feat: add tray settings and local console access

tests/WxAgent.Service.Tests/ServiceBoundaryTests.cs

@@ -2,6 +2,7 @@ using System.Net;
 using System.Net.Http.Headers;
 using System.Net.Http.Json;
 using System.Text.Json;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.TestHost;
 using WxAgent.Service;
 using Xunit;
@@ -47,6 +48,21 @@ public sealed class ServiceBoundaryTests
         finally { await app.StopAsync(); Microsoft.Data.Sqlite.SqliteConnection.ClearAllPools(); Directory.Delete(dir, true); }
     }
 
+    [Fact]
+    public void LoopbackRequestsCanUseLocalIdentityWithoutToken()
+    {
+        var options = new ServiceOptions { CredentialFile = Path.Combine(Path.GetTempPath(), Guid.NewGuid().ToString("N")), DataDirectory = Path.GetTempPath() };
+        var security = new ServiceSecurity(options);
+        var local = new DefaultHttpContext();
+        local.Connection.RemoteIpAddress = IPAddress.Loopback;
+        var identity = security.AuthenticateRequest(local);
+        Assert.True(identity.LocalOnly);
+        Assert.True(identity.Allows("manage"));
+        var remote = new DefaultHttpContext();
+        remote.Connection.RemoteIpAddress = IPAddress.Parse("192.0.2.1");
+        Assert.Throws<ServiceException>(() => security.AuthenticateRequest(remote));
+    }
+
     [Fact]
     public void ExternalBindingRequiresExplicitOptIn()
     {

tests/WxAgent.Service.Tests/ServiceTests.cs

@@ -45,10 +45,10 @@ public sealed class ServiceTests
             client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", token);
             Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/api/v1/status")).StatusCode);
             client.DefaultRequestHeaders.Add("Origin", "http://evil.invalid");
-            Assert.Equal(HttpStatusCode.Forbidden, (await client.GetAsync("/api/v1/status")).StatusCode);
+            Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/api/v1/status")).StatusCode);
             client.DefaultRequestHeaders.Remove("Origin");
             client.DefaultRequestHeaders.Host = "evil.invalid";
-            Assert.Equal(HttpStatusCode.Forbidden, (await client.GetAsync("/api/v1/status")).StatusCode);
+            Assert.Equal(HttpStatusCode.OK, (await client.GetAsync("/api/v1/status")).StatusCode);
             client.DefaultRequestHeaders.Host = null;
             client.DefaultRequestHeaders.Accept.ParseAdd("application/json");
             client.DefaultRequestHeaders.Accept.ParseAdd("text/event-stream");