feat: publish standalone worker

Separate worker packaging and service lifecycle from the control plane.

app/models/rkn_domain_test.go

@@ -0,0 +1,90 @@
+package models_test
+
+import (
+	"sort"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"rsgit.ru/rsmon/rsmon/app/models"
+)
+
+func TestReplaceRknDomains_BulkAndDedup(t *testing.T) {
+	models.Drop()
+	models.Migrate()
+
+	input := []string{
+		"Foo.example",
+		"foo.example", // dup after lowercasing
+		"  bar.example ",
+		"",
+		"baz.example",
+		"qux.example",
+		"qux.example", // dup within input
+	}
+	require.NoError(t, models.ReplaceRknDomains(input))
+
+	got := []string{}
+	assert.NoError(t, models.DB().Model(&models.RknDomain{}).Order("domain").Pluck("domain", &got).Error)
+
+	want := []string{"bar.example", "baz.example", "foo.example", "qux.example"}
+	sort.Strings(want)
+	assert.Equal(t, want, got)
+}
+
+func TestReplaceRknDomains_ReplacesExisting(t *testing.T) {
+	models.Drop()
+	models.Migrate()
+
+	require.NoError(t, models.ReplaceRknDomains([]string{"old1.example", "old2.example"}))
+
+	var n int64
+	assert.NoError(t, models.DB().Model(&models.RknDomain{}).Count(&n).Error)
+	assert.Equal(t, int64(2), n)
+
+	// Second call wipes and replaces — no overlap with old set.
+	require.NoError(t, models.ReplaceRknDomains([]string{"new1.example", "new2.example", "new3.example"}))
+	assert.NoError(t, models.DB().Model(&models.RknDomain{}).Count(&n).Error)
+	assert.Equal(t, int64(3), n)
+
+	var domains []string
+	assert.NoError(t, models.DB().Model(&models.RknDomain{}).Order("domain").Pluck("domain", &domains).Error)
+	assert.Equal(t, []string{"new1.example", "new2.example", "new3.example"}, domains)
+}
+
+func TestIsRknDomainBlocked(t *testing.T) {
+	models.Drop()
+	models.Migrate()
+
+	input := []string{
+		"example.com",
+		"foo.bar",
+		"sub.test",
+	}
+	require.NoError(t, models.ReplaceRknDomains(input))
+
+	cases := []struct {
+		host string
+		want bool
+	}{
+		{"example.com", true},             // exact
+		{"EXAMPLE.com", true},             // case insensitive (caller lowercases)
+		{"www.example.com", true},         // stored has apex; query apex → root-domain match
+		{"deep.nested.example.com", true}, // suffix match via LIKE '%.X'
+		{"foo.bar", true},
+		{"sub.test", true},
+		{"a.sub.test", true},
+		{"unrelated.org", false},
+		{"two.labels", false}, // 2-label input not in list → must not collapse to "labels"
+		{"", false},
+	}
+
+	for _, c := range cases {
+		t.Run(c.host, func(t *testing.T) {
+			got, err := models.IsRknDomainBlocked(c.host)
+			require.NoError(t, err)
+			assert.Equal(t, c.want, got)
+		})
+	}
+}