release: version 1.1.2 - Add error callback mechanism and comprehensive test suite

Features:
- Add ErrorCallback type for UNIX socket connection error reporting
- Add WithErrorCallback option for UnixSocketWriter configuration
- Add BuilderImpl.WithErrorCallback() for propagating callbacks
- Add consecutive failure tracking in processQueue

Testing (50+ new tests):
- Add integration tests for full pipeline (capture → tlsparse → fingerprint → output)
- Add tests for FileWriter.rotate() and Reopen() log rotation
- Add tests for cleanupExpiredFlows() and cleanupLoop() in TLS parser
- Add tests for extractSNIFromPayload() and extractJA4Hash() helpers
- Add tests for config load error paths (invalid YAML, permission denied)
- Add tests for capture.Run() error conditions
- Add tests for signal handling documentation

Documentation:
- Update architecture.yml with new fields (LogLevel, TLSClientHello extensions)
- Update architecture.yml with Close() methods for Capture and Parser interfaces
- Update RPM spec changelog

Cleanup:
- Remove empty internal/api/ directory

Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>

internal/config/loader_test.go

@@ -479,3 +479,265 @@ func TestLoad_ExplicitMissingConfig_Fails(t *testing.T) {
 		t.Fatal("Load() should fail with explicit missing config path")
 	}
 }
+
+// TestLoadFromFile_InvalidYAML tests error handling for malformed YAML
+func TestLoadFromFile_InvalidYAML(t *testing.T) {
+	tmpDir := t.TempDir()
+	badConfig := filepath.Join(tmpDir, "bad.yml")
+
+	// Write invalid YAML syntax
+	invalidYAML := `
+core:
+  interface: eth0
+  listen_ports: [443, 8443
+  bpf_filter: ""
+`
+	if err := os.WriteFile(badConfig, []byte(invalidYAML), 0600); err != nil {
+		t.Fatalf("WriteFile() error = %v", err)
+	}
+
+	loader := NewLoader(badConfig)
+	_, err := loader.Load()
+
+	if err == nil {
+		t.Error("Load() with invalid YAML should return error")
+	}
+	if !strings.Contains(err.Error(), "yaml") {
+		t.Errorf("Load() error = %v, should mention yaml", err)
+	}
+}
+
+// TestLoadFromFile_PermissionDenied tests error handling for permission errors
+func TestLoadFromFile_PermissionDenied(t *testing.T) {
+	if os.Getuid() == 0 {
+		t.Skip("Skipping permission test when running as root")
+	}
+
+	tmpDir := t.TempDir()
+	configPath := filepath.Join(tmpDir, "config.yml")
+
+	// Create config file
+	cfg := api.AppConfig{
+		Core: api.Config{
+			Interface:   "eth0",
+			ListenPorts: []uint16{443},
+		},
+	}
+	data := ToJSON(cfg)
+
+	if err := os.WriteFile(configPath, []byte(data), 0600); err != nil {
+		t.Fatalf("WriteFile() error = %v", err)
+	}
+
+	// Remove read permissions
+	if err := os.Chmod(configPath, 0000); err != nil {
+		t.Fatalf("Chmod() error = %v", err)
+	}
+	defer os.Chmod(configPath, 0600) // Restore for cleanup
+
+	loader := NewLoader(configPath)
+	_, err := loader.Load()
+
+	if err == nil {
+		t.Error("Load() with no read permission should return error")
+	}
+}
+
+// TestLoadFromEnv_InvalidValues tests handling of invalid environment variable values
+func TestLoadFromEnv_InvalidValues(t *testing.T) {
+	tests := []struct {
+		name      string
+		env       map[string]string
+		wantErr   bool
+		errContains string
+	}{
+		{
+			name: "invalid_flow_timeout",
+			env: map[string]string{
+				"JA4SENTINEL_FLOW_TIMEOUT": "not-a-number",
+			},
+			wantErr:   false, // Uses default value when invalid
+			errContains: "",
+		},
+		{
+			name: "invalid_packet_buffer_size",
+			env: map[string]string{
+				"JA4SENTINEL_PACKET_BUFFER_SIZE": "not-a-number",
+			},
+			wantErr:   false, // Uses default value when invalid
+			errContains: "",
+		},
+		{
+			name: "negative_flow_timeout",
+			env: map[string]string{
+				"JA4SENTINEL_FLOW_TIMEOUT": "-100",
+			},
+			wantErr:   false, // Uses default value when negative
+			errContains: "",
+		},
+		{
+			name: "flow_timeout_too_high",
+			env: map[string]string{
+				"JA4SENTINEL_FLOW_TIMEOUT": "1000000",
+			},
+			wantErr:   true, // Validation error
+			errContains: "flow_timeout_sec must be between",
+		},
+		{
+			name: "invalid_log_level",
+			env: map[string]string{
+				"JA4SENTINEL_LOG_LEVEL": "invalid-level",
+			},
+			wantErr:   true, // Validation error
+			errContains: "log_level must be one of",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Set environment variables
+			for key, value := range tt.env {
+				t.Setenv(key, value)
+			}
+
+			loader := NewLoader("")
+			cfg, err := loader.Load()
+
+			if (err != nil) != tt.wantErr {
+				t.Fatalf("Load() error = %v, wantErr %v", err, tt.wantErr)
+			}
+
+			if tt.wantErr && tt.errContains != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.errContains) {
+					t.Errorf("Load() error = %v, should contain %q", err, tt.errContains)
+				}
+			}
+
+			if !tt.wantErr {
+				// Verify defaults are used for invalid values
+				if tt.name == "invalid_flow_timeout" || tt.name == "negative_flow_timeout" {
+					if cfg.Core.FlowTimeoutSec != api.DefaultFlowTimeout {
+						t.Errorf("FlowTimeoutSec = %d, want default %d", cfg.Core.FlowTimeoutSec, api.DefaultFlowTimeout)
+					}
+				}
+				if tt.name == "invalid_packet_buffer_size" {
+					if cfg.Core.PacketBufferSize != api.DefaultPacketBuffer {
+						t.Errorf("PacketBufferSize = %d, want default %d", cfg.Core.PacketBufferSize, api.DefaultPacketBuffer)
+					}
+				}
+			}
+		})
+	}
+}
+
+// TestLoadFromEnv_AllValidValues tests that all valid environment variables are parsed correctly
+func TestLoadFromEnv_AllValidValues(t *testing.T) {
+	t.Setenv("JA4SENTINEL_INTERFACE", "lo")
+	t.Setenv("JA4SENTINEL_PORTS", "8443, 9443")
+	t.Setenv("JA4SENTINEL_BPF_FILTER", "tcp port 8443")
+	t.Setenv("JA4SENTINEL_FLOW_TIMEOUT", "60")
+	t.Setenv("JA4SENTINEL_PACKET_BUFFER_SIZE", "2000")
+	t.Setenv("JA4SENTINEL_LOG_LEVEL", "debug")
+
+	loader := NewLoader("")
+	cfg, err := loader.Load()
+
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+
+	if cfg.Core.Interface != "lo" {
+		t.Errorf("Interface = %q, want 'lo'", cfg.Core.Interface)
+	}
+	if len(cfg.Core.ListenPorts) != 2 || cfg.Core.ListenPorts[0] != 8443 {
+		t.Errorf("ListenPorts = %v, want [8443, 9443]", cfg.Core.ListenPorts)
+	}
+	if cfg.Core.BPFFilter != "tcp port 8443" {
+		t.Errorf("BPFFilter = %q, want 'tcp port 8443'", cfg.Core.BPFFilter)
+	}
+	if cfg.Core.FlowTimeoutSec != 60 {
+		t.Errorf("FlowTimeoutSec = %d, want 60", cfg.Core.FlowTimeoutSec)
+	}
+	if cfg.Core.PacketBufferSize != 2000 {
+		t.Errorf("PacketBufferSize = %d, want 2000", cfg.Core.PacketBufferSize)
+	}
+	if cfg.Core.LogLevel != "debug" {
+		t.Errorf("LogLevel = %q, want 'debug'", cfg.Core.LogLevel)
+	}
+}
+
+// TestValidate_WhitespaceOnlyInterface tests that whitespace-only interface is rejected
+// Note: validate() is internal, so we test through Load() with env override
+func TestValidate_WhitespaceOnlyInterface(t *testing.T) {
+	t.Setenv("JA4SENTINEL_INTERFACE", "   ")
+	t.Setenv("JA4SENTINEL_PORTS", "443")
+
+	loader := NewLoader("")
+	_, err := loader.Load()
+
+	if err == nil {
+		t.Error("Load() with whitespace-only interface should return error")
+	}
+}
+
+// TestMergeConfigs_EmptyBase tests merge with empty base config
+func TestMergeConfigs_EmptyBase(t *testing.T) {
+	base := api.AppConfig{}
+	override := api.AppConfig{
+		Core: api.Config{
+			Interface: "lo",
+		},
+	}
+
+	result := mergeConfigs(base, override)
+
+	if result.Core.Interface != "lo" {
+		t.Errorf("Merged Interface = %q, want 'lo'", result.Core.Interface)
+	}
+}
+
+// TestMergeConfigs_EmptyOverride tests merge with empty override config
+func TestMergeConfigs_EmptyOverride(t *testing.T) {
+	base := api.AppConfig{
+		Core: api.Config{
+			Interface: "eth0",
+		},
+	}
+	override := api.AppConfig{}
+
+	result := mergeConfigs(base, override)
+
+	if result.Core.Interface != "eth0" {
+		t.Errorf("Merged Interface = %q, want 'eth0'", result.Core.Interface)
+	}
+}
+
+// TestMergeConfigs_OutputMerge tests that outputs are properly merged
+func TestMergeConfigs_OutputMerge(t *testing.T) {
+	base := api.AppConfig{
+		Core: api.Config{
+			Interface: "eth0",
+		},
+		Outputs: []api.OutputConfig{
+			{Type: "stdout", Enabled: true},
+		},
+	}
+	override := api.AppConfig{
+		Core: api.Config{
+			ListenPorts: []uint16{8443},
+		},
+		Outputs: []api.OutputConfig{
+			{Type: "file", Enabled: true, Params: map[string]string{"path": "/tmp/test.log"}},
+		},
+	}
+
+	result := mergeConfigs(base, override)
+
+	// Override should replace base outputs
+	if len(result.Outputs) != 1 {
+		t.Errorf("Merged Outputs length = %d, want 1", len(result.Outputs))
+	}
+	if result.Outputs[0].Type != "file" {
+		t.Errorf("Merged Outputs[0].Type = %q, want 'file'", result.Outputs[0].Type)
+	}
+}