platform: modularize api/gui, add docs-tests-web foundation, and refresh root config

selective-vpn-api/app/transport_policy_conflicts_test.go

@@ -0,0 +1,60 @@
+package app
+
+import "testing"
+
+func TestSplitTransportBlockingConflicts(t *testing.T) {
+	conflicts := []TransportConflictRecord{
+		{
+			Key:      "domain:example.com",
+			Type:     "owner_switch",
+			Severity: "block",
+		},
+		{
+			Key:      "domain:dup.example",
+			Type:     "ownership",
+			Severity: "block",
+		},
+		{
+			Key:      "cidr:10.0.0.0/24",
+			Type:     "cidr_overlap",
+			Severity: "block",
+		},
+		{
+			Key:      "domain:warn.example",
+			Type:     "duplicate_intent",
+			Severity: "warn",
+		},
+	}
+
+	overridable, hard := splitTransportBlockingConflicts(conflicts)
+	if len(overridable) != 1 {
+		t.Fatalf("expected 1 overridable conflict, got %d (%#v)", len(overridable), overridable)
+	}
+	if overridable[0].Type != "owner_switch" {
+		t.Fatalf("unexpected overridable type: %q", overridable[0].Type)
+	}
+	if len(hard) != 2 {
+		t.Fatalf("expected 2 hard conflicts, got %d (%#v)", len(hard), hard)
+	}
+}
+
+func TestIsTransportConflictForceOverridable(t *testing.T) {
+	if !isTransportConflictForceOverridable(TransportConflictRecord{
+		Type:     "owner_switch",
+		Severity: "block",
+	}) {
+		t.Fatalf("owner_switch block must be overridable")
+	}
+	if isTransportConflictForceOverridable(TransportConflictRecord{
+		Type:     "ownership",
+		Severity: "block",
+	}) {
+		t.Fatalf("ownership block must not be overridable")
+	}
+	if isTransportConflictForceOverridable(TransportConflictRecord{
+		Type:     "owner_switch",
+		Severity: "warn",
+	}) {
+		t.Fatalf("owner_switch warn must not be overridable")
+	}
+}