VoxIP Kiosk OS 1.0.0: Raspberry Pi kiosk with web management

Chromium kiosk without a desktop for the Raspberry Pi 3, a Flask web
interface on port 8080 (kiosk, system and network management), a
restricted root helper, network changes with automatic rollback, a
healthcheck timer, install/update/uninstall scripts and a pi-gen image
build.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_validation.py

@@ -0,0 +1,95 @@
+import pytest
+
+from voxip_kiosk import validation as v
+
+
+@pytest.mark.parametrize("url", [
+    "https://schermen-ijsselflat.voxip.nl",
+    "https://portal.example.nl/display/ab-flat?token=abc123",
+    "https://10.0.0.5:8443/scherm",
+    "  https://example.org/  ",
+])
+def test_kiosk_url_accepts_https(url):
+    assert v.kiosk_url(url) == url.strip()
+
+
+@pytest.mark.parametrize("url, fragment", [
+    ("http://example.org", "HTTPS"),
+    ("ftp://example.org", "HTTPS"),
+    ("javascript:alert(1)", "HTTPS"),
+    ("file:///etc/passwd", "HTTPS"),
+    ("https://", "hostnaam"),
+    ("https://user:pw@example.org", "wachtwoord"),
+    ("https://exa mple.org", "spaties"),
+    ("https://example.org/\nX", "stuurtekens"),
+    ("https://exa_mple.org", "hostnaam"),
+    ("", "Vul"),
+    ("https://example.org/" + "a" * 2100, "lang"),
+])
+def test_kiosk_url_rejects(url, fragment):
+    with pytest.raises(v.ValidationError, match=fragment):
+        v.kiosk_url(url)
+
+
+def test_mask_url_hides_tokens_only():
+    masked = v.mask_url("https://portal.example.nl/display/ab?token=abcdefghijkl1234&theme=dark")
+    assert "abcdefghijkl" not in masked
+    assert "token=…1234" in masked
+    assert "theme=dark" in masked
+    assert v.mask_url("https://example.org/x") == "https://example.org/x"
+    assert "secret" not in v.mask_url("https://e.org/?key=secret")
+
+
+@pytest.mark.parametrize("name, ok", [
+    ("kiosk", True), ("Hal-BG", True), ("a", True), ("-bad", False), ("bad-", False),
+    ("with space", False), ("x" * 64, False), ("localhost", False), ("kiosk.local", False), ("", False),
+])
+def test_hostname(name, ok):
+    if ok:
+        assert v.hostname(name) == name.lower()
+    else:
+        with pytest.raises(v.ValidationError):
+            v.hostname(name)
+
+
+def test_resolution():
+    assert v.resolution("auto") == "auto"
+    assert v.resolution("1920x1080") == "1920x1080"
+    assert v.resolution("1280X720@60") == "1280x720@60"
+    assert v.parse_resolution("1920x1080@59.94") == ("1920x1080", "59.94")
+    assert v.parse_resolution("auto") is None
+    for bad in ("1920", "99999x1", "1920x1080@", "big"):
+        with pytest.raises(v.ValidationError):
+            v.resolution(bad)
+
+
+def test_ip_helpers():
+    assert v.ipv4_interface("192.168.1.50/24") == "192.168.1.50/24"
+    with pytest.raises(v.ValidationError):
+        v.ipv4_interface("192.168.1.50")
+    with pytest.raises(v.ValidationError, match="netwerk- of broadcast"):
+        v.ipv4_interface("192.168.1.0/24")
+    with pytest.raises(v.ValidationError):
+        v.ipv4_interface("192.168.1.300/24")
+    assert v.dns_servers("1.1.1.1, 9.9.9.9;2606:4700:4700::1111") == ["1.1.1.1", "9.9.9.9", "2606:4700:4700::1111"]
+    assert v.dns_servers("") == []
+    with pytest.raises(v.ValidationError):
+        v.dns_servers("1.1.1.1 2.2.2.2 3.3.3.3 4.4.4.4")
+    with pytest.raises(v.ValidationError):
+        v.dns_servers("dns.google")
+
+
+def test_wifi_values():
+    assert v.ssid("Kantoor 2.4GHz") == "Kantoor 2.4GHz"
+    with pytest.raises(v.ValidationError):
+        v.ssid("x" * 33)
+    with pytest.raises(v.ValidationError):
+        v.ssid("bad\nssid")
+    assert v.wifi_psk("geheim123") == "geheim123"
+    assert v.wifi_psk("a" * 64) == "a" * 64
+    for bad in ("kort", "x" * 64, "geheimé123"):
+        with pytest.raises(v.ValidationError):
+            v.wifi_psk(bad)
+    assert v.country_code("nl") == "NL"
+    with pytest.raises(v.ValidationError):
+        v.country_code("NLD")