Encrypted DNS health, comparing a zone's views, --local everywhere

jarld checks the DoT and DoH listeners every 10 minutes as a client would (page, dashboard, jarl encrypted-dns health, jarl_encrypted_dns_up). The Compare views tab and jarl zone diff show what differs between a zone's views, with Use this version. --local works on unlinked zones. A changed certificates.dir is followed by encrypted DNS's tls statements. Sharing an already shared version replaces other views' overrides.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/engine/linked_test.go

@@ -285,3 +285,59 @@ func TestLinkExisting(t *testing.T) {
 		t.Errorf("shared from internal: external %q", env.view("external"))
 	}
 }
+
+// --local on a zone that isn't linked is fine (its records are local
+// anyway); --shared there is refused.
+func TestLocalOnUnlinkedZone(t *testing.T) {
+	env := linkedEnv(t)
+	local, shared := true, false
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("a"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.1"), Local: &local}))
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "internal", Name: "b", Type: "A", Data: []string{"10.0.0.2"}, Local: &local}))
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "a", "A"), RecordInput{Data: model.Ptr("10.0.0.3"), Local: &local}))
+	if v := env.view("internal"); !slices.Contains(v, "a A 10.0.0.3 L") || !slices.Contains(v, "b A 10.0.0.2 L") {
+		t.Errorf("records: %q", v)
+	}
+	if e := env.submitErr(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("c"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.4"), Local: &shared})); !strings.Contains(e.Message, "nothing to share") {
+		t.Errorf("--shared on an unlinked zone: %v", e)
+	}
+}
+
+func TestCompareZones(t *testing.T) {
+	env := linkedEnv(t)
+	env.submit(env.admin, NewRequest(OpZoneCreate, 0, ZoneInput{Name: model.Ptr("example.com"), View: model.Ptr("external"), LinkWith: "internal"}))
+	env.submit(env.admin, NewRequest(OpRRSetReplace, 0, RRSetInput{Zone: "example.com", View: "external", Name: "www", Type: "A", Data: []string{"203.0.113.10"}, Local: model.Ptr(true)}))
+	env.submit(env.admin, NewRequest(OpRecordCreate, 0, RecordInput{Zone: "example.com", View: "internal", Name: model.Ptr("nas"), Type: model.Ptr("A"), Data: model.Ptr("10.0.0.20"), Local: model.Ptr(true)}))
+	st := env.state()
+	zones := st.ZonesNamed("example.com.")
+	st.SortByView(zones)
+	diff := map[string][]string{}
+	same := 0
+	for _, row := range CompareZones(st, zones) {
+		if row.Same {
+			same++
+			continue
+		}
+		var cells []string
+		for _, vs := range row.Views {
+			cells = append(cells, vs.View+"="+strings.Join(vs.Records, ",")+"/"+vs.Linked)
+		}
+		diff[row.Name+" "+row.Type] = cells
+	}
+	want := map[string][]string{
+		"www A": {"internal=192.0.2.10/shared", "external=203.0.113.10/local"},
+		"nas A": {"internal=10.0.0.20/local", "external=/"},
+	}
+	for k, v := range want {
+		if !slices.Equal(diff[k], v) {
+			t.Errorf("%s: %q, want %q", k, diff[k], v)
+		}
+	}
+	if len(diff) != 2 || same < 3 {
+		t.Errorf("differ %v, same %d", diff, same)
+	}
+	// "Use this version" on the shared one replaces external's override.
+	env.submit(env.admin, NewRequest(OpRecordUpdate, env.recordID("internal", "www", "A"), RecordInput{Local: model.Ptr(false)}))
+	if v := env.view("external"); !slices.Contains(v, "www A 192.0.2.10 S") || slices.Contains(v, "www A 203.0.113.10 L") {
+		t.Errorf("sharing the shared version: external %q", v)
+	}
+}