feat: Add security.properties builder

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: maltesander

rust/operator-binary/src/controller/build/properties/security_properties.rs

@@ -1 +1,82 @@
-//! placeholder — implemented in a later task
+//! Builder for `security.properties` (the JVM security properties file).
+//!
+//! Reproduces the product-config behaviour: `networkaddress.cache.ttl` and
+//! `networkaddress.cache.negative.ttl` are `required` properties with recommended
+//! values, so they are always emitted; user `security.properties` overrides win.
+
+use std::collections::BTreeMap;
+
+const NETWORKADDRESS_CACHE_TTL: &str = "networkaddress.cache.ttl";
+const NETWORKADDRESS_CACHE_NEGATIVE_TTL: &str = "networkaddress.cache.negative.ttl";
+
+const DEFAULT_NETWORKADDRESS_CACHE_TTL: &str = "30";
+const DEFAULT_NETWORKADDRESS_CACHE_NEGATIVE_TTL: &str = "0";
+
+/// Build the `security.properties` key/value pairs.
+///
+/// `overrides` are the resolved user overrides for `security.properties`
+/// (highest precedence). Values are wrapped in `Some` for the writer.
+pub fn build(overrides: BTreeMap<String, String>) -> BTreeMap<String, Option<String>> {
+    let mut props: BTreeMap<String, Option<String>> = BTreeMap::new();
+
+    // 1. Defaults (recommended values for the required properties).
+    props.insert(
+        NETWORKADDRESS_CACHE_TTL.to_string(),
+        Some(DEFAULT_NETWORKADDRESS_CACHE_TTL.to_string()),
+    );
+    props.insert(
+        NETWORKADDRESS_CACHE_NEGATIVE_TTL.to_string(),
+        Some(DEFAULT_NETWORKADDRESS_CACHE_NEGATIVE_TTL.to_string()),
+    );
+
+    // 2. No automatic operator-injected values.
+    // 3. No merged_config contribution.
+    // 4. User overrides (highest precedence).
+    for (k, v) in overrides {
+        props.insert(k, Some(v));
+    }
+
+    props
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn defaults_present_without_overrides() {
+        let props = build(BTreeMap::new());
+        assert_eq!(
+            props.get("networkaddress.cache.ttl"),
+            Some(&Some("30".to_string()))
+        );
+        assert_eq!(
+            props.get("networkaddress.cache.negative.ttl"),
+            Some(&Some("0".to_string()))
+        );
+    }
+
+    #[test]
+    fn user_override_wins() {
+        let overrides = [("networkaddress.cache.ttl".to_string(), "60".to_string())]
+            .into_iter()
+            .collect();
+        let props = build(overrides);
+        assert_eq!(
+            props.get("networkaddress.cache.ttl"),
+            Some(&Some("60".to_string()))
+        );
+    }
+
+    #[test]
+    fn extra_user_override_key_is_added() {
+        let overrides = [("custom.security.prop".to_string(), "x".to_string())]
+            .into_iter()
+            .collect();
+        let props = build(overrides);
+        assert_eq!(
+            props.get("custom.security.prop"),
+            Some(&Some("x".to_string()))
+        );
+    }
+}