Refactor ProxyWarden routing and settings flow

src-tauri/tests/subscription_tests.rs

@@ -2,6 +2,7 @@ use base64::{engine::general_purpose, Engine};
 use proxywarden_lib::models::redact_subscription_url;
 use proxywarden_lib::subscription::{
     self, parse_subscription_body, parse_user_info, SubscriptionFetchIdentity,
+    SubscriptionFetchPolicy,
 };
 use std::io::{Read, Write};
 use std::net::TcpListener;
@@ -91,6 +92,25 @@ fn rejects_invalid_or_non_http_subscription_url_before_network() {
     assert!(unsupported.message.contains("http or https"));
 }
 
+#[test]
+fn rejects_unsafe_local_subscription_urls_before_network() {
+    for url in [
+        "http://127.0.0.1:9/subscription",
+        "http://localhost/subscription",
+        "http://169.254.169.254/latest/meta-data",
+        "http://192.168.0.1/subscription",
+        "http://[::1]/subscription",
+    ] {
+        let error = subscription::fetch_subscription(url)
+            .expect_err("unsafe local URL should fail before request");
+        assert!(
+            error.message.contains("local, private"),
+            "unexpected error for {url}: {}",
+            error.message
+        );
+    }
+}
+
 #[test]
 fn fetch_subscription_sends_device_hwid_header_when_identity_is_set() {
     let listener = TcpListener::bind("127.0.0.1:0").expect("bind local test listener");
@@ -129,8 +149,14 @@ fn fetch_subscription_sends_device_hwid_header_when_identity_is_set() {
 
     let mut identity = SubscriptionFetchIdentity::with_device_hwid(Some("hwid-abc123"));
     identity.device_os_version = Some("Windows 11 Pro | 25H2 | build 26200.8655".to_string());
-    let cache = subscription::fetch_subscription_with_identity(&url, &identity)
-        .expect("fetch subscription through local test server");
+    let cache = subscription::fetch_subscription_with_identity_and_policy(
+        &url,
+        &identity,
+        SubscriptionFetchPolicy {
+            allow_unsafe_local_urls: true,
+        },
+    )
+    .expect("fetch subscription through local test server");
     let request = request_thread.join().expect("request thread");
 
     assert_eq!(cache.servers[0].tag, "nl-1");
@@ -151,7 +177,13 @@ fn redacts_subscription_url_for_display() {
     );
     assert_eq!(
         redact_subscription_url("vless://uuid@example.test"),
-        "vless://uuid@example.test/..."
+        "vless://example.test/..."
+    );
+    assert_eq!(
+        redact_subscription_url(
+            "https://user:password@sub.example.test:8443/path?token=secret#frag"
+        ),
+        "https://sub.example.test:8443/..."
     );
 }