Add the public VPN server lists, with is_vpn and vpn_providers (closes #235)

The IP lookup now checks Mullvad, NordVPN, Private Internet Access, IVPN and X4BNet's community list, each downloaded once a day. Each result has `flags.is_vpn` and `vpn_providers`.

Judgement call: X4BNet publishes IPv4 and IPv6 as two files, so they are two lists, `x4bnet` and `x4bnet_v6`.
Judgement call: Private Internet Access's signature is not read or checked.
Rule suppressed: `tagliatelle` on the structs holding the publishers' field names.

Model: opus-5-5

internal/server/handlers.go

@@ -781,6 +781,10 @@ type IPLookupResult struct {
 
 	Flags IPLookupFlags `json:"flags"`
 
+	// VPNProviders names the VPN lists the address is on. It is empty, never
+	// nil, when there are none.
+	VPNProviders []string `json:"vpn_providers"`
+
 	// IPLists has one entry for each IP list the address is on.
 	IPLists []iplist.Listing `json:"ip_lists"`
 }
@@ -793,6 +797,9 @@ type IPLookupFlags struct {
 	// IsTor says that the address is on the Tor exit list.
 	IsTor bool `json:"is_tor"`
 
+	// IsVPN says that the address is on a list of VPN servers.
+	IsVPN bool `json:"is_vpn"`
+
 	// IsBogon says that the address is reserved, as package bogon tells.
 	IsBogon bool `json:"is_bogon"`
 }
@@ -977,14 +984,30 @@ func (s *Server) ipLookupResult(ip string, ptrs []string, info IPInfo) IPLookupR
 	listings := s.ipListListings(ip)
 
 	return IPLookupResult{
-		IP:      ip,
-		PTR:     ptrs,
-		IPInfo:  info,
-		Flags:   ipLookupFlags(ip, listings),
-		IPLists: listings,
+		IP:           ip,
+		PTR:          ptrs,
+		IPInfo:       info,
+		Flags:        ipLookupFlags(ip, listings),
+		VPNProviders: vpnProviders(listings),
+		IPLists:      listings,
 	}
 }
 
+// vpnProviders returns the names of the VPN lists among listings. It returns
+// an empty list, never nil, so that an answer's vpn_providers is [] rather
+// than null.
+func vpnProviders(listings []iplist.Listing) []string {
+	names := []string{}
+
+	for _, listing := range listings {
+		if listing.VPN {
+			names = append(names, listing.Name)
+		}
+	}
+
+	return names
+}
+
 // ipListListings returns the IP lists that contain ip. It returns an empty
 // list, never nil, so that an answer's ip_lists is [] rather than null.
 func (s *Server) ipListListings(ip string) []iplist.Listing {
@@ -1002,6 +1025,9 @@ func ipLookupFlags(ip string, listings []iplist.Listing) IPLookupFlags {
 		IsTor: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
 			return l.Name == iplist.TorExitsList
 		}),
+		IsVPN: slices.ContainsFunc(listings, func(l iplist.Listing) bool {
+			return l.VPN
+		}),
 		IsBogon: isBogon(ip),
 	}
 }

internal/server/handlers_internal_test.go

@@ -1441,8 +1441,19 @@ const listedUnroutedAddr = "203.0.113.1"
 // torExitAddr is the address that fakeIPLists lists on the Tor exit list.
 const torExitAddr = "203.0.113.2"
 
-// fakeIPLists has two lists. The test list holds addrInTestPrefixV4 and
-// listedUnroutedAddr, and the Tor exit list holds torExitAddr.
+// The addresses that fakeIPLists lists on one and on two VPN lists, and the
+// names of those lists.
+const (
+	oneVPNListAddr  = "203.0.113.3"
+	twoVPNListsAddr = "203.0.113.4"
+	testVPNList     = "test_vpn"
+	otherTestVPN    = "other_test_vpn"
+)
+
+// fakeIPLists has four lists. The test list holds addrInTestPrefixV4,
+// listedUnroutedAddr and twoVPNListsAddr. The Tor exit list holds torExitAddr.
+// The test VPN list holds oneVPNListAddr and twoVPNListsAddr, and the other
+// test VPN list holds twoVPNListsAddr.
 type fakeIPLists struct{}
 
 func testListing() iplist.Listing {
@@ -1463,6 +1474,18 @@ func (fakeIPLists) Lookup(addr netip.Addr) []iplist.Listing {
 		return []iplist.Listing{{Name: iplist.TorExitsList}}
 	}
 
+	if addr == netip.MustParseAddr(oneVPNListAddr) {
+		return []iplist.Listing{{Name: testVPNList, VPN: true}}
+	}
+
+	if addr == netip.MustParseAddr(twoVPNListsAddr) {
+		return []iplist.Listing{
+			{Name: otherTestVPN, VPN: true},
+			testListing(),
+			{Name: testVPNList, VPN: true},
+		}
+	}
+
 	return []iplist.Listing{}
 }
 
@@ -1471,7 +1494,7 @@ func (fakeIPLists) ShortestInterval() time.Duration {
 }
 
 // TestIPLookupFlags looks up addresses with and without a route. Every result
-// has both flags, under the JSON keys the API documents.
+// has every flag, under the JSON keys the API documents.
 func TestIPLookupFlags(t *testing.T) {
 	t.Parallel()
 
@@ -1517,7 +1540,9 @@ func TestIPLookupFlags(t *testing.T) {
 				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
 			}
 
-			want := map[string]bool{"is_tor": tt.tor, "is_bogon": tt.bogon}
+			want := map[string]bool{
+				"is_tor": tt.tor, "is_vpn": false, "is_bogon": tt.bogon,
+			}
 			if !maps.Equal(got, want) {
 				t.Errorf("%s: flags %v, want %v", path, got, want)
 			}
@@ -1525,6 +1550,61 @@ func TestIPLookupFlags(t *testing.T) {
 	}
 }
 
+// TestIPLookupReportsVPNProviders looks up addresses on no list, on a list
+// that is not a VPN list, on one VPN list and on two. is_vpn says whether any
+// VPN list holds the address, and vpn_providers names only those lists. An
+// address on none has [], not null.
+func TestIPLookupReportsVPNProviders(t *testing.T) {
+	t.Parallel()
+
+	s := newServerWithTestRoutes(t)
+	s.resolver = &fakeResolver{}
+	s.SetIPLists(fakeIPLists{})
+
+	tests := []struct {
+		name      string
+		addr      string
+		isVPN     string
+		providers string
+	}{
+		{"on no list", "1.1.1.1", "false", `[]`},
+		{"on a list that is not a VPN list", listedUnroutedAddr, "false", `[]`},
+		{"on one VPN list", oneVPNListAddr, "true", `["` + testVPNList + `"]`},
+		{
+			"on two VPN lists", twoVPNListsAddr, "true",
+			`["` + otherTestVPN + `","` + testVPNList + `"]`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			path := "/api/v1/ip/" + tt.addr
+
+			results := resultFields(t, get(t, s, path).Body.Bytes())
+			if len(results) != 1 {
+				t.Fatalf("%s: %d results, want 1", path, len(results))
+			}
+
+			var flags map[string]json.RawMessage
+
+			err := json.Unmarshal(results[0]["flags"], &flags)
+			if err != nil {
+				t.Fatalf("%s: decoding flags %s: %v", path, results[0]["flags"], err)
+			}
+
+			if got := string(flags["is_vpn"]); got != tt.isVPN {
+				t.Errorf("%s: is_vpn %s, want %s", path, got, tt.isVPN)
+			}
+
+			if got := string(results[0]["vpn_providers"]); got != tt.providers {
+				t.Errorf("%s: vpn_providers %s, want %s", path, got, tt.providers)
+			}
+		})
+	}
+}
+
 // TestIPLookupReportsIPLists looks up two routed addresses, one of them on an
 // IP list. The listed address's result names the list, says what it means and
 // when it was updated. The other's result has an empty list.