pixa/internal/config/trusted_proxies_internal_test.go

package config

import (
	"strings"
	"testing"
)

// TestTrustedProxiesConfig checks the trusted_proxies key wiring: an
// explicit CIDR list lands in TrustedProxies in order and replaces the
// default, an omitted key falls back to the RFC 1918 private ranges, and an
// explicitly empty list trusts no one. The list parser itself is shared with
// blocked_networks and is exercised in depth by that key's tests.
func TestTrustedProxiesConfig(t *testing.T) {
	t.Parallel()

	t.Run("explicit list replaces the default in order", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t,
			signingKeyLine+`trusted_proxies: ["10.0.0.0/8", "2001:db8::/32"]`+"\n")
		if err != nil {
			t.Fatalf("valid trusted_proxies should load: %v", err)
		}

		got := make([]string, len(c.TrustedProxies))
		for i, p := range c.TrustedProxies {
			got[i] = p.String()
		}

		if joined := strings.Join(got, ","); joined != "10.0.0.0/8,2001:db8::/32" {
			t.Errorf("TrustedProxies = %v, want the two ranges in order", got)
		}
	})

	t.Run("omitted key defaults to the RFC 1918 ranges", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t, signingKeyLine)
		if err != nil {
			t.Fatalf("minimal config should load: %v", err)
		}

		got := make([]string, len(c.TrustedProxies))
		for i, p := range c.TrustedProxies {
			got[i] = p.String()
		}

		want := "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
		if joined := strings.Join(got, ","); joined != want {
			t.Errorf("TrustedProxies = %v, want the RFC 1918 ranges %q", got, want)
		}
	})

	t.Run("explicitly empty list trusts no one", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t, signingKeyLine+"trusted_proxies: []\n")
		if err != nil {
			t.Fatalf("empty trusted_proxies should load: %v", err)
		}

		if len(c.TrustedProxies) != 0 {
			t.Errorf("TrustedProxies = %v, want empty", c.TrustedProxies)
		}
	})
}

// TestTrustedProxiesInvalidAbortsStartup checks that an invalid or null
// value aborts startup with an error naming the key and the offending value.
func TestTrustedProxiesInvalidAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, []abortCase{
		{
			name:              "invalid cidr",
			yaml:              signingKeyLine + `trusted_proxies: ["999.0.0.0/8"]` + "\n",
			wantErrSubstrings: []string{keyTrustedProxies, "999.0.0.0/8"},
		},
		{
			name:              "null value",
			yaml:              signingKeyLine + "trusted_proxies:\n",
			wantErrSubstrings: []string{keyTrustedProxies, nullValueText},
		},
	})
}