|
| 1 | +/** |
| 2 | + * @vitest-environment node |
| 3 | + */ |
| 4 | +import { createEnvMock } from '@sim/testing' |
| 5 | +import { afterEach, describe, expect, it, vi } from 'vitest' |
| 6 | + |
| 7 | +vi.mock('@/lib/core/config/env', () => createEnvMock()) |
| 8 | + |
| 9 | +import { env } from '@/lib/core/config/env' |
| 10 | +import { |
| 11 | + __resetAllowedPrivateHostsCacheForTest, |
| 12 | + getAllowedPrivateHostsFromEnv, |
| 13 | + isAllowlistedPrivateHost, |
| 14 | +} from '@/lib/core/config/feature-flags' |
| 15 | + |
| 16 | +function withAllowedPrivateHosts(value: string | undefined) { |
| 17 | + ;(env as { ALLOWED_PRIVATE_HOSTS?: string }).ALLOWED_PRIVATE_HOSTS = value |
| 18 | + __resetAllowedPrivateHostsCacheForTest() |
| 19 | +} |
| 20 | + |
| 21 | +describe('getAllowedPrivateHostsFromEnv', () => { |
| 22 | + afterEach(() => { |
| 23 | + withAllowedPrivateHosts(undefined) |
| 24 | + }) |
| 25 | + |
| 26 | + it('returns null when env var is unset', () => { |
| 27 | + expect(getAllowedPrivateHostsFromEnv()).toBeNull() |
| 28 | + }) |
| 29 | + |
| 30 | + it('returns null when env var is empty after trimming', () => { |
| 31 | + withAllowedPrivateHosts(' , , ') |
| 32 | + expect(getAllowedPrivateHostsFromEnv()).toBeNull() |
| 33 | + }) |
| 34 | + |
| 35 | + it('parses bare hostnames into the hostname set (lowercased)', () => { |
| 36 | + withAllowedPrivateHosts('Gitlab.Allot.Internal,siem.allot.internal') |
| 37 | + const result = getAllowedPrivateHostsFromEnv() |
| 38 | + expect(result?.hostnames).toEqual(new Set(['gitlab.allot.internal', 'siem.allot.internal'])) |
| 39 | + expect(result?.cidrs).toEqual([]) |
| 40 | + }) |
| 41 | + |
| 42 | + it('parses literal IPs as exact /32 or /128 CIDRs', () => { |
| 43 | + withAllowedPrivateHosts('10.112.12.56,fd00::1') |
| 44 | + const result = getAllowedPrivateHostsFromEnv() |
| 45 | + expect(result?.cidrs).toHaveLength(2) |
| 46 | + expect(result?.cidrs[0][1]).toBe(32) |
| 47 | + expect(result?.cidrs[1][1]).toBe(128) |
| 48 | + }) |
| 49 | + |
| 50 | + it('parses CIDR ranges', () => { |
| 51 | + withAllowedPrivateHosts('10.0.0.0/8,fd00::/8') |
| 52 | + const result = getAllowedPrivateHostsFromEnv() |
| 53 | + expect(result?.cidrs).toHaveLength(2) |
| 54 | + expect(result?.cidrs[0][1]).toBe(8) |
| 55 | + expect(result?.cidrs[1][1]).toBe(8) |
| 56 | + }) |
| 57 | + |
| 58 | + it('mixes hostnames, IPs, and CIDRs in one list', () => { |
| 59 | + withAllowedPrivateHosts('gitlab.internal, 10.0.0.0/8 ,10.112.12.56 ') |
| 60 | + const result = getAllowedPrivateHostsFromEnv() |
| 61 | + expect(result?.hostnames.has('gitlab.internal')).toBe(true) |
| 62 | + expect(result?.cidrs).toHaveLength(2) |
| 63 | + }) |
| 64 | + |
| 65 | + it('falls back to hostname when CIDR parse fails', () => { |
| 66 | + withAllowedPrivateHosts('not-a-cidr/bogus') |
| 67 | + const result = getAllowedPrivateHostsFromEnv() |
| 68 | + expect(result?.hostnames.has('not-a-cidr/bogus')).toBe(true) |
| 69 | + }) |
| 70 | + |
| 71 | + it('caches the parse result across calls', () => { |
| 72 | + withAllowedPrivateHosts('gitlab.internal') |
| 73 | + const first = getAllowedPrivateHostsFromEnv() |
| 74 | + ;(env as { ALLOWED_PRIVATE_HOSTS?: string }).ALLOWED_PRIVATE_HOSTS = 'changed.internal' |
| 75 | + expect(getAllowedPrivateHostsFromEnv()).toBe(first) |
| 76 | + }) |
| 77 | +}) |
| 78 | + |
| 79 | +describe('isAllowlistedPrivateHost', () => { |
| 80 | + afterEach(() => { |
| 81 | + withAllowedPrivateHosts(undefined) |
| 82 | + }) |
| 83 | + |
| 84 | + it('returns false when env var is unset', () => { |
| 85 | + expect(isAllowlistedPrivateHost({ ip: '10.0.0.1' })).toBe(false) |
| 86 | + expect(isAllowlistedPrivateHost({ hostname: 'gitlab.internal' })).toBe(false) |
| 87 | + }) |
| 88 | + |
| 89 | + it('matches hostnames case-insensitively', () => { |
| 90 | + withAllowedPrivateHosts('gitlab.allot.internal') |
| 91 | + expect(isAllowlistedPrivateHost({ hostname: 'GITLAB.ALLOT.INTERNAL' })).toBe(true) |
| 92 | + expect(isAllowlistedPrivateHost({ hostname: 'other.internal' })).toBe(false) |
| 93 | + }) |
| 94 | + |
| 95 | + it('matches literal IPv4 entries', () => { |
| 96 | + withAllowedPrivateHosts('10.112.12.56') |
| 97 | + expect(isAllowlistedPrivateHost({ ip: '10.112.12.56' })).toBe(true) |
| 98 | + expect(isAllowlistedPrivateHost({ ip: '10.112.12.57' })).toBe(false) |
| 99 | + }) |
| 100 | + |
| 101 | + it('matches IPv4 CIDR ranges', () => { |
| 102 | + withAllowedPrivateHosts('10.0.0.0/8') |
| 103 | + expect(isAllowlistedPrivateHost({ ip: '10.0.0.1' })).toBe(true) |
| 104 | + expect(isAllowlistedPrivateHost({ ip: '10.255.255.255' })).toBe(true) |
| 105 | + expect(isAllowlistedPrivateHost({ ip: '11.0.0.1' })).toBe(false) |
| 106 | + expect(isAllowlistedPrivateHost({ ip: '192.168.1.1' })).toBe(false) |
| 107 | + }) |
| 108 | + |
| 109 | + it('matches IPv6 CIDR ranges', () => { |
| 110 | + withAllowedPrivateHosts('fc00::/7') |
| 111 | + expect(isAllowlistedPrivateHost({ ip: 'fd00::1' })).toBe(true) |
| 112 | + expect(isAllowlistedPrivateHost({ ip: 'fd12:3456::1' })).toBe(true) |
| 113 | + expect(isAllowlistedPrivateHost({ ip: 'fc00::1' })).toBe(true) |
| 114 | + expect(isAllowlistedPrivateHost({ ip: '2001:db8::1' })).toBe(false) |
| 115 | + }) |
| 116 | + |
| 117 | + it('does not cross-match IPv4 and IPv6 ranges', () => { |
| 118 | + withAllowedPrivateHosts('10.0.0.0/8') |
| 119 | + expect(isAllowlistedPrivateHost({ ip: 'fd00::1' })).toBe(false) |
| 120 | + }) |
| 121 | + |
| 122 | + it('returns true if either hostname or IP matches', () => { |
| 123 | + withAllowedPrivateHosts('gitlab.allot.internal,10.0.0.0/8') |
| 124 | + expect(isAllowlistedPrivateHost({ hostname: 'gitlab.allot.internal', ip: '8.8.8.8' })).toBe( |
| 125 | + true |
| 126 | + ) |
| 127 | + expect(isAllowlistedPrivateHost({ hostname: 'other.internal', ip: '10.5.5.5' })).toBe(true) |
| 128 | + }) |
| 129 | + |
| 130 | + it('returns false for unparseable IPs', () => { |
| 131 | + withAllowedPrivateHosts('10.0.0.0/8') |
| 132 | + expect(isAllowlistedPrivateHost({ ip: 'not-an-ip' })).toBe(false) |
| 133 | + }) |
| 134 | +}) |
0 commit comments