v0.29.0

docs/TEST_REPORT.md

@@ -1,29 +1,87 @@
-# Verification report - RustProxy 0.28.2
+# Verification report - RustProxy 0.29.0
 
 ## Scope
 
-RustProxy 0.28.2 hardens the 0.28.1 external-certificate workflow. Absolute certificate/key paths are validated across the configured and resolved parent chains, the final file is opened with `O_NOFOLLOW`, POSIX ACL read access is supported without requiring an exact chmod value, private keys may not be world-readable, and external certificate/key files may not be group/world-writable. The packaged systemd service explicitly keeps `/etc/letsencrypt` and `/etc/ssl` read-only while normal Unix permissions/ACLs remain authoritative for access.
+This report records verification of the 0.29.0 release source in the packaging environment. The release adds canonical www/non-www redirects, first-class Custom location redirects, automatic HTTP health-check Host selection, per-vhost forced-cache targets, bounded gzip log reading, and regression coverage for 503 maintenance pages and nested URL query strings. SQLite remains schema 9 and Cold Cache remains format 3.
 
-Certificate automation is also narrowed. SQLite schema 9 adds per-Key-ID grants: new Certificate API tokens require explicit certificate IDs, are reload-only by default, cannot call the global all-certificate reload endpoint, and require an explicit deploy grant before `POST /api/certificates/deploy` is accepted. Credentials from earlier releases migrate to reload-only wildcard compatibility grants and should be rotated to explicit IDs.
+## Source and release checks
 
-The release retains the 0.28.0 GeoIP direct-source/MMDB hot reload, listener protocol badges, cache Via/narrow invalidation, Security-editor layout and ACME runtime reporting. COLD cache format 3 and saved proxy configuration format remain unchanged.
+The repository release gates are executed with:
 
-## Verification
+```bash
+./dev.sh test
+./dev.sh check
+```
 
-| Check | Result |
-|---|---|
-| Source/static contracts | PASS - `tools/checks/check_source.py` |
-| Documentation/index/link checks | PASS - `tools/checks/docs_check.py` |
-| Browser-side JavaScript syntax/UI contracts | PASS - `./dev.sh test` pre-Cargo stages |
-| SQLite schema-9 migration and release smoke | PASS - `tools/checks/release_smoke.py`, including legacy-token grant migration |
-| Docker Agent Go tests | PASS - `go test ./...` |
-| Shell/Python/JSON syntax checks | PASS - release/static checks plus explicit shell/JSON validation |
-| `cargo fmt/check/test` | NOT VERIFIED - Rust/Cargo are not installed in this verification environment; `./dev.sh test` exits 127 only after all pre-Cargo gates pass |
-| Live Certbot ACL + targeted API reload | NOT VERIFIED - requires a compiled binary and host certificate material |
-| Live HTTP/2 + HTTP/3 protocol tests | NOT VERIFIED - requires a compiled binary and QUIC-capable runtime |
+`./dev.sh test` runs the Rust-independent source/module, release-smoke, memory, Web Server, security, dependency, browser-UI, documentation and translation checks before attempting Cargo. The 0.29.0 source checks cover the new configuration/UI/runtime contracts as well as retained release behavior.
 
-## Security regression coverage
+Additional syntax checks used for the edited browser assets are:
 
-The source tests include Certbot-style `live/ -> archive/` symlink refresh behavior, acceptance of ACL-style group-mask bits, rejection of group/world-writable or world-readable private-key modes, and rejection of writable non-sticky parent directories. Administration tests cover targeted certificate-ID grants, denial of global reload for Certificate API tokens, rejection of non-allowlisted certificate IDs and independent token revocation.
+```bash
+node --check src/admin/web/vhosts/core.js
+node --check src/admin/web/vhosts/editor.js
+node --check src/admin/web/vhosts/render.js
+```
 
-See [V0.28.2_IMPLEMENTATION.md](V0.28.2_IMPLEMENTATION.md) for the operator ACL example and migration behavior.
+## Environment limitation
+
+Rust/Cargo is not installed or not available on PATH in this packaging environment. Therefore Rust parsing, type checking, linking and execution of `cargo test --locked --all-targets` cannot be claimed here. `./dev.sh test` was executed and all Rust-independent gates printed PASS before the script stopped at the explicit Rust/Cargo guard with exit 127. `./dev.sh check` was also executed and stopped at the same guard with exit 127.
+
+
+Observed auxiliary checks:
+
+```text
+node --check src/admin/web/vhosts/core.js    PASS
+node --check src/admin/web/vhosts/editor.js  PASS
+node --check src/admin/web/vhosts/render.js  PASS
+(cd docker-agent && go test ./...)            PASS
+```
+
+An attempt to fetch a user-local Rust toolchain was unavailable from this environment, so no compiler result is inferred from the source/static checks.
+
+A Rust-enabled release host must still run:
+
+```bash
+cargo fmt --all -- --check
+cargo check --locked --all-targets
+cargo test --locked --all-targets
+```
+
+before promoting the binary package.
+
+## Functional regressions included in source
+
+The Rust test source includes coverage for:
+
+- www/non-www companion routing and canonical redirect behavior;
+- default and explicitly overridden HTTP health-check Host selection;
+- Custom location redirects with a separate capture regex and query preservation;
+- per-vhost forced-cache target matching and retained protocol-safety exclusions;
+- bounded discovery/read of rotated `.gz` Stored Logs;
+- a static/maintenance HTML response with HTTP 503;
+- preservation of a valid nested-URL query string in the upstream URI.
+
+Literal/encoded backslashes remain intentionally rejected by the ambiguous-routing guard. For the reported curl case, use normal query separators inside a quoted URL rather than `\?`, `\=` or `\&`.
+
+## Post-release source revision: multi-host vhost and canonical selector
+
+The vhost editor now selects a canonical hostname from the configured host list, with a legacy first-host fallback. An additional Rust regression test verifies independent `suba.local` and `subb.local` aliases and a selected redirect target; invalid foreign redirect targets are rejected. Compiler/runtime tests remain unverified in this environment.
+
+## Frontends WWW-routing UX revision
+
+The editor groups host chips and WWW redirect controls in the same Frontends tab. The legacy select is replaced by accessible paired radio choices showing both `www -> bare` and `bare -> www` for each exact host (also while the feature is off), plus a list of non-redirected aliases and the number of configured names. A `www.` destination can be implicit: routing claims both hosts even if only the bare name was listed in the vhost. Wildcards are not offered as redirect targets. The selected target survives unrelated edits and automatically falls back to a valid hostname when removed; wildcard-only configurations disable the redirect control and show guidance. The persisted fields (`www_redirect` and `www_redirect_target`) are unchanged.
+
+`node tools/checks/vhost_www_ui_test.mjs` runs the actual WWW-routing editor component in a DOM stand-in and covers its switch, selected-target restore, alias visibility, both redirect directions, implicit `www.` target, wildcard handling, removal fallback, and serialization. Rust source includes a complementary runtime regression for the implicit www routing pair. These checks do not substitute for executing Rust proxy runtime tests.
+
+## WWW UX correction (source revision)
+
+The Frontends tab now shows the WWW target choices next to its hostname editor, grouped by domain and available for preview even when the feature is disabled. Both www to bare and bare to www destinations are available. A WWW destination may be implicit (`www.subb.local` with only `subb.local` configured); the runtime claims both hostnames for the selected pair, while a second domain (`suba.local`) remains an independent alias of the same vhost and backend. A Rust regression test covers the implicit WWW direction; static checks and JS syntax tests are described above. Full Rust compiler/runtime verification still requires Cargo.
+
+### WWW UX packaging verification
+
+In this source revision, `node tools/checks/www_redirect_ui_test.mjs` and
+`node tools/checks/vhost_www_ui_test.mjs` both pass their DOM-stand-in selection
+and synchronization checks. `./dev.sh test` passed all pre-Cargo checks and
+stopped at the missing Cargo guard with exit 127. Syntax checks for the edited
+JavaScript and the two language JSON packs also passed. This does not establish
+Rust compile/test success or end-to-end browser behavior.