feat: shared tls cert, validation fixes

3 files changed, 5 insertions, 38 deletions

diff --git a/internal/admin/api_map.go b/internal/admin/api_map.go
index 231f52b..bd71f78 100644
--- a/internal/admin/api_map.go
+++ b/internal/admin/api_map.go
@@ -61,7 +61,7 @@ func (s *AdminServer) handleMap(w http.ResponseWriter, r *http.Request) {
 		}
 		return room, true
 	}, nil, nil, func(gc world.GridConflict) {
-		if gc.Kind == "overlap" {
+		if gc.Kind == world.GridConflictOverlap {
 			log.Printf("map: grid overlap: room %d wants cell %v already held by %d (via %d->%s)",
 				gc.Target, gc.Want, gc.Occupier, gc.From, gc.Dir)
 		}
diff --git a/internal/admin/api_room_insert_remove.go b/internal/admin/api_room_insert_remove.go
index 36688dc..bbb4d7e 100644
--- a/internal/admin/api_room_insert_remove.go
+++ b/internal/admin/api_room_insert_remove.go
@@ -401,10 +401,10 @@ func (s *AdminServer) formatGridConflicts(cs []world.GridConflict, mode string)
 	var parts []string
 	for _, c := range cs {
 		switch c.Kind {
-		case "twist":
+		case world.GridConflictTwist:
 			r, _ := s.world.LoadRoom(c.Target)
 			parts = append(parts, fmt.Sprintf("room %s would have an ambiguous grid position after %s", s.roomLabel(r, c.Target), verb))
-		case "overlap":
+		case world.GridConflictOverlap:
 			tgt, _ := s.world.LoadRoom(c.Target)
 			occ, _ := s.world.LoadRoom(c.Occupier)
 			parts = append(parts, fmt.Sprintf("%s would cause a grid collision: room %s cannot be placed because room %s is already there", verb, s.roomLabel(tgt, c.Target), s.roomLabel(occ, c.Occupier)))
diff --git a/internal/admin/server.go b/internal/admin/server.go
index 800cfa1..9819924 100644
--- a/internal/admin/server.go
+++ b/internal/admin/server.go
@@ -7,11 +7,8 @@ import (
 	"bytes"
 	"crypto/hmac"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/tls"
-	"crypto/x509"
-	"crypto/x509/pkix"
 	"embed"
 	"encoding/hex"
 	"encoding/json"
@@ -21,7 +18,6 @@ import (
 	"io"
 	"io/fs"
 	"log"
-	"math/big"
 	"net"
 	"net/http"
 	"os"
@@ -36,6 +32,7 @@ import (
 	"thehouseoficarus/internal/item"
 	"thehouseoficarus/internal/object"
 	"thehouseoficarus/internal/player"
+	"thehouseoficarus/internal/tlscert"
 	"thehouseoficarus/internal/world"
 )
 
@@ -832,37 +829,7 @@ func loadOrGenerateCert(cfg *config.Config) (tls.Certificate, error) {
 }
 
 func generateSelfSignedCert() (tls.Certificate, error) {
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("rsa key generation: %w", err)
-	}
-	serial, err := rand.Int(rand.Reader, new(big.Int).Lsh(big.NewInt(1), 128))
-	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("serial number: %w", err)
-	}
-	now := time.Now()
-	tmpl := &x509.Certificate{
-		SerialNumber: serial,
-		Subject: pkix.Name{
-			CommonName: "THOI Admin Self-Signed Certificate",
-		},
-		NotBefore:             now.Add(-1 * time.Hour),
-		NotAfter:              now.Add(365 * 24 * time.Hour),
-		KeyUsage:              x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
-		ExtKeyUsage:           []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
-		BasicConstraintsValid: true,
-		IsCA:                  true,
-		DNSNames:              []string{"localhost"},
-		IPAddresses:           []net.IP{net.ParseIP("127.0.0.1"), net.ParseIP("::1")},
-	}
-	certDER, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
-	if err != nil {
-		return tls.Certificate{}, fmt.Errorf("x509 creation: %w", err)
-	}
-	return tls.Certificate{
-		Certificate: [][]byte{certDER},
-		PrivateKey:  key,
-	}, nil
+	return tlscert.SelfSigned("THOI Admin Self-Signed Certificate")
 }
 
 func writeJSON(w http.ResponseWriter, data any) {