2 files changed, 37 insertions, 1 deletions
diff --git a/internal/net/p2_hardening_test.go b/internal/net/p2_hardening_test.go
new file mode 100644
index 0000000..089dcb2
--- /dev/null
+++ b/internal/net/p2_hardening_test.go
@@ -0,0 +1,31 @@
+package net
+
+import (
+	"testing"
+
+	"thehouseoficarus/internal/config"
+)
+
+// TestPartialTLSConfigIsFatal: an operator who sets only one of
+// tls.cert_file / tls.key_file must get a startup error instead of a silent
+// self-signed fallback that makes clients fail verification confusingly.
+func TestPartialTLSConfigIsFatal(t *testing.T) {
+	cfg := config.Default()
+	cfg.TLS.CertFile = "/tmp/only-cert.pem"
+	cfg.TLS.KeyFile = ""
+	if _, err := loadOrGenerateCert(cfg, "test"); err == nil {
+		t.Fatal("accepted a half-configured TLS cert pair")
+	}
+}
+
+// TestPreAuthStatesUseShortTimeout: the new-account prompts are pre-auth
+// states and must use the short login window, not the 30-minute idle window.
+func TestPreAuthStatesUseShortTimeout(t *testing.T) {
+	for _, st := range []SessionState{StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount} {
+		sess := &Session{}
+		sess.SetState(st)
+		if got := sessionIdleTimeout(sess); got != loginReadTimeout {
+			t.Fatalf("state %v timeout = %v, want %v", st, got, loginReadTimeout)
+		}
+	}
+}
diff --git a/internal/net/server.go b/internal/net/server.go
index 05a98d1..f56aebb 100644
--- a/internal/net/server.go
+++ b/internal/net/server.go
@@ -233,7 +233,7 @@ func (s *Server) sessionIdleTimeout(sess *Session) time.Duration {
 // anonymous flood targets), everything else gets a generous idle timeout.
 func sessionIdleTimeout(sess *Session) time.Duration {
 	switch sess.State() {
-	case StateAccountName, StatePassword:
+	case StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount:
 		return loginReadTimeout
 	default:
 		return idleReadTimeout
@@ -555,6 +555,11 @@ func NewServer(cfg *config.Config) (*Server, error) {
 }
 
 func loadOrGenerateCert(cfg *config.Config, service string) (tls.Certificate, error) {
+	// A half-configured cert pair must fail loudly: silently falling back to a
+	// self-signed cert makes clients fail verification with a confusing error.
+	if (cfg.TLS.CertFile == "") != (cfg.TLS.KeyFile == "") {
+		return tls.Certificate{}, fmt.Errorf("%s: tls.cert_file and tls.key_file must be set together", service)
+	}
 	if cfg.TLS.CertFile != "" && cfg.TLS.KeyFile != "" {
 		return tls.LoadX509KeyPair(cfg.TLS.CertFile, cfg.TLS.KeyFile)
 	}