test(server+java-sdk): 后台 loop 取消退出/listenTCP TLS 分支 + TlsSocketFactory 守卫与 mTLS——server 91.0%、Java SDK 96%

Author: cuihairu

internal/server/control_handler_test.go

@@ -1966,3 +1966,38 @@ func TestControlService_HandleRegisterSchemaDiffWarnings(t *testing.T) {
 		assert.Empty(t, warnings)
 	})
 }
+
+// 后台 loop 的 ctx 取消退出路径（此前 cleanupLoop 41.7% / pruneOldMetrics 71.4%）：
+// 预取消 ctx 后同步直调，两个 loop 应立即返回且不 panic。
+func TestControlService_BackgroundLoops_ExitOnCanceledContext(t *testing.T) {
+	t.Run("pruneOldMetrics returns on done", func(t *testing.T) {
+		svc := newTestControlService()
+		svc.Stop() // 预取消
+		done := make(chan struct{})
+		go func() {
+			svc.pruneOldMetrics()
+			close(done)
+		}()
+		select {
+		case <-done:
+		case <-time.After(2 * time.Second):
+			t.Fatal("pruneOldMetrics must exit on canceled context")
+		}
+	})
+
+	t.Run("cleanupLoop returns on done and prunes expired sessions", func(t *testing.T) {
+		loader := &mockAgentSessionLoader{}
+		svc := newTestControlServiceWithLoader(loader)
+		svc.Stop()
+		done := make(chan struct{})
+		go func() {
+			svc.cleanupLoop()
+			close(done)
+		}()
+		select {
+		case <-done:
+		case <-time.After(2 * time.Second):
+			t.Fatal("cleanupLoop must exit on canceled context")
+		}
+	})
+}

internal/server/tcp_listener_test.go

@@ -2,8 +2,16 @@ package server
 
 import (
 	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
 	"log/slog"
+	"math/big"
 	"net"
+	"os"
+	"path/filepath"
 	"testing"
 	"time"
 
@@ -936,3 +944,64 @@ func (c *countingClusterHooks) OnAgentHeartbeat(ctx context.Context, agentID str
 	c.heartbeats++
 }
 func (c *countingClusterHooks) OnAgentDisconnected(ctx context.Context, agentID string) {}
+
+// listenTCP TLS 分支：cert/key 正常加载、坏路径/坏 CA 报错（此前 63.2%）。
+func TestListenTCP_TLSBranches(t *testing.T) {
+	dir := t.TempDir()
+	certPath := filepath.Join(dir, "cert.pem")
+	keyPath := filepath.Join(dir, "key.pem")
+	caPath := filepath.Join(dir, "ca.pem")
+
+	// 生成自签证书（crypto/x509 标准库，无外部依赖）
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	tmpl := x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject:      pkix.Name{CommonName: "localhost"},
+		NotBefore:    time.Now().Add(-time.Hour),
+		NotAfter:     time.Now().Add(time.Hour),
+		IsCA:         true,
+		KeyUsage:     x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
+		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, &tmpl, &tmpl, &priv.PublicKey, priv)
+	require.NoError(t, err)
+	certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	keyPEM := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(priv)})
+	require.NoError(t, os.WriteFile(certPath, certPEM, 0o600))
+	require.NoError(t, os.WriteFile(keyPath, keyPEM, 0o600))
+	require.NoError(t, os.WriteFile(caPath, certPEM, 0o600))
+
+	// cert+key+CA 齐备：TLS listener 建立成功
+	ln, err := listenTCP(&TCPListenerConfig{
+		Address:  "127.0.0.1:0",
+		Insecure: false,
+		CertFile: certPath, KeyFile: keyPath, CAFile: caPath,
+	})
+	require.NoError(t, err)
+	ln.Close()
+
+	// 坏证书路径 → load server certificate 错误
+	_, err = listenTCP(&TCPListenerConfig{
+		Address: "127.0.0.1:0", Insecure: false,
+		CertFile: filepath.Join(dir, "missing.pem"), KeyFile: keyPath,
+	})
+	require.ErrorContains(t, err, "load server certificate")
+
+	// 坏 CA 文件路径 → read CA file 错误
+	_, err = listenTCP(&TCPListenerConfig{
+		Address: "127.0.0.1:0", Insecure: false,
+		CertFile: certPath, KeyFile: keyPath,
+		CAFile: filepath.Join(dir, "missing-ca.pem"),
+	})
+	require.ErrorContains(t, err, "read CA file")
+
+	// 非 PEM 内容 → append CA certificate 错误
+	badCA := filepath.Join(dir, "bad-ca.pem")
+	require.NoError(t, os.WriteFile(badCA, []byte("not a pem"), 0o600))
+	_, err = listenTCP(&TCPListenerConfig{
+		Address: "127.0.0.1:0", Insecure: false,
+		CertFile: certPath, KeyFile: keyPath, CAFile: badCA,
+	})
+	require.ErrorContains(t, err, "append CA certificate")
+}

sdks/java/src/test/java/io/github/cuihairu/croupier/sdk/transport/TlsTransportTest.java

@@ -123,4 +123,45 @@ void handshakeAndEndpointVerification() throws Exception {
         serverSocket.close();
         pool.shutdownNow();
     }
+    @Test
+    @Timeout(60)
+    @DisplayName("TlsSocketFactory 守卫分支：缺 caFile / 坏 PEM / mTLS 上下文构建")
+    void factoryGuardsAndMutualTls() throws Exception {
+        Path dir = Files.createTempDirectory("croupier-tls-mtls");
+        Path cert = generateCert(dir, "srv", null, null);
+
+        // 缺 caFile → IOException
+        assertThrows(java.io.IOException.class,
+            () -> TlsSocketFactory.create(null, null, null));
+        assertThrows(java.io.IOException.class,
+            () -> TlsSocketFactory.create("  ", null, null));
+
+        // 坏 CA 内容（非 PEM）→ 无证书可解析
+        Path badCa = dir.resolve("bad-ca.pem");
+        Files.writeString(badCa, "not a pem document");
+        assertThrows(Exception.class, () -> TlsSocketFactory.create(badCa.toString(), null, null));
+
+        // mTLS：程序化生成客户端 RSA 私钥（PKCS#8 PEM）+ 复用服务端证书作链
+        java.security.KeyPairGenerator kpg = java.security.KeyPairGenerator.getInstance("RSA");
+        kpg.initialize(2048);
+        java.security.KeyPair kp = kpg.generateKeyPair();
+        String pkcs8Pem = "-----BEGIN PRIVATE KEY-----\n"
+            + java.util.Base64.getMimeEncoder().encodeToString(kp.getPrivate().getEncoded())
+            + "\n-----END PRIVATE KEY-----\n";
+        Path clientKey = dir.resolve("client.key");
+        Files.writeString(clientKey, pkcs8Pem);
+
+        // certFile 存在但 keyFile 为空 → 不启用 mTLS，仅 CA 校验
+        assertNotNull(TlsSocketFactory.create(cert.toString(), cert.toString(), null));
+
+        // keyFile 内容坏 → 私钥解析失败
+        Path badKey = dir.resolve("bad.key");
+        Files.writeString(badKey, "-----BEGIN PRIVATE KEY-----\nbm90IGEga2V5\n-----END PRIVATE KEY-----\n");
+        assertThrows(Exception.class,
+            () -> TlsSocketFactory.create(cert.toString(), cert.toString(), badKey.toString()));
+
+        // 完整 mTLS 上下文构建成功
+        SSLSocketFactory mtlsFactory = TlsSocketFactory.create(cert.toString(), cert.toString(), clientKey.toString());
+        assertNotNull(mtlsFactory);
+    }
 }