test: cover timing, overflow, and target authentication contracts

crates/irtt-app/tests/cli.rs

@@ -144,6 +144,36 @@ fn default_client_output_emits_a_packet_summary() {
     }
 }
 
+#[cfg(feature = "client")]
+#[test]
+fn target_authentication_inherits_overrides_or_disables_the_global_key() {
+    use clap::Parser;
+    use irtt_app::cmd::client::args::ClientArgs;
+    let args = ClientArgs::try_parse_from([
+        "irtt-client",
+        "--hmac",
+        "global-test-key",
+        "inherit=127.0.0.1:2112",
+        "override=127.0.0.1:2113@hmac=target-test-key",
+        "disable=127.0.0.1:2114@hmac=",
+    ])
+    .unwrap();
+    let setup = args.prepare().unwrap();
+    assert_eq!(
+        setup.managed_config().client.hmac_key.as_deref(),
+        Some(b"global-test-key".as_slice())
+    );
+    let targets = setup.managed_targets();
+    let authentication: Vec<_> = targets
+        .iter()
+        .map(|target| target.auth.as_ref().map(|auth| auth.hmac_key.as_deref()))
+        .collect();
+    assert_eq!(
+        authentication,
+        [None, Some(Some(b"target-test-key".as_slice())), Some(None)]
+    );
+}
+
 // A real authenticated server detects broken client argument-to-config mapping.
 #[cfg(feature = "client")]
 #[test]