pixa/internal/config/trusted_proxies_internal_test.go

package config

import (
	"strings"
	"testing"
)

// TestTrustedProxiesConfig checks the trusted_proxies key wiring: an
// explicit CIDR list lands in TrustedProxies in order and replaces the
// default, an omitted key falls back to the RFC 1918 private ranges, and an
// explicitly empty list trusts no one. The list parser itself is shared with
// blocked_networks and is exercised in depth by that key's tests.
func TestTrustedProxiesConfig(t *testing.T) {
	t.Parallel()

	t.Run("explicit list replaces the default in order", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t,
			signingKeyLine+`trusted_proxies: ["10.0.0.0/8", "2001:db8::/32"]`+"\n")
		if err != nil {
			t.Fatalf("valid trusted_proxies should load: %v", err)
		}

		got := make([]string, len(c.TrustedProxies))
		for i, p := range c.TrustedProxies {
			got[i] = p.String()
		}

		if joined := strings.Join(got, ","); joined != "10.0.0.0/8,2001:db8::/32" {
			t.Errorf("TrustedProxies = %v, want the two ranges in order", got)
		}
	})

	t.Run("omitted key defaults to the RFC 1918 ranges", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t, signingKeyLine)
		if err != nil {
			t.Fatalf("minimal config should load: %v", err)
		}

		got := make([]string, len(c.TrustedProxies))
		for i, p := range c.TrustedProxies {
			got[i] = p.String()
		}

		want := "10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"
		if joined := strings.Join(got, ","); joined != want {
			t.Errorf("TrustedProxies = %v, want the RFC 1918 ranges %q", got, want)
		}
	})

	t.Run("explicitly empty list trusts no one", func(t *testing.T) {
		t.Parallel()

		c, err := configFromYAML(t, signingKeyLine+"trusted_proxies: []\n")
		if err != nil {
			t.Fatalf("empty trusted_proxies should load: %v", err)
		}

		if len(c.TrustedProxies) != 0 {
			t.Errorf("TrustedProxies = %v, want empty", c.TrustedProxies)
		}
	})
}

// TestTrustedProxiesInvalidAbortsStartup checks that an invalid or null
// value aborts startup with an error naming the key and the offending value.
func TestTrustedProxiesInvalidAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, []abortCase{
		{
			name:              "invalid cidr",
			yaml:              signingKeyLine + `trusted_proxies: ["999.0.0.0/8"]` + "\n",
			wantErrSubstrings: []string{keyTrustedProxies, "999.0.0.0/8"},
		},
		{
			name:              "null value",
			yaml:              signingKeyLine + "trusted_proxies:\n",
			wantErrSubstrings: []string{keyTrustedProxies, nullValueText},
		},
	})
}

// TestTrustedProxiesMappedEntryIsIPv4Range checks that an entry written in
// the IPv4-mapped form (::ffff:a.b.c.d) is kept as the IPv4 range it covers,
// since the client address is matched as the IPv4 address it holds. /96, the
// shortest such entry, covers every IPv4 address.
func TestTrustedProxiesMappedEntryIsIPv4Range(t *testing.T) {
	t.Parallel()

	c, err := configFromYAML(t, signingKeyLine+
		`trusted_proxies: ["::ffff:10.0.0.0/104", "::ffff:0:0/96"]`+"\n")
	if err != nil {
		t.Fatalf("IPv4-mapped trusted_proxies entries should load: %v", err)
	}

	got := make([]string, len(c.TrustedProxies))
	for i, p := range c.TrustedProxies {
		got[i] = p.String()
	}

	if joined := strings.Join(got, ","); joined != "10.0.0.0/8,0.0.0.0/0" {
		t.Errorf("TrustedProxies = %v, want 10.0.0.0/8 and 0.0.0.0/0", got)
	}
}

// TestTrustedProxiesMappedEntryShorterThan96AbortsStartup checks that an
// entry in the IPv4-mapped form shorter than /96, which covers more than the
// IPv4 addresses, aborts startup with an error naming the key and the value.
func TestTrustedProxiesMappedEntryShorterThan96AbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, []abortCase{
		{
			name:              "mapped-95",
			yaml:              signingKeyLine + `trusted_proxies: ["::ffff:0:0/95"]` + "\n",
			wantErrSubstrings: []string{keyTrustedProxies, "::ffff:0:0/95"},
		},
	})
}