Reconcile endpoint-qualified firewall policy

tests/reconciler.php

@@ -0,0 +1,103 @@
+<?php
+
+// SPDX-License-Identifier: BSD-2-Clause
+// SPDX-FileCopyrightText: 2026 ms2k
+
+namespace OPNsense\NordVPN;
+
+class Settings
+{
+    public object $general;
+    public object $managed;
+
+    public function __construct()
+    {
+        $this->general = (object)['countries' => ''];
+        $this->managed = (object)[
+            'server_country' => 'NL',
+            'server_hostname' => 'nl.example.invalid',
+        ];
+    }
+}
+
+$root = dirname(__DIR__);
+foreach (['NordApi', 'EndpointStore', 'StatusStore', 'SystemRunner', 'TunnelHealth', 'ManagedConfiguration', 'Reconciler'] as $class) {
+    require_once $root . '/src/opnsense/mvc/app/library/OPNsense/NordVPN/' . $class . '.php';
+}
+
+class TestConfiguration extends ManagedConfiguration
+{
+    private Settings $testSettings;
+
+    public function __construct()
+    {
+        $this->testSettings = new Settings();
+    }
+
+    public function settings(): Settings
+    {
+        return $this->testSettings;
+    }
+
+    public function interfaceName(): ?string
+    {
+        return 'wg0';
+    }
+}
+
+class AvailableHealth extends TunnelHealth
+{
+    public function __construct()
+    {
+    }
+
+    public function check(string $interface): array
+    {
+        return ['available' => true, 'last_handshake' => 1000];
+    }
+}
+
+class FailOnceRunner extends SystemRunner
+{
+    public int $firewallCalls = 0;
+
+    public function applyFirewall(): void
+    {
+        $this->firewallCalls++;
+        if ($this->firewallCalls === 1) {
+            throw new \RuntimeException('Synthetic firewall failure.');
+        }
+    }
+}
+
+$path = sys_get_temp_dir() . '/nordvpn-retry-' . bin2hex(random_bytes(8)) . '.json';
+$status = new StatusStore($path);
+$runner = new FailOnceRunner();
+$reconciler = new Reconciler(
+    new NordApi(static fn() => []),
+    new TestConfiguration(),
+    new AvailableHealth(),
+    $status,
+    $runner
+);
+
+try {
+    $reconciler->run();
+    throw new \RuntimeException('The first firewall failure was not reported.');
+} catch (\RuntimeException $exception) {
+    if ($exception->getMessage() !== 'Synthetic firewall failure.') {
+        throw $exception;
+    }
+}
+
+if (empty($status->read()['firewall_pending'])) {
+    throw new \RuntimeException('The failed firewall apply was not retained as pending.');
+}
+
+$reconciler->run();
+if ($runner->firewallCalls !== 2 || !empty($status->read()['firewall_pending'])) {
+    throw new \RuntimeException('The pending firewall apply was not completed on retry.');
+}
+
+unlink($path);
+echo "ok - reconciliation retries a failed firewall apply\n";