23 files changed, 519 insertions, 3 deletions

diff --git a/tests/unit/Makefile b/tests/unit/Makefile
index 0a726f6..aa7f5ae 100644
--- a/tests/unit/Makefile
+++ b/tests/unit/Makefile
@@ -22,7 +22,7 @@ LDFLAGS := -lmbedcrypto -lcjson -lm
 
 SECP256K1_OBJ := secp256k1.o precomputed_ecmult.o precomputed_ecmult_gen.o
 
-TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server test_mining_payment
+TESTS := test_geohash test_identity test_nostr_event test_cashu test_session test_tollgate_client test_lnurl_pay test_lightning_payout test_mcp_handler test_nip04 test_cvm_server test_mining_payment test_stratum_proxy test_session_payment_method test_tollgate_client_mining test_firewall_sandbox
 
 .PHONY: all test clean $(TESTS)
 
@@ -84,5 +84,17 @@ test_cvm_server: test_cvm_server.c
 test_mining_payment: test_mining_payment.c $(REPO_ROOT)/main/mining_payment.c
         $(CC) $(CFLAGS) $< $(REPO_ROOT)/main/mining_payment.c -o $@ $(LDFLAGS)
 
+test_stratum_proxy: test_stratum_proxy.c $(REPO_ROOT)/main/stratum_proxy.c $(REPO_ROOT)/main/mining_payment.c
+        $(CC) $(CFLAGS) $< $(REPO_ROOT)/main/stratum_proxy.c $(REPO_ROOT)/main/mining_payment.c -o $@ $(LDFLAGS)
+
+test_session_payment_method: test_session_payment_method.c $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c
+        $(CC) $(CFLAGS) $< $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c -o $@ $(LDFLAGS)
+
+test_tollgate_client_mining: test_tollgate_client_mining.c
+        $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
+
+test_firewall_sandbox: test_firewall_sandbox.c $(REPO_ROOT)/main/firewall.c
+        $(CC) $(CFLAGS) -include stubs/dns_server.h $< $(REPO_ROOT)/main/firewall.c -o $@ $(LDFLAGS)
+
 clean:
         rm -f $(TESTS) $(SECP256K1_OBJ)
diff --git a/tests/unit/stubs/dns_server.h b/tests/unit/stubs/dns_server.h
new file mode 100644
index 0000000..0a9450b
--- /dev/null
+++ b/tests/unit/stubs/dns_server.h
@@ -0,0 +1,11 @@
+#ifndef STUBS_DNS_SERVER_H
+#define STUBS_DNS_SERVER_H
+
+#include <stdint.h>
+#include <stdbool.h>
+
+static inline void dns_server_set_client_authenticated(uint32_t ip, bool auth) {
+    (void)ip; (void)auth;
+}
+
+#endif
diff --git a/tests/unit/stubs/esp_wifi_ap_get_sta_list.h b/tests/unit/stubs/esp_wifi_ap_get_sta_list.h
new file mode 100644
index 0000000..3e98032
--- /dev/null
+++ b/tests/unit/stubs/esp_wifi_ap_get_sta_list.h
@@ -0,0 +1,38 @@
+#ifndef STUBS_ESP_WIFI_AP_GET_STA_LIST_H
+#define STUBS_ESP_WIFI_AP_GET_STA_LIST_H
+
+#include <stdint.h>
+#include <string.h>
+#include "esp_err.h"
+
+#define ESP_WIFI_AP_MAX_STA 10
+
+typedef struct {
+    uint8_t mac[6];
+} wifi_sta_info_t;
+
+typedef struct {
+    int num;
+    wifi_sta_info_t sta[ESP_WIFI_AP_MAX_STA];
+} wifi_sta_list_t;
+
+typedef struct {
+    int num;
+    struct {
+        uint8_t mac[6];
+        esp_ip4_addr_t ip;
+    } sta[ESP_WIFI_AP_MAX_STA];
+} wifi_sta_mac_ip_list_t;
+
+static inline esp_err_t esp_wifi_ap_get_sta_list(wifi_sta_list_t *sta) {
+    memset(sta, 0, sizeof(*sta));
+    return ESP_FAIL;
+}
+
+static inline esp_err_t esp_wifi_ap_get_sta_list_with_ip(const wifi_sta_list_t *sta_in, wifi_sta_mac_ip_list_t *out) {
+    (void)sta_in;
+    memset(out, 0, sizeof(*out));
+    return ESP_FAIL;
+}
+
+#endif
diff --git a/tests/unit/stubs/freertos/task.h b/tests/unit/stubs/freertos/task.h
index 3855d41..ec96156 100644
--- a/tests/unit/stubs/freertos/task.h
+++ b/tests/unit/stubs/freertos/task.h
@@ -6,14 +6,17 @@
 
 typedef void *TaskHandle_t;
 typedef void *SemaphoreHandle_t;
+typedef int BaseType_t;
+
+#define pdPASS 1
 
 static inline void vTaskDelete(TaskHandle_t t) { (void)t; }
 static inline SemaphoreHandle_t xSemaphoreCreateMutex(void) { return (SemaphoreHandle_t)malloc(1); }
 static inline void vSemaphoreDelete(SemaphoreHandle_t s) { free(s); }
 static inline int xSemaphoreTake(SemaphoreHandle_t s, uint32_t blk) { (void)s; (void)blk; return 1; }
 static inline int xSemaphoreGive(SemaphoreHandle_t s) { (void)s; return 1; }
-static inline int xTaskCreate(void (*fn)(void*), const char *n, uint32_t st, void *p, uint32_t pri, TaskHandle_t *h) {
-    (void)fn; (void)n; (void)st; (void)p; (void)pri; (void)h; return 1;
+static inline BaseType_t xTaskCreate(void (*fn)(void*), const char *n, uint32_t st, void *p, uint32_t pri, TaskHandle_t *h) {
+    (void)fn; (void)n; (void)st; (void)p; (void)pri; (void)h; return pdPASS;
 }
 
 #endif
diff --git a/tests/unit/stubs/lwip/etharp.h b/tests/unit/stubs/lwip/etharp.h
new file mode 100644
index 0000000..adc6b7b
--- /dev/null
+++ b/tests/unit/stubs/lwip/etharp.h
@@ -0,0 +1,22 @@
+#ifndef STUBS_LWIP_ETHARP_H
+#define STUBS_LWIP_ETHARP_H
+
+#include <stdint.h>
+#include <stddef.h>
+#include "lwip/ip4_addr.h"
+
+struct eth_addr {
+    uint8_t addr[6];
+};
+
+struct netif;
+
+typedef int err_t;
+#define ERR_OK 0
+
+static inline err_t etharp_get_entry(ssize_t i, ip4_addr_t **ip, struct netif **netif, struct eth_addr **eth) {
+    (void)i; (void)ip; (void)netif; (void)eth;
+    return -1;
+}
+
+#endif
diff --git a/tests/unit/stubs/lwip/ip4_addr.h b/tests/unit/stubs/lwip/ip4_addr.h
index 174211b..9d92ff0 100644
--- a/tests/unit/stubs/lwip/ip4_addr.h
+++ b/tests/unit/stubs/lwip/ip4_addr.h
@@ -3,6 +3,9 @@
 
 #include <stdint.h>
 
+typedef uint32_t u32_t;
+typedef uint16_t u16_t;
+
 typedef struct {
     uint32_t addr;
 } ip4_addr_t;
diff --git a/tests/unit/stubs/lwip/napt.h b/tests/unit/stubs/lwip/lwip_napt.h
index c6a5ca1..c6a5ca1 100644
--- a/tests/unit/stubs/lwip/napt.h
+++ b/tests/unit/stubs/lwip/lwip_napt.h
diff --git a/tests/unit/stubs/lwip/netif.h b/tests/unit/stubs/lwip/netif.h
index 461a64e..9415539 100644
--- a/tests/unit/stubs/lwip/netif.h
+++ b/tests/unit/stubs/lwip/netif.h
@@ -1,4 +1,20 @@
 #ifndef STUBS_LWIP_NETIF_H
 #define STUBS_LWIP_NETIF_H
 
+#include <stdint.h>
+#include <stddef.h>
+
+struct pbuf {
+    void *payload;
+    uint16_t len;
+};
+
+static inline uint32_t lwip_ntohl(uint32_t n) {
+    return ((n & 0xFF) << 24) | ((n & 0xFF00) << 8) | ((n >> 8) & 0xFF00) | ((n >> 24) & 0xFF);
+}
+
+static inline uint16_t lwip_ntohs(uint16_t n) {
+    return ((n & 0xFF) << 8) | ((n >> 8) & 0xFF);
+}
+
 #endif
diff --git a/tests/unit/stubs/lwip/prot/ip.h b/tests/unit/stubs/lwip/prot/ip.h
new file mode 100644
index 0000000..0770760
--- /dev/null
+++ b/tests/unit/stubs/lwip/prot/ip.h
@@ -0,0 +1,20 @@
+#ifndef STUBS_LWIP_PROT_IP_H
+#define STUBS_LWIP_PROT_IP_H
+
+#include <stdint.h>
+
+#define IP_PROTO_TCP 6
+#define IP_PROTO_UDP 17
+#define IP_HLEN 20
+
+struct ip_hdr {
+    uint8_t _proto;
+    union {
+        uint32_t addr;
+    } src;
+    union {
+        uint32_t addr;
+    } dest;
+};
+
+#endif
diff --git a/tests/unit/stubs/lwip/prot/ip4.h b/tests/unit/stubs/lwip/prot/ip4.h
new file mode 100644
index 0000000..0f70170
--- /dev/null
+++ b/tests/unit/stubs/lwip/prot/ip4.h
@@ -0,0 +1,6 @@
+#ifndef STUBS_LWIP_PROT_IP4_H
+#define STUBS_LWIP_PROT_IP4_H
+
+#include "ip.h"
+
+#endif
diff --git a/tests/unit/stubs/lwip/prot/tcp.h b/tests/unit/stubs/lwip/prot/tcp.h
new file mode 100644
index 0000000..5841371
--- /dev/null
+++ b/tests/unit/stubs/lwip/prot/tcp.h
@@ -0,0 +1,13 @@
+#ifndef STUBS_LWIP_PROT_TCP_H
+#define STUBS_LWIP_PROT_TCP_H
+
+#include <stdint.h>
+
+#define TCP_HLEN 20
+
+struct tcp_hdr {
+    uint16_t src;
+    uint16_t dest;
+};
+
+#endif
diff --git a/tests/unit/stubs/lwip/sockets.h b/tests/unit/stubs/lwip/sockets.h
index 44f03ac..91bf8b2 100644
--- a/tests/unit/stubs/lwip/sockets.h
+++ b/tests/unit/stubs/lwip/sockets.h
@@ -1,4 +1,10 @@
 #ifndef STUBS_LWIP_SOCKETS_H
 #define STUBS_LWIP_SOCKETS_H
 
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <unistd.h>
+#include <string.h>
+
 #endif
diff --git a/tests/unit/test_firewall_sandbox b/tests/unit/test_firewall_sandbox
new file mode 100755
index 0000000..4b85357
--- /dev/null
+++ b/tests/unit/test_firewall_sandbox
diff --git a/tests/unit/test_firewall_sandbox.c b/tests/unit/test_firewall_sandbox.c
new file mode 100644
index 0000000..66a491b
--- /dev/null
+++ b/tests/unit/test_firewall_sandbox.c
@@ -0,0 +1,94 @@
+#include "test_framework.h"
+#include "../../main/firewall.h"
+#include <stdio.h>
+#include <string.h>
+
+int main(void)
+{
+    printf("=== test_firewall_sandbox ===\n");
+
+    printf("\n--- FW_MAX_MAC_LEN is 18 ---\n");
+    {
+        ASSERT_EQ_INT(18, FW_MAX_MAC_LEN, "MAC length is 18 (17 chars + null)");
+    }
+
+    printf("\n--- esp_ip4_addr_t available ---\n");
+    {
+        esp_ip4_addr_t ip;
+        ip.addr = 0x0102A8C0;
+        ASSERT(ip.addr == 0x0102A8C0, "ip4_addr stores value");
+    }
+
+    printf("\n--- firewall_set_mining_port / set_sandbox_mint_access compile ---\n");
+    {
+        firewall_set_mining_port(3333);
+        firewall_set_mining_port(4033);
+        firewall_set_sandbox_mint_access(true);
+        firewall_set_sandbox_mint_access(false);
+        ASSERT(true, "setters compile and run without crash");
+    }
+
+    printf("\n--- firewall_init + client management ---\n");
+    {
+        esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
+        esp_err_t ret = firewall_init(ap_ip);
+        ASSERT_EQ_INT(ESP_OK, (int)ret, "firewall_init succeeds");
+        ASSERT_EQ_INT(0, firewall_client_count(), "no clients after init");
+
+        firewall_grant_access(0x0201A8C0);
+        ASSERT_EQ_INT(1, firewall_client_count(), "1 client after grant");
+        ASSERT(firewall_is_client_allowed(0x0201A8C0), "client is allowed");
+
+        firewall_revoke_access(0x0201A8C0);
+        ASSERT_EQ_INT(0, firewall_client_count(), "0 clients after revoke");
+        ASSERT(!firewall_is_client_allowed(0x0201A8C0), "client not allowed after revoke");
+    }
+
+    printf("\n--- grant same IP twice ---\n");
+    {
+        esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
+        firewall_init(ap_ip);
+
+        firewall_grant_access(0x0301A8C0);
+        firewall_grant_access(0x0301A8C0);
+        ASSERT_EQ_INT(1, firewall_client_count(), "duplicate grant does not double count");
+    }
+
+    printf("\n--- revoke non-existent ---\n");
+    {
+        firewall_revoke_access(0x99999999);
+        ASSERT_EQ_INT(1, firewall_client_count(), "revoke non-existent no effect");
+    }
+
+    printf("\n--- revoke_all ---\n");
+    {
+        firewall_grant_access(0x0401A8C0);
+        firewall_grant_access(0x0501A8C0);
+        ASSERT_EQ_INT(3, firewall_client_count(), "3 clients");
+        firewall_revoke_all();
+        ASSERT_EQ_INT(0, firewall_client_count(), "0 after revoke_all");
+    }
+
+    printf("\n--- max clients (10) ---\n");
+    {
+        esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
+        firewall_init(ap_ip);
+
+        for (int i = 0; i < 10; i++) {
+            firewall_grant_access(0x0A000000 + i);
+        }
+        ASSERT_EQ_INT(10, firewall_client_count(), "10 clients at max");
+
+        firewall_grant_access(0x0A000100);
+        ASSERT_EQ_INT(10, firewall_client_count(), "still 10 after exceeding max");
+    }
+
+    printf("\n--- is_mac_allowed (no MACs resolved in stub) ---\n");
+    {
+        firewall_init((esp_ip4_addr_t){ .addr = 0x012FA80A });
+        firewall_grant_access(0x0601A8C0);
+        ASSERT(!firewall_is_mac_allowed(""), "empty MAC not allowed");
+    }
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_identity b/tests/unit/test_identity
index 4dc9cd5..2704601 100755
--- a/tests/unit/test_identity
+++ b/tests/unit/test_identity
diff --git a/tests/unit/test_mcp_handler b/tests/unit/test_mcp_handler
index b7b1518..be992f6 100755
--- a/tests/unit/test_mcp_handler
+++ b/tests/unit/test_mcp_handler
diff --git a/tests/unit/test_session_payment_method b/tests/unit/test_session_payment_method
new file mode 100755
index 0000000..94c7134
--- /dev/null
+++ b/tests/unit/test_session_payment_method
diff --git a/tests/unit/test_session_payment_method.c b/tests/unit/test_session_payment_method.c
new file mode 100644
index 0000000..0239140
--- /dev/null
+++ b/tests/unit/test_session_payment_method.c
@@ -0,0 +1,74 @@
+#include "test_framework.h"
+#include "../../main/session.h"
+#include "../../main/firewall.h"
+#include "../../main/config.h"
+#include "../../main/cashu.h"
+#include <string.h>
+#include <stdio.h>
+
+static tollgate_config_t g_test_config;
+
+const tollgate_config_t *tollgate_config_get(void) {
+    return &g_test_config;
+}
+
+esp_err_t firewall_get_mac_for_ip(uint32_t ip, char *mac_out, size_t size) {
+    (void)ip;
+    snprintf(mac_out, size, "AA:BB:CC:DD:EE:FF");
+    return 0;
+}
+
+static uint32_t g_granted_ips[32];
+static int g_granted_count = 0;
+
+void firewall_grant_access(uint32_t ip) {
+    if (g_granted_count < 32) g_granted_ips[g_granted_count++] = ip;
+}
+
+void firewall_revoke_access(uint32_t ip) {
+    (void)ip;
+}
+
+int main(void)
+{
+    printf("=== test_session_payment_method ===\n");
+    memset(&g_test_config, 0, sizeof(g_test_config));
+    strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
+    g_granted_count = 0;
+
+    printf("\n--- session_create sets PAYMENT_METHOD_CASHU ---\n");
+    session_manager_init();
+    session_t *s1 = session_create(0x0A010001, 60000);
+    ASSERT(s1 != NULL, "session created");
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s1->payment_method, "cashu session has PAYMENT_METHOD_CASHU");
+
+    printf("\n--- session_create_bytes sets PAYMENT_METHOD_BYTES ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s2 = session_create_bytes(0x0A010002, 1048576);
+    ASSERT(s2 != NULL, "bytes session created");
+    ASSERT_EQ_INT(PAYMENT_METHOD_BYTES, (int)s2->payment_method, "bytes session has PAYMENT_METHOD_BYTES");
+    ASSERT_EQ_UINT64(1048576, s2->allotment_bytes, "allotment_bytes set");
+    ASSERT_EQ_UINT64(0, s2->bytes_consumed, "bytes_consumed starts at 0");
+
+    printf("\n--- payment_method_t enum values are distinct ---\n");
+    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_MINING, "CASHU != MINING");
+    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_BYTES, "CASHU != BYTES");
+    ASSERT(PAYMENT_METHOD_MINING != PAYMENT_METHOD_BYTES, "MINING != BYTES");
+
+    printf("\n--- session extend preserves payment_method ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s3 = session_create(0x0A010003, 60000);
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "initially CASHU");
+    session_extend(s3, 30000);
+    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "still CASHU after extend");
+
+    printf("\n--- bytes session allotment_ms is INT64_MAX ---\n");
+    session_manager_init();
+    g_granted_count = 0;
+    session_t *s4 = session_create_bytes(0x0A010004, 2097152);
+    ASSERT(s4->allotment_ms == INT64_MAX, "bytes session has INT64_MAX allotment_ms");
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_stratum_proxy b/tests/unit/test_stratum_proxy
new file mode 100755
index 0000000..608835f
--- /dev/null
+++ b/tests/unit/test_stratum_proxy
diff --git a/tests/unit/test_stratum_proxy.c b/tests/unit/test_stratum_proxy.c
new file mode 100644
index 0000000..7788911
--- /dev/null
+++ b/tests/unit/test_stratum_proxy.c
@@ -0,0 +1,95 @@
+#include "test_framework.h"
+#include "../../main/stratum_proxy.h"
+#include "../../main/mining_payment.h"
+#include <stdio.h>
+#include <string.h>
+
+int main(void)
+{
+    printf("=== test_stratum_proxy ===\n");
+
+    mining_payment_init();
+
+    printf("\n--- stratum_proxy_set_job / get_current_job ---\n");
+    {
+        stratum_job_t job = {0};
+        job.job_id = 42;
+        job.nbits = 0x170309E2;
+        job.ntime = 0x6789ABCD;
+        job.version = 0x20000000;
+        job.valid = true;
+        memset(job.prevhash, 0xAA, 32);
+        memset(job.merkle_root, 0xBB, 32);
+
+        stratum_proxy_set_job(&job);
+
+        const stratum_job_t *cur = stratum_proxy_get_current_job();
+        ASSERT(cur != NULL, "current job not NULL");
+        ASSERT_EQ_INT(42, (int)cur->job_id, "job_id=42");
+        ASSERT_EQ_INT(0x170309E2, (int)cur->nbits, "nbits preserved");
+        ASSERT_EQ_INT(0x6789ABCD, (int)cur->ntime, "ntime preserved");
+        ASSERT_EQ_INT(0x20000000, (int)cur->version, "version preserved");
+        ASSERT(cur->valid, "job is valid");
+        ASSERT_MEM_EQ(job.prevhash, cur->prevhash, 32, "prevhash preserved");
+    }
+
+    printf("\n--- stratum_proxy_set_job (NULL) ---\n");
+    {
+        stratum_proxy_set_job(NULL);
+        const stratum_job_t *cur = stratum_proxy_get_current_job();
+        ASSERT_EQ_INT(42, (int)cur->job_id, "job unchanged after NULL set");
+    }
+
+    printf("\n--- stratum_proxy_get_stats ---\n");
+    {
+        mining_set_current_nbits(0x170309E2);
+        stratum_proxy_set_job(&(stratum_job_t){
+            .job_id = 1,
+            .nbits = 0x170309E2,
+            .valid = true
+        });
+
+        stratum_proxy_stats_t stats;
+        memset(&stats, 0xFF, sizeof(stats));
+        stratum_proxy_get_stats(&stats);
+
+        ASSERT(stats.current_hashprice > 0.0, "hashprice populated from mining_payment");
+        ASSERT_EQ_INT(0x170309E2, (int)stats.nbits, "nbits in stats");
+    }
+
+    printf("\n--- stratum_proxy_get_stats (NULL) ---\n");
+    {
+        stratum_proxy_get_stats(NULL);
+        ASSERT(true, "get_stats with NULL does not crash");
+    }
+
+    printf("\n--- stratum_job_t initialization ---\n");
+    {
+        stratum_job_t zero = {0};
+        ASSERT(!zero.valid, "zero-initialized job is invalid");
+        ASSERT_EQ_INT(0, (int)zero.job_id, "zero job_id");
+        ASSERT_EQ_INT(0, (int)zero.nbits, "zero nbits");
+    }
+
+    printf("\n--- stratum_proxy_stats_t initialization ---\n");
+    {
+        stratum_proxy_stats_t zero = {0};
+        ASSERT(zero.hashrate_ghs == 0.0, "zero hashrate");
+        ASSERT_EQ_INT(0, (int)zero.active_miners, "zero active miners");
+        ASSERT_EQ_UINT64(0, zero.total_shares, "zero total shares");
+        ASSERT_EQ_UINT64(0, zero.total_accepted, "zero total accepted");
+        ASSERT_EQ_UINT64(0, zero.total_rejected, "zero total rejected");
+    }
+
+    printf("\n--- STRATUM_MAX_JOBS constant ---\n");
+    {
+        ASSERT(STRATUM_MAX_JOBS >= 1, "STRATUM_MAX_JOBS >= 1");
+    }
+
+    printf("\n--- STRATUM_MAX_JOB_ID_LEN constant ---\n");
+    {
+        ASSERT(STRATUM_MAX_JOB_ID_LEN >= 16, "STRATUM_MAX_JOB_ID_LEN >= 16");
+    }
+
+    TEST_SUMMARY();
+}
diff --git a/tests/unit/test_tollgate_client b/tests/unit/test_tollgate_client
index 02f7226..b56a6f0 100755
--- a/tests/unit/test_tollgate_client
+++ b/tests/unit/test_tollgate_client
diff --git a/tests/unit/test_tollgate_client_mining b/tests/unit/test_tollgate_client_mining
new file mode 100755
index 0000000..64b99dd
--- /dev/null
+++ b/tests/unit/test_tollgate_client_mining
diff --git a/tests/unit/test_tollgate_client_mining.c b/tests/unit/test_tollgate_client_mining.c
new file mode 100644
index 0000000..e270864
--- /dev/null
+++ b/tests/unit/test_tollgate_client_mining.c
@@ -0,0 +1,103 @@
+#include "test_framework.h"
+#include "../../main/config.h"
+#include <string.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <cjson/cJSON.h>
+
+static tollgate_config_t g_test_config;
+
+const tollgate_config_t *tollgate_config_get(void) {
+    return &g_test_config;
+}
+
+uint64_t nucula_wallet_balance(void) { return 100; }
+esp_err_t nucula_wallet_send(uint64_t a, char *b, size_t c) { (void)a; (void)b; (void)c; return ESP_OK; }
+
+#include "freertos/FreeRTOS.h"
+
+#include "../../main/tollgate_client.c"
+
+int main(void)
+{
+    printf("=== test_tollgate_client_mining ===\n");
+
+    memset(&g_test_config, 0, sizeof(g_test_config));
+    g_test_config.client_enabled = true;
+
+    printf("\n--- mining tag: mining_available=true, port=3333 ---\n");
+    {
+        const char *json = "{\"kind\":10021,\"tags\":["
+            "[\"metric\",\"milliseconds\"],"
+            "[\"step_size\",\"60000\"],"
+            "[\"price_per_step\",\"0\",\"mining\",\"3333\",\"sat\"],"
+            "[\"tips\",\"1\",\"2\",\"5\"]"
+            "]}";
+
+        tollgate_discovery_t disc;
+        bool ok = parse_discovery_response(json, &disc);
+        ASSERT(ok, "mining discovery parsed");
+        ASSERT(disc.is_tollgate, "is_tollgate=true");
+        ASSERT(disc.mining_available, "mining_available=true");
+        ASSERT_EQ_INT(3333, (int)disc.mining_port, "mining_port=3333");
+    }
+
+    printf("\n--- mining tag: no mining tag ---\n");
+    {
+        const char *json = "{\"kind\":10021,\"tags\":["
+            "[\"metric\",\"milliseconds\"],"
+            "[\"step_size\",\"60000\"],"
+            "[\"price_per_step\",\"cashu\",\"21\",\"sat\",\"https://testnut.cashu.space\",\"1\"]"
+            "]}";
+
+        tollgate_discovery_t disc;
+        bool ok = parse_discovery_response(json, &disc);
+        ASSERT(ok, "cashu discovery parsed");
+        ASSERT(disc.is_tollgate, "is_tollgate=true");
+        ASSERT(!disc.mining_available, "mining_available=false");
+        ASSERT_EQ_INT(0, (int)disc.mining_port, "mining_port=0 when no mining");
+        ASSERT_EQ_INT(21, disc.price_per_step, "price_per_step=21 for cashu");
+    }
+
+    printf("\n--- mining tag: custom port 4033 ---\n");
+    {
+        const char *json = "{\"kind\":10021,\"tags\":["
+            "[\"metric\",\"milliseconds\"],"
+            "[\"step_size\",\"60000\"],"
+            "[\"price_per_step\",\"0\",\"mining\",\"4033\",\"sat\"]"
+            "]}";
+
+        tollgate_discovery_t disc;
+        bool ok = parse_discovery_response(json, &disc);
+        ASSERT(ok, "mining custom port parsed");
+        ASSERT(disc.mining_available, "mining_available=true");
+        ASSERT_EQ_INT(4033, (int)disc.mining_port, "mining_port=4033");
+    }
+
+    printf("\n--- tollgate_discovery_t zero-init ---\n");
+    {
+        tollgate_discovery_t disc = {0};
+        ASSERT(!disc.is_tollgate, "zero-init: is_tollgate=false");
+        ASSERT(!disc.mining_available, "zero-init: mining_available=false");
+        ASSERT_EQ_INT(0, (int)disc.mining_port, "zero-init: mining_port=0");
+        ASSERT_EQ_INT(0, disc.price_per_step, "zero-init: price=0");
+    }
+
+    printf("\n--- TG_CLIENT_MINING state enum ---\n");
+    {
+        ASSERT(TG_CLIENT_MINING > TG_CLIENT_PAID, "MINING > PAID in enum");
+        ASSERT(TG_CLIENT_MINING < TG_CLIENT_ERROR, "MINING < ERROR in enum");
+    }
+
+    printf("\n--- discovery struct fields ---\n");
+    {
+        tollgate_discovery_t disc;
+        memset(&disc, 0, sizeof(disc));
+        disc.mining_available = true;
+        disc.mining_port = 9999;
+        ASSERT(disc.mining_available, "mining_available set");
+        ASSERT_EQ_INT(9999, (int)disc.mining_port, "mining_port set");
+    }
+
+    TEST_SUMMARY();
+}