From c3df5754f4960a93f6d1857fea52fb29669435c2 Mon Sep 17 00:00:00 2001
From: clawbot <35+clawbot@noreply.example.org>
Date: Sun, 18 Oct 2026 23:18:44 +0000
Subject: [PATCH] Test that a blocked_networks entry in the IPv4-mapped form is
 read as its IPv4 range

Two new tests, failing until the fix. An entry such as
::ffff:10.0.0.0/104 must load as 10.0.0.0/8, since the fetcher matches
an IPv4-mapped address as the IPv4 address it holds. An entry in that
form shorter than /96 must abort startup naming blocked_networks and
the value.

Model: opus-5-5
---
 .../config/blocked_networks_internal_test.go  | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/internal/config/blocked_networks_internal_test.go b/internal/config/blocked_networks_internal_test.go
index 25373be..9267016 100644
--- a/internal/config/blocked_networks_internal_test.go
+++ b/internal/config/blocked_networks_internal_test.go
@@ -88,3 +88,45 @@ func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
 		},
 	})
 }
+
+// TestBlockedNetworksMappedEntryIsIPv4Range checks that an entry written in
+// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
+// since the fetcher matches an IPv4-mapped address as the IPv4 address it
+// holds.
+func TestBlockedNetworksMappedEntryIsIPv4Range(t *testing.T) {
+	t.Parallel()
+
+	yamlContent := signingKeyLine + `blocked_networks:
+  - "::ffff:10.0.0.0/104"
+`
+
+	c, err := configFromYAML(t, yamlContent)
+	if err != nil {
+		t.Fatalf("an IPv4-mapped blocked_networks entry should load, got error: %v", err)
+	}
+
+	if len(c.BlockedNetworks) != 1 {
+		t.Fatalf("BlockedNetworks = %v, want 1 entry", c.BlockedNetworks)
+	}
+
+	if got := c.BlockedNetworks[0].String(); got != "10.0.0.0/8" {
+		t.Errorf("BlockedNetworks[0] = %q, want %q", got, "10.0.0.0/8")
+	}
+}
+
+// TestBlockedNetworksMappedEntryShorterThan96AbortsStartup checks that an
+// entry in the IPv4-mapped form shorter than /96, which covers more than the
+// IPv4 addresses, aborts startup with an error naming the key and the value.
+func TestBlockedNetworksMappedEntryShorterThan96AbortsStartup(t *testing.T) {
+	t.Parallel()
+
+	runAbortCases(t, []abortCase{
+		{
+			name: "mapped-shorter-than-96",
+			yaml: signingKeyLine + `blocked_networks:
+  - "::ffff:0.0.0.0/80"
+`,
+			wantErrSubstrings: []string{keyBlockedNetworks, "::ffff:0.0.0.0/80"},
+		},
+	})
+}