v0.20.0 mtls hardening, fail-closed config, startup warnings, sink fixes

internal/tlsx/tlsx_test.go

@@ -0,0 +1,34 @@
+package tlsx
+
+import (
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Startup names a certificate outside its validity window or within 30 days
+// of leaving it; a healthy one stays silent.
+func TestExpiryWarning(t *testing.T) {
+	now := time.Date(2026, 10, 1, 12, 0, 0, 0, time.UTC)
+	day := 24 * time.Hour
+	cert := func(from, until time.Duration) *x509.Certificate {
+		return &x509.Certificate{Subject: pkix.Name{CommonName: "relay"}, NotBefore: now.Add(from), NotAfter: now.Add(until)}
+	}
+	for _, tc := range []struct {
+		name string
+		cert *x509.Certificate
+		want string
+	}{
+		{"valid", cert(-day, 90*day), ""},
+		{"expiring", cert(-day, 10*day), "expires on 2026-10-11"},
+		{"expired", cert(-90*day, -day), "expired on 2026-09-30"},
+		{"not yet valid", cert(day, 90*day), "not valid until"},
+	} {
+		got := expiryWarning(tc.cert, now)
+		if tc.want == "" && got != "" || !strings.Contains(got, tc.want) {
+			t.Errorf("%s: warning = %q, want %q", tc.name, got, tc.want)
+		}
+	}
+}