1 files changed, 31 insertions, 0 deletions
diff --git a/internal/net/p2_hardening_test.go b/internal/net/p2_hardening_test.go
new file mode 100644
index 0000000..089dcb2
--- /dev/null
+++ b/internal/net/p2_hardening_test.go
@@ -0,0 +1,31 @@
+package net
+
+import (
+	"testing"
+
+	"thehouseoficarus/internal/config"
+)
+
+// TestPartialTLSConfigIsFatal: an operator who sets only one of
+// tls.cert_file / tls.key_file must get a startup error instead of a silent
+// self-signed fallback that makes clients fail verification confusingly.
+func TestPartialTLSConfigIsFatal(t *testing.T) {
+	cfg := config.Default()
+	cfg.TLS.CertFile = "/tmp/only-cert.pem"
+	cfg.TLS.KeyFile = ""
+	if _, err := loadOrGenerateCert(cfg, "test"); err == nil {
+		t.Fatal("accepted a half-configured TLS cert pair")
+	}
+}
+
+// TestPreAuthStatesUseShortTimeout: the new-account prompts are pre-auth
+// states and must use the short login window, not the 30-minute idle window.
+func TestPreAuthStatesUseShortTimeout(t *testing.T) {
+	for _, st := range []SessionState{StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount} {
+		sess := &Session{}
+		sess.SetState(st)
+		if got := sessionIdleTimeout(sess); got != loginReadTimeout {
+			t.Fatalf("state %v timeout = %v, want %v", st, got, loginReadTimeout)
+		}
+	}
+}