feat(v2): complete v2 reimplementation

tests/unit/test_ssh_source_config.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+import pytest
+from backup_tool.ssh_source import SSHSourcePublicConfig
+from pydantic import ValidationError
+
+VALID_CONFIG = {
+    "hostname": "backup.example.test",
+    "port": 22,
+    "username": "backup",
+    "host_key": "ssh-ed25519 AQID",
+    "root": "/",
+}
+
+
+def test_ssh_source_config_is_closed_and_canonical() -> None:
+    config = SSHSourcePublicConfig.model_validate(VALID_CONFIG)
+
+    assert config.model_dump() == VALID_CONFIG
+
+
+@pytest.mark.parametrize(
+    "field,value",
+    [
+        ("hostname", "backup user@example.test"),
+        ("hostname", "ssh://backup.example.test"),
+        ("port", 0),
+        ("port", 65536),
+        ("username", "backup user"),
+        ("username", "backup/root"),
+        ("host_key", "ssh-ed25519 not-base64!"),
+        ("host_key", "ssh-rsa AQID"),
+        ("root", "/data"),
+    ],
+)
+def test_ssh_source_config_rejects_invalid_public_values(field: str, value: object) -> None:
+    invalid = {**VALID_CONFIG, field: value}
+
+    with pytest.raises(ValidationError):
+        SSHSourcePublicConfig.model_validate(invalid)
+
+
+def test_ssh_source_config_rejects_non_public_connection_options() -> None:
+    with pytest.raises(ValidationError):
+        SSHSourcePublicConfig.model_validate({**VALID_CONFIG, "password": "not-allowed"})
+
+    with pytest.raises(ValidationError):
+        SSHSourcePublicConfig.model_validate({**VALID_CONFIG, "remote_command": "not-allowed"})