDb().prepare("INSERT INTO domains (domain, status) VALUES ('example.com','verified')").run();
+ const settings = require('../src/services/settings');
+ // C: portal.base_domain + prefix → effectivePortalHost() = home.example.com.
+ // C/portalConfig IS present on this branch, so this must be deterministic —
+ // a failure to set the keys should surface, not be swallowed.
+ settings.set('portal.base_domain', 'example.com');
+ settings.set('portal.prefix', 'home');
+ const r = policy.checkDomainPolicy('home.example.com', { routeType: 'http' });
+ assert.equal(r.error, 'domain_collision');
+});
diff --git a/tests/routes_registry_ui.test.js b/tests/routes_registry_ui.test.js
new file mode 100644
index 00000000..cf9600f2
--- /dev/null
+++ b/tests/routes_registry_ui.test.js
@@ -0,0 +1,46 @@
+'use strict';
+const crypto = require('crypto');
+process.env.GC_ENCRYPTION_KEY = process.env.GC_ENCRYPTION_KEY || crypto.randomBytes(32).toString('hex');
+const { test, beforeEach, afterEach } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs'); const path = require('node:path');
+const supertest = require('supertest');
+const { setup, teardown, getAgent } = require('./helpers/setup');
+
+let app;
+beforeEach(async () => { await setup(); app = require('../src/app').createApp(); });
+afterEach(teardown);
+
+test('create wizard has prefix + base-domain dropdown + free-text carve-out (served, no raw keys)', async () => {
+ const res = await getAgent().get('/routes').expect(200);
+ assert.match(res.text, /create-route-prefix/);
+ assert.match(res.text, /create-route-base-domain/);
+ assert.match(res.text, /create-route-domain-freetext/);
+ // routes.other_domain and routes.no_verified_domains_hint are intentionally in GC.t (for JS);
+ // the following keys must NOT appear as unrendered template artefacts:
+ assert.doesNotMatch(res.text, /routes\.(prefix|prefix_hint|base_domain)\b/);
+ // prefix_hint must be server-rendered (Nunjucks), not leaked as a raw key
+ assert.match(res.text, /empty = directly on the domain|leer = direkt auf der Domain/);
+});
+
+test('all three themes carry the create-route registry ids', () => {
+ for (const theme of ['aurora', 'default', 'pro']) {
+ const html = fs.readFileSync(path.join(__dirname, '..', 'templates', theme, 'pages', 'routes.njk'), 'utf8');
+ ['create-route-prefix', 'create-route-base-domain', 'create-route-domain-freetext']
+ .forEach(id => assert.ok(html.includes(id), `${theme}: ${id}`));
+ }
+});
+
+test('edit modal carries registry ids in all three themes', () => {
+ for (const theme of ['aurora', 'default', 'pro']) {
+ const html = fs.readFileSync(path.join(__dirname, '..', 'templates', theme, 'partials', 'modals', 'route-edit.njk'), 'utf8');
+ ['edit-route-prefix', 'edit-route-base-domain', 'edit-route-domain-freetext']
+ .forEach(id => assert.ok(html.includes(id), `${theme}: ${id}`));
+ }
+});
+
+test('routes.js renders an unverified-base badge from baseUnverified', async () => {
+ const js = await supertest(app).get('/js/routes.js').expect(200);
+ assert.match(js.text, /baseUnverified/);
+ assert.match(js.text, /routes\.unverified_base_badge|unverified-base/);
+});