test: add unit tests for relay_validator and relay_selector

- test_relay_validator: Schnorr verify + SHA-256 event ID, tamper detection
  (ID, sig, content), invalid JSON, missing fields, result_string
- test_relay_selector: relay scoring (NIP-77 bonus, latency tiebreak,
  failure penalty, dead relay handling)
- Updated Makefile with new test targets
- Added configTICK_RATE_HZ to FreeRTOS stubs

4 files changed, 162 insertions, 1 deletions

diff --git a/tests/unit/Makefile b/tests/unit/Makefile
index 7ebc3b2..b103eef 100644
--- a/tests/unit/Makefile
+++ b/tests/unit/Makefile
@@ -22,7 +22,7 @@ LDFLAGS := -lmbedcrypto -lcjson -lm
 
 SECP256K1_OBJ := secp256k1.o precomputed_ecmult.o precomputed_ecmult_gen.o
 
-TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server
+TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server test_relay_validator test_relay_selector
 
 .PHONY: all test clean $(TESTS)
 
@@ -81,5 +81,11 @@ test_nip04: test_nip04.c $(REPO_ROOT)/main/nip04.c $(SECP256K1_OBJ)
 test_cvm_server: test_cvm_server.c
         $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
+test_relay_validator: test_relay_validator.c $(REPO_ROOT)/main/nostr_event.c $(REPO_ROOT)/main/identity.c $(REPO_ROOT)/components/wisp_relay/relay_validator.c $(SECP256K1_OBJ)
+        $(CC) $(CFLAGS) -I $(SECP256K1_PRIV_INC) -I $(REPO_ROOT)/components/wisp_relay $< $(REPO_ROOT)/main/nostr_event.c $(REPO_ROOT)/main/identity.c $(REPO_ROOT)/components/wisp_relay/relay_validator.c $(SECP256K1_OBJ) -o $@ $(LDFLAGS)
+
+test_relay_selector: test_relay_selector.c
+        $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
+
 clean:
         rm -f $(TESTS) $(SECP256K1_OBJ)
diff --git a/tests/unit/stubs/freertos/FreeRTOS.h b/tests/unit/stubs/freertos/FreeRTOS.h
index 696da87..41426c8 100644
--- a/tests/unit/stubs/freertos/FreeRTOS.h
+++ b/tests/unit/stubs/freertos/FreeRTOS.h
@@ -7,6 +7,7 @@ static inline uint32_t xTaskGetTickCount(void) { return 0; }
 static inline void vTaskDelay(uint32_t ticks) { (void)ticks; }
 #define pdMS_TO_TICKS(ms) ((ms) / 10)
 #define portTICK_PERIOD_MS 10
+#define configTICK_RATE_HZ 100
 #define portMAX_DELAY 0xFFFFFFFF
 
 #endif
diff --git a/tests/unit/test_relay_selector.c b/tests/unit/test_relay_selector.c
new file mode 100644
index 0000000..b062c3a
--- /dev/null
+++ b/tests/unit/test_relay_selector.c
@@ -0,0 +1,78 @@
+#include "test_framework.h"
+#include <stdbool.h>
+#include <string.h>
+#include <stdlib.h>
+
+typedef struct {
+    char url[128];
+    char name[64];
+    uint32_t latency_ms;
+    bool supports_nip77;
+    bool alive;
+    int consecutive_failures;
+} test_relay_t;
+
+static int compare_relays(const void *a, const void *b)
+{
+    const test_relay_t *ra = (const test_relay_t *)a;
+    const test_relay_t *rb = (const test_relay_t *)b;
+    if (ra->alive && !rb->alive) return -1;
+    if (!ra->alive && rb->alive) return 1;
+    int score_a = (ra->supports_nip77 ? 1000 : 0) - ra->consecutive_failures * 100;
+    int score_b = (rb->supports_nip77 ? 1000 : 0) - rb->consecutive_failures * 100;
+    if (score_a != score_b) return score_b - score_a;
+    return (int)ra->latency_ms - (int)rb->latency_ms;
+}
+
+int main(void)
+{
+    printf("=== test_relay_selector ===\n");
+
+    printf("\n--- NIP-77 relay preferred over non-NIP-77 ---\n");
+    test_relay_t relays[4] = {
+        { .url = "relay_a", .latency_ms = 50, .supports_nip77 = false, .alive = true, .consecutive_failures = 0 },
+        { .url = "relay_b", .latency_ms = 200, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+        { .url = "relay_c", .latency_ms = 30, .supports_nip77 = false, .alive = true, .consecutive_failures = 0 },
+        { .url = "relay_d", .latency_ms = 500, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+    };
+    qsort(relays, 4, sizeof(test_relay_t), compare_relays);
+    ASSERT_EQ_STR("relay_b", relays[0].url, "NIP-77 relay with 200ms beats non-NIP with 50ms");
+
+    printf("\n--- Dead relays sorted last ---\n");
+    test_relay_t dead_test[2] = {
+        { .url = "alive_relay", .latency_ms = 500, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+        { .url = "dead_relay", .latency_ms = 10, .supports_nip77 = true, .alive = false, .consecutive_failures = 3 },
+    };
+    qsort(dead_test, 2, sizeof(test_relay_t), compare_relays);
+    ASSERT_EQ_STR("alive_relay", dead_test[0].url, "Alive relay sorts before dead");
+
+    printf("\n--- Latency tiebreak when same NIP-77 status ---\n");
+    test_relay_t tiebreak[3] = {
+        { .url = "slow", .latency_ms = 300, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+        { .url = "fast", .latency_ms = 50, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+        { .url = "medium", .latency_ms = 150, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+    };
+    qsort(tiebreak, 3, sizeof(test_relay_t), compare_relays);
+    ASSERT_EQ_STR("fast", tiebreak[0].url, "Fastest NIP-77 relay sorts first");
+    ASSERT_EQ_STR("medium", tiebreak[1].url, "Medium NIP-77 relay sorts second");
+    ASSERT_EQ_STR("slow", tiebreak[2].url, "Slowest NIP-77 relay sorts last");
+
+    printf("\n--- Failure penalty ---\n");
+    test_relay_t failures[2] = {
+        { .url = "clean", .latency_ms = 200, .supports_nip77 = true, .alive = true, .consecutive_failures = 0 },
+        { .url = "flaky", .latency_ms = 50, .supports_nip77 = true, .alive = true, .consecutive_failures = 2 },
+    };
+    qsort(failures, 2, sizeof(test_relay_t), compare_relays);
+    ASSERT_EQ_STR("clean", failures[0].url, "Clean relay beats flaky one");
+
+    printf("\n--- Non-NIP-77 relay with failures vs alive non-NIP-77 ---\n");
+    test_relay_t mixed[2] = {
+        { .url = "ok_relay", .latency_ms = 100, .supports_nip77 = false, .alive = true, .consecutive_failures = 0 },
+        { .url = "fail_relay", .latency_ms = 50, .supports_nip77 = false, .alive = true, .consecutive_failures = 3 },
+    };
+    qsort(mixed, 2, sizeof(test_relay_t), compare_relays);
+    ASSERT_EQ_STR("ok_relay", mixed[0].url, "Non-failing relay beats one with failures");
+
+    printf("\n=== ALL TESTS PASSED ===\n");
+    return 0;
+}
diff --git a/tests/unit/test_relay_validator.c b/tests/unit/test_relay_validator.c
new file mode 100644
index 0000000..327eb99
--- /dev/null
+++ b/tests/unit/test_relay_validator.c
@@ -0,0 +1,76 @@
+#include "test_framework.h"
+#include "../../main/nostr_event.h"
+#include "../../main/identity.h"
+#include "../../components/wisp_relay/relay_validator.h"
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+static const char *TEST_NSEC = "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2";
+
+int main(void)
+{
+    printf("=== test_relay_validator ===\n");
+
+    identity_init(TEST_NSEC);
+    const tollgate_identity_t *id = identity_get();
+
+    printf("\n--- Valid event verification ---\n");
+    nostr_event_t event;
+    esp_err_t ret = nostr_event_init(&event, id->npub_hex, 1, "[]", "test relay validator");
+    ASSERT_EQ_INT(ESP_OK, ret, "event init succeeds");
+    ret = nostr_event_sign(&event, id->nsec);
+    ASSERT_EQ_INT(ESP_OK, ret, "event sign succeeds");
+
+    char json_buf[2048];
+    ret = nostr_event_to_json(&event, json_buf, sizeof(json_buf));
+    ASSERT_EQ_INT(ESP_OK, ret, "event to json succeeds");
+
+    bool valid = relay_validator_verify_event(json_buf, strlen(json_buf));
+    ASSERT(valid, "Valid event passes verification");
+
+    printf("\n--- Tampered event ID detection ---\n");
+    char *tampered = strdup(json_buf);
+    char *id_pos = strstr(tampered, event.id);
+    ASSERT(id_pos != NULL, "Found ID in JSON");
+    id_pos[0] = (id_pos[0] == 'a') ? 'b' : 'a';
+    bool tampered_valid = relay_validator_verify_event(tampered, strlen(tampered));
+    ASSERT(!tampered_valid, "Tampered event ID fails verification");
+    free(tampered);
+
+    printf("\n--- Tampered signature detection ---\n");
+    tampered = strdup(json_buf);
+    char *sig_pos = strstr(tampered, event.sig);
+    ASSERT(sig_pos != NULL, "Found sig in JSON");
+    sig_pos[0] = (sig_pos[0] == 'a') ? 'b' : 'a';
+    tampered_valid = relay_validator_verify_event(tampered, strlen(tampered));
+    ASSERT(!tampered_valid, "Tampered signature fails verification");
+    free(tampered);
+
+    printf("\n--- Tampered content detection ---\n");
+    tampered = strdup(json_buf);
+    char *content_pos = strstr(tampered, "test relay validator");
+    ASSERT(content_pos != NULL, "Found content in JSON");
+    content_pos[0] = 'X';
+    tampered_valid = relay_validator_verify_event(tampered, strlen(tampered));
+    ASSERT(!tampered_valid, "Tampered content fails verification");
+    free(tampered);
+
+    printf("\n--- Empty/invalid JSON ---\n");
+    ASSERT(!relay_validator_verify_event("", 0), "Empty string fails");
+    ASSERT(!relay_validator_verify_event("{}", 2), "Empty object fails");
+    ASSERT(!relay_validator_verify_event("not json", 8), "Non-JSON fails");
+    ASSERT(!relay_validator_verify_event("[1,2,3]", 7), "Array fails");
+
+    printf("\n--- Missing fields ---\n");
+    ASSERT(!relay_validator_verify_event("{\"id\":\"" "0000000000000000000000000000000000000000000000000000000000000000" "\"}", 71),
+           "Missing pubkey/sig fails");
+
+    printf("\n--- result_string ---\n");
+    ASSERT_EQ_STR("ok", relay_validator_result_string(VALIDATION_OK), "OK string");
+    ASSERT_EQ_STR("invalid: signature", relay_validator_result_string(VALIDATION_ERR_SIG), "SIG string");
+    ASSERT_EQ_STR("invalid: event id", relay_validator_result_string(VALIDATION_ERR_ID), "ID string");
+
+    printf("\n=== ALL TESTS PASSED ===\n");
+    return 0;
+}