Refactor UI assets and harden quality checks

tests/test_security_helpers.py

@@ -0,0 +1,43 @@
+from karldns.security import (
+    DashboardUnlockIdentity,
+    _dashboard_unlock_cookie_parts,
+    _strip_header_ip,
+    _trusted_proxy_candidate,
+)
+
+
+def test_dashboard_unlock_identity_payload_is_stable() -> None:
+    identity = DashboardUnlockIdentity("home.example.net", "manage-secret", "hash")
+
+    assert identity.payload(123, 3600) == b"home.example.net\x00manage-secret\x00hash\x00123\x003600"
+
+
+def test_trusted_proxy_candidate_matches_cidr_and_single_ip() -> None:
+    assert _trusted_proxy_candidate("10.10.0.1", "10.0.0.0/8") is True
+    assert _trusted_proxy_candidate("203.0.113.10", "203.0.113.10") is True
+
+
+def test_trusted_proxy_candidate_ignores_invalid_values() -> None:
+    assert _trusted_proxy_candidate("not-an-ip", "10.0.0.0/8") is False
+    assert _trusted_proxy_candidate("10.10.0.1", "not-a-network") is False
+
+
+def test_dashboard_unlock_cookie_parts_parse_v3_cookie() -> None:
+    parts = _dashboard_unlock_cookie_parts("v3:123:3600:signature")
+
+    assert parts is not None
+    assert parts.timestamp == 123
+    assert parts.max_age_seconds == 3600
+    assert parts.signature == "signature"
+
+
+def test_dashboard_unlock_cookie_parts_reject_invalid_cookie() -> None:
+    assert _dashboard_unlock_cookie_parts("v2:123:3600:signature") is None
+    assert _dashboard_unlock_cookie_parts("v3:not-int:3600:signature") is None
+
+
+def test_strip_header_ip_handles_common_proxy_formats() -> None:
+    assert _strip_header_ip('"203.0.113.10"') == "203.0.113.10"
+    assert _strip_header_ip("[2001:db8::10]:443") == "2001:db8::10"
+    assert _strip_header_ip("203.0.113.10:443") == "203.0.113.10"
+    assert _strip_header_ip("unknown") == ""