fix: renforcer limites TLS, timeouts socket et validation config

Co-authored-by: aider (openrouter/openai/gpt-5.3-codex) <aider@aider.chat>

internal/config/loader.go

@@ -38,7 +38,7 @@ func (l *LoaderImpl) Load() (api.AppConfig, error) {
 	fileConfig, err := l.loadFromFile(path)
 	if err == nil {
 		config = mergeConfigs(config, fileConfig)
-	} else if !( !explicit && errors.Is(err, os.ErrNotExist)) {
+	} else if !(!explicit && errors.Is(err, os.ErrNotExist)) {
 		return config, fmt.Errorf("failed to load config file: %w", err)
 	}
 
@@ -115,6 +115,7 @@ func parsePorts(s string) []uint16 {
 
 	parts := strings.Split(s, ",")
 	ports := make([]uint16, 0, len(parts))
+	seen := make(map[uint16]struct{}, len(parts))
 
 	for _, part := range parts {
 		part = strings.TrimSpace(part)
@@ -123,9 +124,19 @@ func parsePorts(s string) []uint16 {
 		}
 
 		port, err := strconv.ParseUint(part, 10, 16)
-		if err == nil {
-			ports = append(ports, uint16(port))
+		if err != nil {
+			continue
 		}
+
+		p := uint16(port)
+		if p == 0 {
+			continue
+		}
+		if _, exists := seen[p]; exists {
+			continue
+		}
+		seen[p] = struct{}{}
+		ports = append(ports, p)
 	}
 
 	return ports
@@ -164,19 +175,53 @@ func mergeConfigs(base, override api.AppConfig) api.AppConfig {
 
 // validate checks if the configuration is valid
 func (l *LoaderImpl) validate(config api.AppConfig) error {
-	if config.Core.Interface == "" {
+	if strings.TrimSpace(config.Core.Interface) == "" {
 		return fmt.Errorf("interface cannot be empty")
 	}
 
 	if len(config.Core.ListenPorts) == 0 {
 		return fmt.Errorf("at least one listen port is required")
 	}
+	for _, p := range config.Core.ListenPorts {
+		if p == 0 {
+			return fmt.Errorf("listen port 0 is invalid")
+		}
+	}
+
+	if config.Core.FlowTimeoutSec <= 0 || config.Core.FlowTimeoutSec > 300 {
+		return fmt.Errorf("flow_timeout_sec must be between 1 and 300")
+	}
+
+	if config.Core.PacketBufferSize <= 0 || config.Core.PacketBufferSize > 1_000_000 {
+		return fmt.Errorf("packet_buffer_size must be between 1 and 1000000")
+	}
+
+	allowedTypes := map[string]struct{}{
+		"stdout":      {},
+		"file":        {},
+		"unix_socket": {},
+	}
 
 	// Validate outputs
 	for i, output := range config.Outputs {
-		if output.Type == "" {
+		outputType := strings.TrimSpace(output.Type)
+		if outputType == "" {
 			return fmt.Errorf("output[%d]: type cannot be empty", i)
 		}
+		if _, ok := allowedTypes[outputType]; !ok {
+			return fmt.Errorf("output[%d]: unknown type %q", i, outputType)
+		}
+
+		switch outputType {
+		case "file":
+			if strings.TrimSpace(output.Params["path"]) == "" {
+				return fmt.Errorf("output[%d]: file output requires non-empty path", i)
+			}
+		case "unix_socket":
+			if strings.TrimSpace(output.Params["socket_path"]) == "" {
+				return fmt.Errorf("output[%d]: unix_socket output requires non-empty socket_path", i)
+			}
+		}
 	}
 
 	return nil