feat: add input validation

.gitignore

···
 config.yaml
 
 # Database
-*.db
+*.db*
 
 # SSH host keys
 host_key

config/validate.go

···
 package config
 
 import (
+	"context"
 	"errors"
+	"fmt"
+	"net/http"
 	"net/mail"
 	"net/url"
+	"time"
 
 	"github.com/adhocore/gronx"
+	"github.com/mmcdole/gofeed"
 )
 
 var (
···
 
 	return nil
 }
+
+// ValidateFeedURLs attempts to fetch and parse each feed URL with a short timeout
+func ValidateFeedURLs(ctx context.Context, cfg *ParsedConfig) error {
+	ctx, cancel := context.WithTimeout(ctx, 10*time.Second)
+	defer cancel()
+
+	parser := gofeed.NewParser()
+	client := &http.Client{
+		Timeout: 5 * time.Second,
+	}
+
+	for _, feed := range cfg.Feeds {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, feed.URL, nil)
+		if err != nil {
+			return fmt.Errorf("invalid feed URL %s: %w", feed.URL, err)
+		}
+
+		req.Header.Set("User-Agent", "Herald/1.0 (RSS Aggregator)")
+
+		resp, err := client.Do(req)
+		if err != nil {
+			return fmt.Errorf("failed to fetch feed %s: %w", feed.URL, err)
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			resp.Body.Close()
+			return fmt.Errorf("feed %s returned status %d", feed.URL, resp.StatusCode)
+		}
+
+		_, err = parser.Parse(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			return fmt.Errorf("failed to parse feed %s: %w", feed.URL, err)
+		}
+	}
+
+	return nil
+}

email/send.go

···
 	}
 }
 
+// ValidateConfig tests SMTP connectivity and auth
+func (m *Mailer) ValidateConfig() error {
+	addr := net.JoinHostPort(m.cfg.Host, fmt.Sprintf("%d", m.cfg.Port))
+
+	var auth smtp.Auth
+	if m.cfg.User != "" && m.cfg.Pass != "" {
+		auth = smtp.PlainAuth("", m.cfg.User, m.cfg.Pass, m.cfg.Host)
+	}
+
+	// Port 465 uses implicit TLS
+	if m.cfg.Port == 465 {
+		tlsConfig := &tls.Config{
+			ServerName: m.cfg.Host,
+		}
+
+		conn, err := tls.Dial("tcp", addr, tlsConfig)
+		if err != nil {
+			return fmt.Errorf("TLS dial: %w", err)
+		}
+		defer conn.Close()
+
+		client, err := smtp.NewClient(conn, m.cfg.Host)
+		if err != nil {
+			return fmt.Errorf("SMTP client: %w", err)
+		}
+		defer client.Close()
+
+		if auth != nil {
+			if err = client.Auth(auth); err != nil {
+				return fmt.Errorf("auth: %w", err)
+			}
+		}
+
+		return client.Quit()
+	}
+
+	// Port 587 uses STARTTLS
+	conn, err := net.Dial("tcp", addr)
+	if err != nil {
+		return fmt.Errorf("dial: %w", err)
+	}
+	defer conn.Close()
+
+	client, err := smtp.NewClient(conn, m.cfg.Host)
+	if err != nil {
+		return fmt.Errorf("SMTP client: %w", err)
+	}
+	defer client.Close()
+
+	// Start TLS before auth
+	tlsConfig := &tls.Config{
+		ServerName: m.cfg.Host,
+	}
+	if err = client.StartTLS(tlsConfig); err != nil {
+		return fmt.Errorf("STARTTLS: %w", err)
+	}
+
+	if auth != nil {
+		if err = client.Auth(auth); err != nil {
+			return fmt.Errorf("auth: %w", err)
+		}
+	}
+
+	return client.Quit()
+}
+
 func (m *Mailer) Send(to, subject, htmlBody, textBody, unsubToken, dashboardURL string) error {
 	addr := net.JoinHostPort(m.cfg.Host, fmt.Sprintf("%d", m.cfg.Port))
 

main.go

···
 		From: cfg.SMTP.From,
 	}, cfg.Origin)
 
+	// Validate SMTP configuration
+	if err := mailer.ValidateConfig(); err != nil {
+		return fmt.Errorf("SMTP validation failed: %w", err)
+	}
+
 	sched := scheduler.NewScheduler(db, mailer, logger, 60*time.Second, cfg.Origin)
 
 	sshServer := ssh.NewServer(ssh.Config{

ssh/scp.go

···
 		return 0, fmt.Errorf("invalid config: %w", err)
 	}
 
+	ctx := s.Context()
+
+	// Validate feed URLs by attempting to fetch them
+	if err := config.ValidateFeedURLs(ctx, parsed); err != nil {
+		return 0, fmt.Errorf("feed validation failed: %w", err)
+	}
+
 	nextRun, err := calculateNextRun(parsed.CronExpr)
 	if err != nil {
 		return 0, fmt.Errorf("failed to calculate next run: %w", err)
 	}
-
-	ctx := s.Context()
 	
 	// Use transaction for config update
 	tx, err := h.store.BeginTx(ctx)