initial commit on Federted servers

internal/signals/signals_test.go

@@ -0,0 +1,31 @@
+package signals
+
+import (
+	"context"
+	"strings"
+	"testing"
+	"time"
+)
+
+// Review NET-02: mailbox credentials must never travel over a plaintext
+// socket unless the explicit development fixture flag is set.
+func TestPlaintextTransportRejected(t *testing.T) {
+	t.Setenv("INTEGRATIONS_ALLOW_INSECURE_IMAP", "")
+	if e := checkTransport(Mailbox{TLS: false}); e == nil {
+		t.Fatal("plaintext mailbox accepted without the development flag")
+	}
+	if e := checkTransport(Mailbox{TLS: true}); e != nil {
+		t.Fatalf("TLS mailbox rejected: %v", e)
+	}
+	// The guard runs before any dial, so Connect fails fast without network.
+	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	_, e := Connect(ctx, Mailbox{Host: "127.0.0.1", Port: 1, TLS: false})
+	if e == nil || !strings.Contains(e.Error(), "TLS is required") {
+		t.Fatalf("plaintext Connect was not refused up front: %v", e)
+	}
+	t.Setenv("INTEGRATIONS_ALLOW_INSECURE_IMAP", "1")
+	if e := checkTransport(Mailbox{TLS: false}); e != nil {
+		t.Fatalf("development fixture flag did not permit plaintext: %v", e)
+	}
+}