v0.32.5

docs/TEST_REPORT.md

@@ -0,0 +1,101 @@
+# Verification report - RustProxy 0.32.5
+
+## Verification performed for this source package
+
+- **0.32.5 administration UI startup fix:** the DNS ACL translation helper in
+  `src/admin/web/management.js` is now initialized before the DDNS hint uses
+  it. `tools/checks/dynamic_acl_startup_0325_ui_test.mjs` executes the real ACL
+  editor initializer with a simulated DOM and verifies that it completes and
+  renders the translatable DNS hint. The test reproduced the user-reported
+  `ReferenceError` against the unmodified 0.32.5 source before the fix.
+  **36/36 JavaScript checks passed** after adding this test to `dev.sh`.
+  The assembled JavaScript bundle passed `node --check`. The source/version,
+  admin surface, security, docs and language checks passed. `release_smoke.py`
+  exceeded the available execution timeout; the Rust compiler and live server
+  remain unavailable, so full release/runtime acceptance is not claimed.
+- **0.32.5 build correction:** fix reported Rust `E0505` in `src/acl/dynamic.rs` by cloning the hostname into `lookup_name` for `lookup_host`. The original `name` is returned as the cache key. Added a source-contract regression check; Rust compilation is still required to confirm the correction.
+- `tools/checks/dynamic_acl_0325.py`: **15/15 static source contracts passed**.
+- JavaScript dashboard/settings regression scripts: **36/36 passed** (35 existing and one new startup regression).
+- `tools/checks/check_source.py`, `rust_module_contracts.py`,
+  `docs_check.py`, `langs_check.py`, `security_contracts.py`, and
+  `admin_surface_audit_0310.py`: passed.
+- The full `./dev.sh test` was interrupted by the environment time limit while
+  running expensive pre-Cargo release simulations. It was **not** a full pass.
+- Cargo/rustc are unavailable here. Dynamic DNS Rust unit tests, integration
+  tests, real resolver timeouts/rotation and production acceptance **not run**.
+
+## 0.32.5 dynamic DNS ACL changes
+
+This build extends existing ACL `Rule.network` entries with allow-only DNS/DDNS
+hostname support. Resolution is background-only and bounded (60s cadence,
+4s timeout, max 8 concurrent lookups, max 128 unique names / 32 IPs per name).
+Initial, expired and failed resolution states deny dynamic host authorization.
+Existing numeric IP/CIDR and explicit-deny precedence remain unchanged.
+
+A Rust compiler and real DNS peer were not available in this environment.
+The Rust tests in `src/acl/tests.rs` and `src/acl/dynamic.rs` **have not been
+executed** here. Before rollout, run `cargo fmt --all -- --check`,
+`cargo check --locked --all-targets` and `cargo test --locked`, then confirm
+live DDNS rotation and fail-closed DNS outages on staging.
+
+## Previous 0.32.4 scope
+
+Review of the supplied RustProxy 0.32.3 source and patch to 0.32.4:
+HTTP Host / HTTP/2 authority parity, explicit TCP/DNS destination and TLS/SNI
+isolation, relaxed HTTPS-by-IP troubleshooting hint, and uniform Overview gutters.
+Follow-up patch to the first 0.32.4 archive:
+- Fix reported `E0382` in `src/proxy/types.rs`: `Request::builder().uri(uri)`
+  moved `uri` before `upstream_request_target(&uri, ...)` could borrow it.
+  `.uri(uri.clone())` preserves the original URI for authority selection.
+- Make normal Overview gutters uniformly 4px (dense 3px, comfortable 12px).
+  Resolve the higher-specificity `html[data-dashboard-density] .stats-grid`
+  rule which otherwise overrode the aligned grid and kept the larger gaps.
+Existing database/configuration schemas and retry/transport policies are
+unchanged. Only compiling Rust and live protocol tests prove runtime behavior.
+
+## Available checks
+
+- `./dev.sh test`: **all pre-Cargo checks passed**, including source/security,
+  SQLite migration/upgrade/backup simulations, memory-model scripts and **35
+  Node.js UI/behavior test scripts**. The command then exited **127** because
+  Rust/Cargo is not installed; this is **not** a passing Rust test run.
+- New `preserve_host_0324.py` and `preserve_host_0324_ui_test.mjs` passed:
+  authority/destination split source contracts, four protocol selectors,
+  verified/unencrypted origin warnings, explicit diagnostics preset.
+- Expanded Chromium CSS fixture `tools/checks/overview_gutters_0324_browser.py`:
+  **27 checks passed** (3 container widths x 3 UI density modes x 3 Dashboard
+  densities), checking horizontal/vertical gutters, equally high rows and
+  numeric-to-large-card transition. Normal/dense/comfortable gaps measured
+  **4/3/12px** and the outer grid bottom margin remained `0px`.
+  The older `overview_grid_spacing_0323_browser.py` also passed with all
+  62 blocks, responsive breakpoints and browser zoom 90%-130%.
+  These are simulated layout tests, not a live administrator session.
+- `preserve_host_0324.py` now guards against moving `uri` before its final
+  authority adjustment, in addition to the backend/transport source contracts.
+  The existing Rust unit test for retry authority remains in the source.
+- Version consistency: Cargo manifest, package root in existing lockfile,
+  OpenAPI, README, release notes and static assertion fixtures updated to 0.32.4.
+  External Cargo dependency resolutions have **not** been regenerated.
+
+## Rust validation not performed (blocking for production)
+
+The user's Rust compiler reported `error[E0382]: borrow of moved value: uri`
+from the first 0.32.4 archive. This has been corrected in source, but **the
+corrected code has not been compiled here**: no Cargo or Rust compiler is
+available in the source-editing environment.
+Do not treat static tests or the simulated TLS-peer tests added to Rust source
+as evidence that RustProxy builds or that an actual Angie backend accepts the
+corrected requests. Run, on a Rust 1.99+ host:
+
+```sh
+cargo fmt --all -- --check
+cargo check --locked --all-targets
+cargo test --locked
+```
+
+Then validate on staging with HTTPS-by-IP and `preserve_host: true` for
+HTTP/1.1, Auto (H2 and H1 ALPN), compatible HTTP/2 and strict H2; check
+`:authority` vs `Host`, SNI, certificate verification, WebSockets, H2C and
+HTTP health probe `host` overrides. Inspect Angie response/error logs for
+400 responses and verify backend connectivity through pool rotation/retry.
+No claim of universal backend compatibility or measured throughput is made.