feat: Add validation for SSH certificates and implement unit tests for SshAuthInterceptor

Cargo.lock

@@ -2517,6 +2517,7 @@ name = "nxmesh-proto"
 version = "0.1.0"
 dependencies = [
  "prost",
+ "tokio-test",
  "tonic",
  "tonic-async-interceptor",
  "tonic-prost",

apps/nxmesh-agent/src/cli/mod.rs

@@ -79,3 +79,84 @@ pub enum Commands {
         ca_cert: Option<String>,
     },
 }
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    use super::{Cli, Commands};
+
+    #[test]
+    fn parses_serve_flag_without_subcommand() {
+        let parsed = Cli::try_parse_from(["nxmesh-agent", "--serve"]);
+        assert!(parsed.is_ok());
+
+        let parsed = parsed.ok();
+        assert!(parsed.is_some());
+        let parsed = parsed.unwrap_or_else(|| unreachable!());
+
+        assert!(parsed.serve);
+        assert!(parsed.command.is_none());
+    }
+
+    #[test]
+    fn parses_import_certs_with_zip_defaults() {
+        let parsed = Cli::try_parse_from(["nxmesh-agent", "import-certs", "bundle.zip"]);
+        assert!(parsed.is_ok());
+
+        let parsed = parsed.ok();
+        assert!(parsed.is_some());
+        let parsed = parsed.unwrap_or_else(|| unreachable!());
+
+        match parsed.command {
+            Some(Commands::ImportCerts {
+                zip,
+                cert_name,
+                key_name,
+                ca_name,
+                cert,
+                key,
+                ca_cert,
+            }) => {
+                assert_eq!(zip.as_deref(), Some("bundle.zip"));
+                assert_eq!(cert_name.as_deref(), Some("cert.pem"));
+                assert_eq!(key_name.as_deref(), Some("key.pem"));
+                assert_eq!(ca_name.as_deref(), Some("ca.pem"));
+                assert!(cert.is_none());
+                assert!(key.is_none());
+                assert!(ca_cert.is_none());
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn rejects_import_certs_with_separate_files() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-agent",
+            "import-certs",
+            "--cert",
+            "agent.crt",
+            "--key",
+            "agent.key",
+            "--ca-cert",
+            "ca.crt",
+        ]);
+        assert!(parsed.is_err());
+    }
+
+    #[test]
+    fn rejects_conflicting_zip_and_separate_inputs() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-agent",
+            "import-certs",
+            "bundle.zip",
+            "--cert",
+            "agent.crt",
+            "--key",
+            "agent.key",
+        ]);
+
+        assert!(parsed.is_err());
+    }
+}

apps/nxmesh-agent/src/config/settings.rs

@@ -318,6 +318,14 @@ where
 
 #[cfg(test)]
 mod tests {
+    use std::{
+        fs,
+        os::unix::fs::PermissionsExt,
+        path::{Path, PathBuf},
+    };
+
+    use tempfile::TempDir;
+
     use super::*;
 
     #[test]
@@ -330,4 +338,223 @@ mod tests {
         assert_send_sync::<LogSettings>();
         assert_send_sync::<NginxSettings>();
     }
+
+    fn write_file(path: &Path) {
+        let result = fs::write(path, b"content");
+        assert!(result.is_ok());
+    }
+
+    fn create_exec_file(path: &Path) {
+        write_file(path);
+        let metadata = fs::metadata(path);
+        assert!(metadata.is_ok());
+        let metadata = metadata.ok();
+        assert!(metadata.is_some());
+        let metadata = metadata.unwrap_or_else(|| unreachable!());
+
+        let mut perms = metadata.permissions();
+        perms.set_mode(0o755);
+        let result = fs::set_permissions(path, perms);
+        assert!(result.is_ok());
+    }
+
+    fn create_non_exec_file(path: &Path) {
+        write_file(path);
+        let metadata = fs::metadata(path);
+        assert!(metadata.is_ok());
+        let metadata = metadata.ok();
+        assert!(metadata.is_some());
+        let metadata = metadata.unwrap_or_else(|| unreachable!());
+
+        let mut perms = metadata.permissions();
+        perms.set_mode(0o644);
+        let result = fs::set_permissions(path, perms);
+        assert!(result.is_ok());
+    }
+
+    fn valid_tls_raw_paths(temp_dir: &TempDir) -> (PathBuf, PathBuf, PathBuf) {
+        let ca_path = temp_dir.path().join("ca.pem");
+        let cert_path = temp_dir.path().join("cert.pem");
+        let key_path = temp_dir.path().join("key.pem");
+
+        write_file(&ca_path);
+        write_file(&cert_path);
+        write_file(&key_path);
+
+        (ca_path, cert_path, key_path)
+    }
+
+    #[test]
+    fn tls_raw_path_validate_succeeds_when_all_files_exist() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let (ca_path, cert_path, key_path) = valid_tls_raw_paths(&temp_dir);
+        let settings = TLSSettings::RawPath {
+            ca_path: ca_path.to_string_lossy().to_string(),
+            cert_path: cert_path.to_string_lossy().to_string(),
+            key_path: key_path.to_string_lossy().to_string(),
+        };
+
+        assert!(settings.validate().is_ok());
+    }
+
+    #[test]
+    fn tls_raw_path_validate_fails_when_ca_missing() {
+        let settings = TLSSettings::RawPath {
+            ca_path: "/tmp/does-not-exist-ca.pem".into(),
+            cert_path: "/tmp/does-not-exist-cert.pem".into(),
+            key_path: "/tmp/does-not-exist-key.pem".into(),
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("CA file not found"));
+    }
+
+    #[test]
+    fn tls_zip_path_validate_fails_when_zip_missing() {
+        let settings = TLSSettings::ZipPath {
+            cert_zip_path: "/tmp/missing-certs.zip".into(),
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Certificate zip file not found"));
+    }
+
+    #[test]
+    fn grpc_validate_fails_when_connection_string_empty() {
+        let settings = GrpcSettings {
+            connection_string: "".into(),
+            m_auth: MAuthSettings::Tls(TLSSettings::ZipPath {
+                cert_zip_path: "/tmp/does-not-exist.zip".into(),
+            }),
+            cors: None,
+        };
+
+        let result = settings.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("gRPC connection string cannot be empty"));
+    }
+
+    #[test]
+    fn nginx_validate_succeeds_for_valid_paths_and_commands() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: default_nginx_reload_command(),
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        assert!(nginx.validate().is_ok());
+    }
+
+    #[test]
+    fn nginx_validate_fails_for_non_executable_binary() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_non_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: default_nginx_reload_command(),
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        let result = nginx.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Nginx binary is not executable"));
+    }
+
+    #[test]
+    fn nginx_validate_fails_when_reload_command_lacks_template() {
+        let temp_dir = TempDir::new();
+        assert!(temp_dir.is_ok());
+        let temp_dir = temp_dir.ok();
+        assert!(temp_dir.is_some());
+        let temp_dir = temp_dir.unwrap_or_else(|| unreachable!());
+
+        let nginx_binary = temp_dir.path().join("nginx");
+        let nginx_config = temp_dir.path().join("nginx.conf");
+
+        create_exec_file(&nginx_binary);
+        write_file(&nginx_config);
+
+        let nginx = NginxSettings {
+            nginx_config_path: nginx_config.to_string_lossy().to_string(),
+            nginx_binary_path: Some(nginx_binary.to_string_lossy().to_string()),
+            override_nginx_reload_command: vec!["nginx".into(), "-s".into(), "reload".into()],
+            override_nginx_test_command: default_nginx_test_command(),
+            nginx_reload_timeout_seconds: 30,
+            nginx_test_timeout_seconds: 30,
+        };
+
+        let result = nginx.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_else(|| unreachable!());
+        assert!(msg.contains("Nginx reload command must contain the binary path template"));
+    }
+
+    #[test]
+    fn level_filter_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_level_filter",
+                serialize_with = "serialize_level_filter"
+            )]
+            level: LevelFilter,
+        }
+
+        let original = Wrapper {
+            level: LevelFilter::DEBUG,
+        };
+
+        let encoded = serde_json::to_string(&original);
+        assert!(encoded.is_ok());
+        let encoded = encoded.ok();
+        assert!(encoded.is_some());
+        let encoded = encoded.unwrap_or_else(|| unreachable!());
+        assert!(encoded.to_lowercase().contains("debug"));
+
+        let decoded = serde_json::from_str::<Wrapper>(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.ok();
+        assert!(decoded.is_some());
+        let decoded = decoded.unwrap_or_else(|| unreachable!());
+        assert_eq!(decoded.level, LevelFilter::DEBUG);
+    }
 }

apps/nxmesh-agent/src/connector/master/mod.rs

@@ -4,7 +4,8 @@ use tokio::sync::Mutex;
 
 pub mod ssh;
 
-pub type AgentClient = nxmesh_proto::agent_service_client::AgentServiceClient<tonic::transport::Channel>;
+pub type AgentClient =
+    nxmesh_proto::agent_service_client::AgentServiceClient<tonic::transport::Channel>;
 
 #[async_trait::async_trait]
 pub trait MasterConnectorTrait: Send + Sync {
@@ -38,3 +39,105 @@ impl MasterConnectorTrait for MasterConnector {
         self.connector.get_client()
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    };
+
+    use tokio::sync::Mutex;
+
+    use crate::config::settings::{
+        GrpcSettings, LogSettings, MAuthSettings, Settings, TLSSettings,
+    };
+
+    use super::{AgentClient, MasterConnector, MasterConnectorTrait};
+
+    struct FakeConnector {
+        called: Arc<AtomicBool>,
+        fail: bool,
+        client: Arc<Mutex<AgentClient>>,
+    }
+
+    #[async_trait::async_trait]
+    impl MasterConnectorTrait for FakeConnector {
+        async fn connect(
+            &mut self,
+            _settings: &Settings,
+        ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+            self.called.store(true, Ordering::SeqCst);
+            if self.fail {
+                return Err("connector failed".into());
+            }
+            Ok(())
+        }
+
+        fn get_client(&self) -> Arc<Mutex<AgentClient>> {
+            self.client.clone()
+        }
+    }
+
+    fn test_settings() -> Settings {
+        Settings {
+            grpc: GrpcSettings {
+                connection_string: "https://localhost:50051".to_string(),
+                m_auth: MAuthSettings::Tls(TLSSettings::ZipPath {
+                    cert_zip_path: "/tmp/certs.zip".to_string(),
+                }),
+                cors: None,
+            },
+            log: LogSettings::default(),
+            nginx: None,
+        }
+    }
+
+    fn test_client() -> Arc<Mutex<AgentClient>> {
+        let channel =
+            tonic::transport::Channel::from_static("http://127.0.0.1:50051").connect_lazy();
+        Arc::new(Mutex::new(AgentClient::new(channel)))
+    }
+
+    #[tokio::test]
+    async fn master_connector_delegates_connect_successfully() {
+        let called = Arc::new(AtomicBool::new(false));
+        let fake = FakeConnector {
+            called: called.clone(),
+            fail: false,
+            client: test_client(),
+        };
+        let mut master = MasterConnector::new(Box::new(fake));
+
+        let result = master.connect(&test_settings()).await;
+        assert!(result.is_ok());
+        assert!(called.load(Ordering::SeqCst));
+    }
+
+    #[tokio::test]
+    async fn master_connector_propagates_connect_errors() {
+        let fake = FakeConnector {
+            called: Arc::new(AtomicBool::new(false)),
+            fail: true,
+            client: test_client(),
+        };
+        let mut master = MasterConnector::new(Box::new(fake));
+
+        let result = master.connect(&test_settings()).await;
+        assert!(result.is_err());
+    }
+
+    #[tokio::test]
+    async fn master_connector_returns_underlying_client() {
+        let shared_client = test_client();
+        let fake = FakeConnector {
+            called: Arc::new(AtomicBool::new(false)),
+            fail: false,
+            client: shared_client.clone(),
+        };
+        let master = MasterConnector::new(Box::new(fake));
+
+        let client = master.get_client();
+        assert!(Arc::ptr_eq(&client, &shared_client));
+    }
+}

apps/nxmesh-agent/src/connector/master/ssh.rs

@@ -6,7 +6,7 @@ use nxmesh_proto::agent_service_client::AgentServiceClient;
 use tonic::transport::{Certificate, ClientTlsConfig, Identity};
 use tracing::warn;
 
-use crate::config::settings::{self, MAuthSettings, TLSSettings};
+use crate::config::settings::{MAuthSettings, TLSSettings};
 
 use super::{AgentClient, MasterConnectorTrait};
 
@@ -130,3 +130,151 @@ impl MasterConnectorTrait for SshMasterConnector {
         self.client.clone()
     }
 }
+
+#[cfg(test)]
+#[allow(clippy::expect_used)]
+mod tests {
+    use std::{
+        fs::{self, File},
+        io::Write,
+        path::Path,
+    };
+
+    use tempfile::TempDir;
+
+    use crate::config::settings::{MAuthSettings, TLSSettings};
+
+    use super::SshMasterConnector;
+
+    const CERT_PEM: &[u8] = b"-----BEGIN CERTIFICATE-----\nAQ==\n-----END CERTIFICATE-----\n";
+    const KEY_PEM: &[u8] = b"-----BEGIN PRIVATE KEY-----\nAQ==\n-----END PRIVATE KEY-----\n";
+    const CA_PEM: &[u8] = b"-----BEGIN CERTIFICATE-----\nAQ==\n-----END CERTIFICATE-----\n";
+
+    fn create_zip_with_entries(
+        dir: &TempDir,
+        file_name: &str,
+        entries: &[(&str, &[u8])],
+    ) -> Result<String, Box<dyn std::error::Error + Send + Sync>> {
+        let zip_path = dir.path().join(file_name);
+        let file = File::create(&zip_path)?;
+        let mut zip = zip::ZipWriter::new(file);
+        let options = zip::write::SimpleFileOptions::default()
+            .compression_method(zip::CompressionMethod::Deflated)
+            .unix_permissions(0o600);
+
+        for (entry_name, contents) in entries {
+            zip.start_file(entry_name, options)?;
+            zip.write_all(contents)?;
+        }
+
+        zip.finish()?;
+        Ok(zip_path.to_string_lossy().to_string())
+    }
+
+    fn write_file(
+        path: &Path,
+        contents: &[u8],
+    ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
+        fs::write(path, contents)?;
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn extract_certificate_succeeds_with_expected_files() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "certs.zip",
+            &[
+                ("cert.pem", CERT_PEM),
+                ("key.pem", KEY_PEM),
+                ("ca.pem", CA_PEM),
+                ("ignored.txt", b"ignored"),
+            ],
+        )
+        .expect("failed to create zip");
+
+        let (ca, cert, key) = SshMasterConnector::extract_certificate(&zip_path)
+            .await
+            .expect("expected cert extraction to succeed");
+
+        assert_eq!(ca, CA_PEM);
+        assert_eq!(cert, CERT_PEM);
+        assert_eq!(key, KEY_PEM);
+    }
+
+    #[tokio::test]
+    async fn extract_certificate_fails_when_required_files_are_missing() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "missing-key.zip",
+            &[("cert.pem", CERT_PEM), ("ca.pem", CA_PEM)],
+        )
+        .expect("failed to create zip");
+
+        let err = SshMasterConnector::extract_certificate(&zip_path)
+            .await
+            .expect_err("expected extraction to fail when key.pem is missing");
+
+        assert!(
+            err.to_string()
+                .contains("Certificate zip must contain cert.pem, key.pem and ca.pem")
+        );
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_succeeds_for_raw_paths() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let cert_path = temp_dir.path().join("cert.pem");
+        let key_path = temp_dir.path().join("key.pem");
+        let ca_path = temp_dir.path().join("ca.pem");
+
+        write_file(&cert_path, CERT_PEM).expect("failed to write cert.pem");
+        write_file(&key_path, KEY_PEM).expect("failed to write key.pem");
+        write_file(&ca_path, CA_PEM).expect("failed to write ca.pem");
+
+        let settings = MAuthSettings::Tls(TLSSettings::RawPath {
+            ca_path: ca_path.to_string_lossy().to_string(),
+            cert_path: cert_path.to_string_lossy().to_string(),
+            key_path: key_path.to_string_lossy().to_string(),
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_ok(), "expected raw path TLS config to succeed");
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_succeeds_for_zip_path() {
+        let temp_dir = TempDir::new().expect("failed to create temp dir");
+        let zip_path = create_zip_with_entries(
+            &temp_dir,
+            "certs.zip",
+            &[
+                ("cert.pem", CERT_PEM),
+                ("key.pem", KEY_PEM),
+                ("ca.pem", CA_PEM),
+            ],
+        )
+        .expect("failed to create zip");
+
+        let settings = MAuthSettings::Tls(TLSSettings::ZipPath {
+            cert_zip_path: zip_path,
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_ok(), "expected zip path TLS config to succeed");
+    }
+
+    #[tokio::test]
+    async fn generate_tls_config_fails_for_missing_raw_files() {
+        let settings = MAuthSettings::Tls(TLSSettings::RawPath {
+            ca_path: "/tmp/non-existent-ca.pem".to_string(),
+            cert_path: "/tmp/non-existent-cert.pem".to_string(),
+            key_path: "/tmp/non-existent-key.pem".to_string(),
+        });
+
+        let result = SshMasterConnector::generate_tls_config(&settings).await;
+        assert!(result.is_err(), "expected raw path TLS config to fail");
+    }
+}

apps/nxmesh-agent/src/connector/mod.rs

@@ -1 +1 @@
-pub mod master;
+pub mod master;

apps/nxmesh-master/src/cli/mod.rs

@@ -61,3 +61,73 @@ pub async fn handle_sub_command(
         } => Ok(gen_agent_certs(settings, output, agent_id, zip).await?),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    use super::{Cli, Commands};
+
+    #[test]
+    fn parses_serve_mode() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "--serve"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        assert!(parsed.serve);
+        assert!(!parsed.generate_ca);
+        assert!(parsed.command.is_none());
+    }
+
+    #[test]
+    fn parses_generate_ca_flag() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "--generate-ca", "--serve"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        assert!(parsed.generate_ca);
+        assert!(parsed.serve);
+    }
+
+    #[test]
+    fn parses_gen_certs_with_default_output() {
+        let parsed = Cli::try_parse_from(["nxmesh-master", "gen-certs"]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        match parsed.command {
+            Some(Commands::GenCerts { output }) => {
+                assert_eq!(output, "./certs");
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn parses_gen_agent_certs_with_custom_values() {
+        let parsed = Cli::try_parse_from([
+            "nxmesh-master",
+            "gen-agent-certs",
+            "--output",
+            "./out",
+            "--agent-id",
+            "agent-123",
+            "--zip",
+        ]);
+        assert!(parsed.is_ok());
+        let parsed = parsed.unwrap_or_else(|_| unreachable!());
+
+        match parsed.command {
+            Some(Commands::GenAgentCerts {
+                output,
+                agent_id,
+                zip,
+            }) => {
+                assert_eq!(output, "./out");
+                assert_eq!(agent_id, "agent-123");
+                assert!(zip);
+            }
+            _ => unreachable!(),
+        }
+    }
+}

apps/nxmesh-master/src/config/settings.rs

@@ -334,6 +334,13 @@ where
 
 #[cfg(test)]
 mod tests {
+    use std::{
+        fs,
+        net::{IpAddr, Ipv4Addr},
+        path::PathBuf,
+        time::{SystemTime, UNIX_EPOCH},
+    };
+
     use super::*;
 
     #[test]
@@ -348,4 +355,232 @@ mod tests {
         assert_send_sync::<CorsSettings>();
         assert_send_sync::<LogSettings>();
     }
+
+    fn make_temp_dir(prefix: &str) -> PathBuf {
+        let ts = SystemTime::now().duration_since(UNIX_EPOCH);
+        assert!(ts.is_ok());
+        let ts = ts.unwrap_or_default();
+        let path = std::env::temp_dir().join(format!(
+            "{}_{}_{}",
+            prefix,
+            std::process::id(),
+            ts.as_nanos()
+        ));
+        let created = fs::create_dir_all(&path);
+        assert!(created.is_ok());
+        path
+    }
+
+    #[test]
+    fn certificate_paths_include_cert_dir() {
+        let cert = CertificateSettings {
+            cert_dir: "./certs".to_string(),
+            san_dns: Vec::new(),
+            san_ip: Vec::new(),
+            cert_path: Some("server.crt".to_string()),
+            key_path: Some("server.key".to_string()),
+        };
+
+        assert_eq!(cert.cert_path(), Some("./certs/server.crt".to_string()));
+        assert_eq!(cert.key_path(), Some("./certs/server.key".to_string()));
+    }
+
+    #[test]
+    fn certificate_validate_creates_directory_when_missing() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-create").join("nested");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: vec![san],
+            san_ip: Vec::new(),
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_ok());
+        assert!(cert_dir.exists());
+
+        let _ = fs::remove_dir_all(cert_dir.parent().unwrap_or(&cert_dir));
+    }
+
+    #[test]
+    fn certificate_validate_fails_when_only_cert_path_is_set() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-partial");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: vec![san],
+            san_ip: Vec::new(),
+            cert_path: Some("server.crt".to_string()),
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Both certificate and key paths must be provided"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn certificate_validate_fails_with_unspecified_ip() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-unspecified-ip");
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: Vec::new(),
+            san_ip: vec![IpAddr::V4(Ipv4Addr::UNSPECIFIED)],
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("SAN IP entries cannot be unspecified"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn certificate_validate_fails_without_any_san_entries() {
+        let cert_dir = make_temp_dir("nxmesh-master-cert-no-san");
+        let cert = CertificateSettings {
+            cert_dir: cert_dir.to_string_lossy().to_string(),
+            san_dns: Vec::new(),
+            san_ip: Vec::new(),
+            cert_path: None,
+            key_path: None,
+        };
+
+        let result = cert.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("At least one SAN entry"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn database_validate_fails_for_zero_max_connections() {
+        let db = DatabaseSettings {
+            url: "postgres://localhost/db".to_string(),
+            max_connections: Some(0),
+        };
+
+        let result = db.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Max database connections must be greater than 0"));
+    }
+
+    #[test]
+    fn auth_validate_fails_for_empty_secret() {
+        let auth = AuthSettings {
+            jwt_secret: "".to_string(),
+            jwt_expiration_hours: 24,
+        };
+
+        let result = auth.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("JWT secret cannot be empty"));
+    }
+
+    #[test]
+    fn server_validate_fails_for_zero_port() {
+        let cert_dir = make_temp_dir("nxmesh-master-server-validate");
+        let san = Ia5String::try_from("localhost".to_string());
+        assert!(san.is_ok());
+        let san = san.unwrap_or_else(|_| unreachable!());
+        let server = ServerSettings {
+            bind_address: "0.0.0.0".to_string(),
+            port: 0,
+            certificate: CertificateSettings {
+                cert_dir: cert_dir.to_string_lossy().to_string(),
+                san_dns: vec![san],
+                san_ip: Vec::new(),
+                cert_path: None,
+                key_path: None,
+            },
+            cors: None,
+        };
+
+        let result = server.validate();
+        assert!(result.is_err());
+        let msg = result.err().unwrap_or_default();
+        assert!(msg.contains("Server port must be greater than 0"));
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[test]
+    fn level_filter_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_level_filter",
+                serialize_with = "serialize_level_filter"
+            )]
+            level: LevelFilter,
+        }
+
+        let data = Wrapper {
+            level: LevelFilter::DEBUG,
+        };
+
+        let encoded = serde_json::to_string(&data);
+        assert!(encoded.is_ok());
+        let encoded = encoded.unwrap_or_default();
+        assert!(encoded.to_lowercase().contains("debug"));
+
+        let decoded: Result<Wrapper, _> = serde_json::from_str(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or(Wrapper {
+            level: LevelFilter::ERROR,
+        });
+        assert_eq!(decoded.level, LevelFilter::DEBUG);
+    }
+
+    #[test]
+    fn ia5string_vec_round_trip_serialization() {
+        #[derive(Serialize, Deserialize)]
+        struct Wrapper {
+            #[serde(
+                deserialize_with = "deserialize_ia5string_vec",
+                serialize_with = "serialize_ia5string_vec"
+            )]
+            san_dns: Vec<Ia5String>,
+        }
+
+        let first = Ia5String::try_from("localhost".to_string());
+        assert!(first.is_ok());
+        let second = Ia5String::try_from("example.com".to_string());
+        assert!(second.is_ok());
+
+        let first = first.unwrap_or_else(|_| unreachable!());
+        let second = second.unwrap_or_else(|_| unreachable!());
+
+        let data = Wrapper {
+            san_dns: vec![first, second],
+        };
+
+        let encoded = serde_json::to_string(&data);
+        assert!(encoded.is_ok());
+        let encoded = encoded.unwrap_or_default();
+        assert!(encoded.contains("localhost"));
+        assert!(encoded.contains("example.com"));
+
+        let decoded: Result<Wrapper, _> = serde_json::from_str(&encoded);
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or(Wrapper {
+            san_dns: Vec::new(),
+        });
+        assert_eq!(decoded.san_dns.len(), 2);
+    }
 }

apps/nxmesh-master/src/db/mod.rs

@@ -9,3 +9,16 @@ pub(crate) async fn establish_connection(
         .await
         .map_err(|e| format!("Failed to connect to database: {}", e).into())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::establish_connection;
+
+    #[tokio::test]
+    async fn establish_connection_fails_for_invalid_url_scheme() {
+        let result = establish_connection("invalid://not-a-db").await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("Failed to connect to database"));
+    }
+}

apps/nxmesh-master/src/service/certificate/mod.rs

@@ -347,3 +347,392 @@ fn validity_period() -> (OffsetDateTime, OffsetDateTime) {
     };
     (not_before, not_after)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        fs,
+        net::{IpAddr, Ipv4Addr},
+        os::unix::fs::PermissionsExt,
+        path::{Path, PathBuf},
+        sync::Arc,
+        time::{SystemTime, UNIX_EPOCH},
+    };
+
+    use rcgen::string::Ia5String;
+    use sea_orm::DatabaseConnection;
+    use serde_json::json;
+
+    use crate::config::settings::Settings;
+
+    use super::{CertificateService, CertificateServiceImpl, ConnectionType, validity_period};
+
+    fn unique_temp_dir(prefix: &str) -> PathBuf {
+        let now = SystemTime::now().duration_since(UNIX_EPOCH);
+        assert!(now.is_ok());
+        let now = now.unwrap_or_default();
+
+        let dir = std::env::temp_dir().join(format!(
+            "{}_{}_{}",
+            prefix,
+            std::process::id(),
+            now.as_nanos()
+        ));
+        let created = fs::create_dir_all(&dir);
+        assert!(created.is_ok());
+        dir
+    }
+
+    fn mock_db_connection() -> DatabaseConnection {
+        DatabaseConnection::default()
+    }
+
+    fn parse_ia5(input: &str) -> Ia5String {
+        let value = Ia5String::try_from(input.to_string());
+        assert!(value.is_ok());
+        value.unwrap_or_else(|_| unreachable!())
+    }
+
+    fn test_settings(grpc_dns: &str, http_dns: &str) -> Arc<Settings> {
+        let parsed = serde_json::from_value::<Settings>(json!({
+            "server": {
+                "bind_address": "127.0.0.1",
+                "port": 8080,
+                "certificate": {
+                    "cert_dir": "./certs",
+                    "san_dns": [http_dns],
+                    "san_ip": ["127.0.0.2"]
+                },
+                "cors": null
+            },
+            "database": {
+                "url": "postgres://user:pass@localhost/db",
+                "max_connections": 5
+            },
+            "grpc": {
+                "bind_address": "127.0.0.1",
+                "port": 50051,
+                "certificate": {
+                    "cert_dir": "./certs",
+                    "san_dns": [grpc_dns],
+                    "san_ip": ["127.0.0.1"]
+                },
+                "cors": null
+            },
+            "auth": {
+                "jwt_secret": "secret",
+                "jwt_expiration_hours": 24
+            },
+            "log": {
+                "level": "INFO"
+            }
+        }));
+
+        assert!(parsed.is_ok());
+        Arc::new(parsed.unwrap_or_else(|_| unreachable!()))
+    }
+
+    fn new_service(cert_dir: &str) -> CertificateServiceImpl {
+        CertificateServiceImpl::new(
+            mock_db_connection(),
+            cert_dir.to_string(),
+            test_settings("grpc.local", "http.local"),
+        )
+    }
+
+    #[test]
+    fn validity_period_is_forward_and_about_one_year() {
+        let (not_before, not_after) = validity_period();
+        assert!(not_after > not_before);
+
+        let diff = not_after - not_before;
+        assert!(diff.whole_days() >= 364);
+        assert!(diff.whole_days() <= 366);
+    }
+
+    #[tokio::test]
+    async fn get_ca_cert_fails_when_folder_missing() {
+        let dir = unique_temp_dir("nxmesh-master-ca-missing");
+        let removed = fs::remove_dir_all(&dir);
+        assert!(removed.is_ok());
+
+        let service = new_service(&dir.to_string_lossy());
+        let result = service.get_ca_cert().await;
+        assert!(result.is_err());
+
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate folder not found"));
+    }
+
+    #[tokio::test]
+    async fn generate_ca_cert_creates_files_and_is_retrievable() {
+        let dir = unique_temp_dir("nxmesh-master-generate-ca");
+        let service = new_service(&dir.to_string_lossy());
+
+        let generated = service.generate_ca_cert().await;
+        assert!(generated.is_ok());
+        let generated = generated.unwrap_or_else(|_| unreachable!());
+        assert!(!generated.cert_pem.is_empty());
+        assert!(!generated.private_key.is_empty());
+        assert!(!generated.public_key.is_empty());
+
+        let ca_cert = dir.join("ca.crt");
+        let ca_key = dir.join("ca.key");
+        let ca_pub = dir.join("ca.pub");
+
+        assert!(ca_cert.exists());
+        assert!(ca_key.exists());
+        assert!(ca_pub.exists());
+
+        let cert_meta = fs::metadata(&ca_cert);
+        assert!(cert_meta.is_ok());
+        let cert_meta = cert_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_meta.permissions().mode() & 0o777, 0o600);
+
+        let key_meta = fs::metadata(&ca_key);
+        assert!(key_meta.is_ok());
+        let key_meta = key_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(key_meta.permissions().mode() & 0o777, 0o600);
+
+        let pub_meta = fs::metadata(&ca_pub);
+        assert!(pub_meta.is_ok());
+        let pub_meta = pub_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(pub_meta.permissions().mode() & 0o777, 0o600);
+
+        let retrieved = service.get_ca_cert().await;
+        assert!(retrieved.is_ok());
+        let (cert_path, key_path) = retrieved.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_path, ca_cert.to_string_lossy());
+        assert_eq!(key_path, ca_key.to_string_lossy());
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn get_ca_cert_fails_when_folder_exists_but_files_missing() {
+        let dir = unique_temp_dir("nxmesh-master-ca-partial");
+        let service = new_service(&dir.to_string_lossy());
+
+        let ca_cert_path = dir.join("ca.crt");
+        let write_result = fs::write(&ca_cert_path, "dummy cert");
+        assert!(write_result.is_ok());
+
+        let result = service.get_ca_cert().await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate or key not found"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_ca_cert_fails_when_ca_exists() {
+        let dir = unique_temp_dir("nxmesh-master-ca-exists");
+        let service = new_service(&dir.to_string_lossy());
+
+        let first = service.generate_ca_cert().await;
+        assert!(first.is_ok());
+
+        let second = service.generate_ca_cert().await;
+        assert!(second.is_err());
+        let msg = second.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("CA certificate already exists"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_pub_cert_pair_requires_ca_cert() {
+        let dir = unique_temp_dir("nxmesh-master-pub-cert-missing-ca");
+        let service = new_service(&dir.to_string_lossy());
+
+        let result = service
+            .generate_pub_cert_pair(
+                vec![IpAddr::V4(Ipv4Addr::LOCALHOST)],
+                vec![parse_ia5("localhost")],
+            )
+            .await;
+        assert!(result.is_err());
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_pub_cert_pair_succeeds_after_ca_generation() {
+        let dir = unique_temp_dir("nxmesh-master-pub-cert-ok");
+        let service = new_service(&dir.to_string_lossy());
+
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let cert_pair = service
+            .generate_pub_cert_pair(
+                vec![IpAddr::V4(Ipv4Addr::LOCALHOST)],
+                vec![parse_ia5("localhost")],
+            )
+            .await;
+        assert!(cert_pair.is_ok());
+        let (cert, key) = cert_pair.unwrap_or_else(|_| unreachable!());
+
+        assert!(cert.contains("BEGIN CERTIFICATE"));
+        assert!(key.contains("BEGIN PRIVATE KEY"));
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_fails_when_output_parent_missing() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-ca");
+        let missing_output = unique_temp_dir("nxmesh-master-agent-certs-missing");
+        let removed = fs::remove_dir_all(&missing_output);
+        assert!(removed.is_ok());
+
+        let service = new_service(&ca_dir.to_string_lossy());
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let result = service
+            .generate_agent_certs("agent-id", &missing_output.to_string_lossy())
+            .await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(msg.contains("Output parent directory does not exist"));
+
+        let _ = fs::remove_dir_all(&ca_dir);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_fails_when_ca_is_missing() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-no-ca");
+        let output_parent = unique_temp_dir("nxmesh-master-agent-certs-no-ca-out");
+        let service = new_service(&ca_dir.to_string_lossy());
+
+        let result = service
+            .generate_agent_certs("agent-1", &output_parent.to_string_lossy())
+            .await;
+        assert!(result.is_err());
+        let msg = result.err().map(|e| e.to_string()).unwrap_or_default();
+        assert!(
+            msg.contains("CA certificate")
+                || msg.contains("CA certificate folder not found")
+                || msg.contains("CA certificate or key not found")
+        );
+
+        let _ = fs::remove_dir_all(&ca_dir);
+        let _ = fs::remove_dir_all(&output_parent);
+    }
+
+    #[tokio::test]
+    async fn generate_agent_certs_and_zip_certificates_succeeds() {
+        let ca_dir = unique_temp_dir("nxmesh-master-agent-certs-zip-ca");
+        let output_parent = unique_temp_dir("nxmesh-master-agent-certs-zip-out");
+        let service = new_service(&ca_dir.to_string_lossy());
+
+        let ca = service.generate_ca_cert().await;
+        assert!(ca.is_ok());
+
+        let generated = service
+            .generate_agent_certs("agent-42", &output_parent.to_string_lossy())
+            .await;
+        assert!(generated.is_ok());
+        let generated = generated.unwrap_or_else(|_| unreachable!());
+
+        assert!(Path::new(&generated.cert_path).exists());
+        assert!(Path::new(&generated.key_path).exists());
+        assert!(Path::new(&generated.ca_cert_path).exists());
+
+        assert!(generated.cert_path.ends_with("agent-42/cert.pem"));
+        assert!(generated.key_path.ends_with("agent-42/key.pem"));
+
+        let cert_meta = fs::metadata(&generated.cert_path);
+        assert!(cert_meta.is_ok());
+        let cert_meta = cert_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(cert_meta.permissions().mode() & 0o777, 0o600);
+
+        let key_meta = fs::metadata(&generated.key_path);
+        assert!(key_meta.is_ok());
+        let key_meta = key_meta.unwrap_or_else(|_| unreachable!());
+        assert_eq!(key_meta.permissions().mode() & 0o777, 0o600);
+
+        let zip = service
+            .zip_certificates(
+                &generated.cert_path,
+                &generated.key_path,
+                &generated.ca_cert_path,
+            )
+            .await;
+        assert!(zip.is_ok());
+        let zip = zip.unwrap_or_else(|_| unreachable!());
+        assert!(Path::new(&zip).exists());
+
+        let zip_file = std::fs::File::open(&zip);
+        assert!(zip_file.is_ok());
+        let zip_file = zip_file.unwrap_or_else(|_| unreachable!());
+        let archive = zip::ZipArchive::new(zip_file);
+        assert!(archive.is_ok());
+        let mut archive = archive.unwrap_or_else(|_| unreachable!());
+
+        assert!(archive.by_name("cert.pem").is_ok());
+        assert!(archive.by_name("key.pem").is_ok());
+        assert!(archive.by_name("ca.pem").is_ok());
+
+        assert!(zip.ends_with("cert.zip"));
+
+        let _ = fs::remove_dir_all(&ca_dir);
+        let _ = fs::remove_dir_all(&output_parent);
+    }
+
+    #[tokio::test]
+    async fn zip_certificates_fails_when_input_files_are_missing() {
+        let cert_dir = unique_temp_dir("nxmesh-master-zip-missing-input");
+        let service = new_service(&cert_dir.to_string_lossy());
+
+        let missing_cert = cert_dir.join("missing-cert.pem");
+        let missing_key = cert_dir.join("missing-key.pem");
+        let missing_ca = cert_dir.join("missing-ca.pem");
+
+        let result = service
+            .zip_certificates(
+                &missing_cert.to_string_lossy(),
+                &missing_key.to_string_lossy(),
+                &missing_ca.to_string_lossy(),
+            )
+            .await;
+        assert!(result.is_err());
+
+        let _ = fs::remove_dir_all(&cert_dir);
+    }
+
+    #[tokio::test]
+    async fn get_sans_returns_values_for_each_connection_type() {
+        let dir = unique_temp_dir("nxmesh-master-get-sans");
+        let service = CertificateServiceImpl::new(
+            mock_db_connection(),
+            dir.to_string_lossy().to_string(),
+            test_settings("grpc.example.test", "http.example.test"),
+        );
+
+        let (grpc_ips, grpc_dns) = service.get_sans(ConnectionType::GRPC);
+        assert_eq!(grpc_ips.len(), 1);
+        assert_eq!(grpc_ips[0], IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)));
+        assert_eq!(grpc_dns.len(), 1);
+        assert_eq!(grpc_dns[0].to_string(), "grpc.example.test");
+
+        let (http_ips, http_dns) = service.get_sans(ConnectionType::HTTP);
+        assert_eq!(http_ips.len(), 1);
+        assert_eq!(http_ips[0], IpAddr::V4(Ipv4Addr::new(127, 0, 0, 2)));
+        assert_eq!(http_dns.len(), 1);
+        assert_eq!(http_dns[0].to_string(), "http.example.test");
+
+        let mut grpc_ips_mut = grpc_ips.clone();
+        grpc_ips_mut.clear();
+        let mut grpc_dns_mut = grpc_dns.clone();
+        grpc_dns_mut.clear();
+
+        let (grpc_ips_again, grpc_dns_again) = service.get_sans(ConnectionType::GRPC);
+        assert_eq!(grpc_ips_again.len(), 1);
+        assert_eq!(grpc_dns_again.len(), 1);
+
+        let _ = fs::remove_dir_all(&dir);
+    }
+}

crates/nxmesh-proto/Cargo.toml

@@ -25,3 +25,6 @@ client = []
 
 [build-dependencies]
 tonic-prost-build.workspace = true
+
+[dev-dependencies]
+tokio-test.workspace = true

crates/nxmesh-proto/src/auth/ssh_auth.rs

@@ -38,12 +38,162 @@ impl SshAuthInterceptor {
     async fn authenticate(&self, req: Request<()>) -> Result<Request<()>, Status> {
         let certs = req.peer_certs().ok_or(Status::unauthenticated("No cert"))?;
 
-        let is_authorized = self.certificate_provider.is_authorized(&certs).await?;
+        self.validate_certs(&certs).await?;
+        Ok(req)
+    }
+
+    async fn validate_certs(&self, certs: &Arc<Vec<CertificateDer<'_>>>) -> Result<(), Status> {
+        let is_authorized = self.certificate_provider.is_authorized(certs).await?;
 
         if is_authorized {
-            Ok(req)
+            Ok(())
         } else {
             Err(Status::permission_denied("Blocked"))
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::sync::{
+        Arc, Mutex,
+        atomic::{AtomicUsize, Ordering},
+    };
+
+    use tonic::{Request, Status, transport::CertificateDer};
+    use tonic_async_interceptor::AsyncInterceptor;
+
+    use super::{CertificateValidationProvider, SshAuthInterceptor, create_ssh_auth_interceptor};
+
+    #[derive(Clone, Copy)]
+    enum ProviderMode {
+        Allow,
+        Deny,
+        Error,
+    }
+
+    struct TestCertificateProvider {
+        mode: ProviderMode,
+        calls: Arc<AtomicUsize>,
+        cert_count_seen: Arc<Mutex<Option<usize>>>,
+    }
+
+    #[tonic::async_trait]
+    impl CertificateValidationProvider for TestCertificateProvider {
+        async fn is_authorized(
+            &self,
+            certs: &Arc<Vec<CertificateDer<'_>>>,
+        ) -> Result<bool, Status> {
+            self.calls.fetch_add(1, Ordering::SeqCst);
+
+            let lock = self.cert_count_seen.lock();
+            assert!(lock.is_ok());
+            let mut lock = lock.unwrap_or_else(|_| unreachable!());
+            *lock = Some(certs.len());
+
+            match self.mode {
+                ProviderMode::Allow => Ok(true),
+                ProviderMode::Deny => Ok(false),
+                ProviderMode::Error => Err(Status::internal("provider failed")),
+            }
+        }
+    }
+
+    fn build_provider(
+        mode: ProviderMode,
+    ) -> (
+        Arc<TestCertificateProvider>,
+        Arc<AtomicUsize>,
+        Arc<Mutex<Option<usize>>>,
+    ) {
+        let calls = Arc::new(AtomicUsize::new(0));
+        let cert_count_seen = Arc::new(Mutex::new(None));
+        let provider = Arc::new(TestCertificateProvider {
+            mode,
+            calls: calls.clone(),
+            cert_count_seen: cert_count_seen.clone(),
+        });
+        (provider, calls, cert_count_seen)
+    }
+
+    fn sample_certs() -> Arc<Vec<CertificateDer<'static>>> {
+        Arc::new(vec![
+            CertificateDer::from(vec![1, 2, 3]),
+            CertificateDer::from(vec![4, 5, 6]),
+        ])
+    }
+
+    #[test]
+    fn create_ssh_auth_interceptor_builds_layer() {
+        let (provider, _, _) = build_provider(ProviderMode::Allow);
+        let _ = create_ssh_auth_interceptor(provider);
+    }
+
+    #[test]
+    fn authenticate_fails_when_no_peer_certificates_exist() {
+        let (provider, calls, _) = build_provider(ProviderMode::Allow);
+        let interceptor = SshAuthInterceptor::new(provider);
+
+        let result = tokio_test::block_on(interceptor.authenticate(Request::new(())));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Unauthenticated);
+        assert_eq!(calls.load(Ordering::SeqCst), 0);
+    }
+
+    #[test]
+    fn validate_certs_succeeds_when_provider_allows() {
+        let (provider, calls, cert_count_seen) = build_provider(ProviderMode::Allow);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_ok());
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+
+        let seen = cert_count_seen.lock();
+        assert!(seen.is_ok());
+        let seen = seen.unwrap_or_else(|_| unreachable!());
+        assert_eq!(*seen, Some(2));
+    }
+
+    #[test]
+    fn validate_certs_returns_permission_denied_when_provider_denies() {
+        let (provider, calls, _) = build_provider(ProviderMode::Deny);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::PermissionDenied);
+        assert_eq!(err.message(), "Blocked");
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn validate_certs_propagates_provider_errors() {
+        let (provider, calls, _) = build_provider(ProviderMode::Error);
+        let interceptor = SshAuthInterceptor::new(provider);
+        let certs = sample_certs();
+
+        let result = tokio_test::block_on(interceptor.validate_certs(&certs));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Internal);
+        assert_eq!(err.message(), "provider failed");
+        assert_eq!(calls.load(Ordering::SeqCst), 1);
+    }
+
+    #[test]
+    fn async_interceptor_call_delegates_to_authenticate() {
+        let (provider, calls, _) = build_provider(ProviderMode::Allow);
+        let mut interceptor = SshAuthInterceptor::new(provider);
+
+        let result = tokio_test::block_on(interceptor.call(Request::new(())));
+        assert!(result.is_err());
+        let err = result.err().unwrap_or_else(|| unreachable!());
+        assert_eq!(err.code(), tonic::Code::Unauthenticated);
+        assert_eq!(calls.load(Ordering::SeqCst), 0);
+    }
+}

crates/nxmesh-proto/src/lib.rs

@@ -11,3 +11,114 @@ pub mod agent {
 pub use agent::*;
 pub mod auth;
 pub use tonic_async_interceptor::*;
+
+#[cfg(test)]
+mod tests {
+    use prost::Message;
+
+    use crate::agent::{
+        AgentMessage, ConfigApplyStatus, ConfigStatus, DeploymentMode, Error, MasterMessage,
+        MetricType, RegistrationRequest, agent_message, master_message,
+    };
+
+    #[test]
+    fn agent_message_round_trip_with_registration_payload() {
+        let msg = AgentMessage {
+            agent_id: "agent-1".to_string(),
+            timestamp: 123,
+            payload: Some(agent_message::Payload::Registration(RegistrationRequest {
+                hostname: "node-1".to_string(),
+                ip_address: "127.0.0.1".to_string(),
+                version: "1.0.0".to_string(),
+                capabilities: vec!["reload".to_string(), "metrics".to_string()],
+                labels: std::collections::HashMap::from([
+                    ("region".to_string(), "dev".to_string()),
+                    ("tier".to_string(), "edge".to_string()),
+                ]),
+                deployment_mode: DeploymentMode::Standalone as i32,
+            })),
+        };
+
+        let encoded = msg.encode_to_vec();
+        let decoded = AgentMessage::decode(encoded.as_slice());
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or_else(|_| unreachable!());
+
+        assert_eq!(decoded.agent_id, "agent-1");
+        assert_eq!(decoded.timestamp, 123);
+
+        match decoded.payload {
+            Some(agent_message::Payload::Registration(payload)) => {
+                assert_eq!(payload.hostname, "node-1");
+                assert_eq!(payload.ip_address, "127.0.0.1");
+                assert_eq!(payload.version, "1.0.0");
+                assert_eq!(payload.capabilities.len(), 2);
+                assert_eq!(payload.labels.get("region"), Some(&"dev".to_string()));
+                assert_eq!(payload.deployment_mode, DeploymentMode::Standalone as i32);
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn master_message_round_trip_with_error_payload() {
+        let msg = MasterMessage {
+            timestamp: 999,
+            payload: Some(master_message::Payload::Error(Error {
+                code: "E_CONFIG_INVALID".to_string(),
+                message: "invalid config".to_string(),
+                details: std::collections::HashMap::from([
+                    ("file".to_string(), "site.conf".to_string()),
+                    ("line".to_string(), "42".to_string()),
+                ]),
+            })),
+        };
+
+        let encoded = msg.encode_to_vec();
+        let decoded = MasterMessage::decode(encoded.as_slice());
+        assert!(decoded.is_ok());
+        let decoded = decoded.unwrap_or_else(|_| unreachable!());
+
+        assert_eq!(decoded.timestamp, 999);
+        match decoded.payload {
+            Some(master_message::Payload::Error(err)) => {
+                assert_eq!(err.code, "E_CONFIG_INVALID");
+                assert_eq!(err.message, "invalid config");
+                assert_eq!(err.details.get("line"), Some(&"42".to_string()));
+            }
+            _ => unreachable!(),
+        }
+    }
+
+    #[test]
+    fn enum_integer_mappings_are_stable() {
+        assert_eq!(DeploymentMode::Unspecified as i32, 0);
+        assert_eq!(DeploymentMode::DockerSidecar as i32, 1);
+        assert_eq!(DeploymentMode::KubernetesSidecar as i32, 2);
+        assert_eq!(DeploymentMode::Standalone as i32, 3);
+
+        assert_eq!(ConfigApplyStatus::Unspecified as i32, 0);
+        assert_eq!(ConfigApplyStatus::Pending as i32, 1);
+        assert_eq!(ConfigApplyStatus::Validating as i32, 2);
+        assert_eq!(ConfigApplyStatus::Applying as i32, 3);
+        assert_eq!(ConfigApplyStatus::Success as i32, 4);
+        assert_eq!(ConfigApplyStatus::Failed as i32, 5);
+        assert_eq!(ConfigApplyStatus::RolledBack as i32, 6);
+
+        assert_eq!(MetricType::Unspecified as i32, 0);
+        assert_eq!(MetricType::Gauge as i32, 1);
+        assert_eq!(MetricType::Counter as i32, 2);
+        assert_eq!(MetricType::Histogram as i32, 3);
+    }
+
+    #[test]
+    fn config_status_defaults_are_proto3_zero_values() {
+        let status = ConfigStatus::default();
+
+        assert_eq!(status.config_id, "");
+        assert_eq!(status.version, 0);
+        assert_eq!(status.status, ConfigApplyStatus::Unspecified as i32);
+        assert_eq!(status.error_message, "");
+        assert_eq!(status.applied_at, 0);
+    }
+}