pixa/internal/config/blocked_networks_internal_test.go

package config

import (
	"testing"
)

// TestBlockedNetworksParsed loads a valid blocked_networks list and checks
// each CIDR is parsed into the resolved prefixes in order.
func TestBlockedNetworksParsed(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + `blocked_networks:
  - 203.0.113.0/24
  - 2001:db8::/32
`

	c, err := configFromYAML(t, yamlContent)
	if err != nil {
		t.Fatalf("valid blocked_networks should load, got error: %v", err)
	}

	want := []string{"203.0.113.0/24", "2001:db8::/32"}
	if len(c.BlockedNetworks) != len(want) {
		t.Fatalf("BlockedNetworks = %v, want %d entries", c.BlockedNetworks, len(want))
	}

	for i, w := range want {
		if got := c.BlockedNetworks[i].String(); got != w {
			t.Errorf("BlockedNetworks[%d] = %q, want %q", i, got, w)
		}
	}
}

// TestBlockedNetworksOmittedIsEmpty confirms an omitted key leaves the
// operator list empty; the built-in defaults still apply in the fetcher.
func TestBlockedNetworksOmittedIsEmpty(t *testing.T) {
	t.Parallel()

	c, err := configFromYAML(t, signingKeyLine)
	if err != nil {
		t.Fatalf("minimal config should be valid, got error: %v", err)
	}

	if len(c.BlockedNetworks) != 0 {
		t.Errorf("BlockedNetworks = %v, want empty", c.BlockedNetworks)
	}
}

// TestBlockedNetworksInvalidAbortsStartup checks that malformed values abort
// startup with an error naming the key and the offending value.
func TestBlockedNetworksInvalidAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, []abortCase{
		{
			name: "not-a-cidr",
			yaml: signingKeyLine + `blocked_networks:
  - not-a-cidr
`,
			wantErrSubstrings: []string{keyBlockedNetworks, "not-a-cidr"},
		},
		{
			name: "bare-address-without-prefix",
			yaml: signingKeyLine + `blocked_networks:
  - 10.0.0.1
`,
			wantErrSubstrings: []string{keyBlockedNetworks, "10.0.0.1"},
		},
		{
			name: "empty-entry",
			yaml: signingKeyLine + `blocked_networks:
  - ""
`,
			wantErrSubstrings: []string{keyBlockedNetworks},
		},
		{
			name: "non-string-entry",
			yaml: signingKeyLine + `blocked_networks:
  - 42
`,
			wantErrSubstrings: []string{keyBlockedNetworks},
		},
		{
			name: "null-value",
			yaml: signingKeyLine + `blocked_networks:
`,
			wantErrSubstrings: []string{keyBlockedNetworks, nullValueText},
		},
	})
}

// TestBlockedNetworksMappedEntryIsIPv4Range checks that an entry written in
// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
// since the fetcher matches an IPv4-mapped address as the IPv4 address it
// holds. /96, the shortest such entry, covers every IPv4 address.
func TestBlockedNetworksMappedEntryIsIPv4Range(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + `blocked_networks:
  - "::ffff:10.0.0.0/104"
  - "::ffff:0:0/96"
`

	c, err := configFromYAML(t, yamlContent)
	if err != nil {
		t.Fatalf("IPv4-mapped blocked_networks entries should load, got error: %v", err)
	}

	want := []string{"10.0.0.0/8", "0.0.0.0/0"}
	if len(c.BlockedNetworks) != len(want) {
		t.Fatalf("BlockedNetworks = %v, want %d entries", c.BlockedNetworks, len(want))
	}

	for i, w := range want {
		if got := c.BlockedNetworks[i].String(); got != w {
			t.Errorf("BlockedNetworks[%d] = %q, want %q", i, got, w)
		}
	}
}

// TestBlockedNetworksMappedEntryShorterThan96AbortsStartup checks that an
// entry in the IPv4-mapped form shorter than /96, which covers more than the
// IPv4 addresses, aborts startup with an error naming the key and the value.
func TestBlockedNetworksMappedEntryShorterThan96AbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, []abortCase{
		{
			name: "mapped-shorter-than-96",
			yaml: signingKeyLine + `blocked_networks:
  - "::ffff:0.0.0.0/80"
`,
			wantErrSubstrings: []string{keyBlockedNetworks, "::ffff:0.0.0.0/80"},
		},
		{
			name: "mapped-95",
			yaml: signingKeyLine + `blocked_networks:
  - "::ffff:0:0/95"
`,
			wantErrSubstrings: []string{keyBlockedNetworks},
		},
	})
}