feat(worker): adopt canonical public URL

internal/installer/install_test.go

@@ -90,6 +90,131 @@ func TestValidateEnvironmentFileInputErrors(t *testing.T) {
 	}
 }
 
+// TestResolveInstallEnvPublicURLWins verifies the installer canonicalizes
+// the advertised origin: PUBLIC_URL is written and the legacy WORKER_URL
+// is dropped from the resolved env when both are present.
+func TestResolveInstallEnvPublicURLWins(t *testing.T) {
+	v, err := resolveInstallEnv(InstallOptions{}, "", map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"PUBLIC_URL":  "https://worker.example.com",
+		"WORKER_URL":  "http://legacy.example.com",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v["PUBLIC_URL"] != "https://worker.example.com" {
+		t.Fatalf("PUBLIC_URL not resolved: %+v", v)
+	}
+	if _, ok := v["WORKER_URL"]; ok {
+		t.Fatalf("legacy WORKER_URL must be dropped when PUBLIC_URL is set: %+v", v)
+	}
+}
+
+// TestResolveInstallEnvLegacyWorkerURLPassesThrough keeps the bounded
+// migration: an env file that only carries the legacy WORKER_URL still
+// resolves and is written unchanged so existing installs upgrade in place.
+func TestResolveInstallEnvLegacyWorkerURLPassesThrough(t *testing.T) {
+	v, err := resolveInstallEnv(InstallOptions{}, "", map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"WORKER_URL":  "https://legacy.example.com",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v["WORKER_URL"] != "https://legacy.example.com" {
+		t.Fatalf("legacy WORKER_URL not preserved: %+v", v)
+	}
+	if v["PUBLIC_URL"] != "" {
+		t.Fatalf("PUBLIC_URL must stay empty: %+v", v)
+	}
+}
+
+// TestResolveInstallEnvLegacyWorkerURLTolerant verifies the bounded
+// migration does not newly reject legacy shapes that previously
+// installed (a path-bearing WORKER_URL) while a path-bearing PUBLIC_URL
+// stays strict.
+func TestResolveInstallEnvLegacyWorkerURLTolerant(t *testing.T) {
+	v, err := resolveInstallEnv(InstallOptions{}, "", map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"WORKER_URL":  "https://legacy.example.com/web",
+	})
+	if err != nil {
+		t.Fatalf("legacy WORKER_URL with a path must keep installing: %v", err)
+	}
+	if v["WORKER_URL"] != "https://legacy.example.com/web" {
+		t.Fatalf("legacy WORKER_URL not preserved: %+v", v)
+	}
+
+	_, err = resolveInstallEnv(InstallOptions{}, "", map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"PUBLIC_URL":  "https://worker.example.com/web",
+	})
+	if err == nil {
+		t.Fatal("path-bearing canonical PUBLIC_URL must be rejected")
+	}
+}
+
+// TestResolveInstallEnvPublicURLFlagBeatsEnv verifies the --public-url
+// flag follows the installer precedence: the flag wins over the env file
+// and the legacy WORKER_URL is dropped when PUBLIC_URL is present.
+func TestResolveInstallEnvPublicURLFlagBeatsEnv(t *testing.T) {
+	v, err := resolveInstallEnv(InstallOptions{PublicURL: "https://flag.example.com"}, "", map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"PUBLIC_URL":  "https://file.example.com",
+		"WORKER_URL":  "https://legacy.example.com",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if v["PUBLIC_URL"] != "https://flag.example.com" {
+		t.Fatalf("--public-url flag must win: %+v", v)
+	}
+	if _, ok := v["WORKER_URL"]; ok {
+		t.Fatalf("legacy WORKER_URL must be dropped when PUBLIC_URL is set: %+v", v)
+	}
+}
+
+// TestResolveInstallEnvRejectsMalformedPublicURL verifies the installer
+// rejects an advertised origin that violates the plan's origin shape
+// (path, userinfo, and non-http(s) schemes).
+func TestResolveInstallEnvRejectsMalformedPublicURL(t *testing.T) {
+	for _, bad := range []string{
+		"https://worker.example.com/web",
+		"https://user:pass@worker.example.com",
+		"ftp://worker.example.com",
+		"worker.example.com",
+	} {
+		t.Run(bad, func(t *testing.T) {
+			_, err := resolveInstallEnv(InstallOptions{}, "", map[string]string{
+				"RSMON_URL":   "https://rsmon.ru",
+				"RSMON_TOKEN": "secret",
+				"PUBLIC_URL":  bad,
+			})
+			if err == nil {
+				t.Fatalf("PUBLIC_URL=%q accepted", bad)
+			}
+		})
+	}
+}
+
+// TestRenderEnvFileOrder includes the canonical PUBLIC_URL ordering.
+func TestRenderEnvFilePublicURLEmptyOmitted(t *testing.T) {
+	got := string(renderEnvFile(map[string]string{
+		"RSMON_URL":   "https://rsmon.ru",
+		"RSMON_TOKEN": "secret",
+		"PUBLIC_URL":  "",
+		"WORKER_URL":  "",
+	}))
+	if strings.Contains(got, "PUBLIC_URL=") || strings.Contains(got, "WORKER_URL=") {
+		t.Fatalf("empty public URL keys must be omitted: %q", got)
+	}
+}
+
 func TestEnvironment(t *testing.T) {
 	got := string(Environment("https://example.test", "secret"))
 	for _, want := range []string{"RSMON_URL=https://example.test\n", "RSMON_TOKEN=secret\n", "WORKER_HOST=127.0.0.1\n"} {