cinny/src/app/utils/serverAcl.test.ts

import { test } from 'node:test';
import assert from 'node:assert/strict';
import {
  isValidServerPattern,
  globToRegExp,
  matchesAnyGlob,
  normalizeServerAcl,
} from './serverAcl';

test('isValidServerPattern: accepts hostnames, IPs, and globs', () => {
  for (const v of [
    '*',
    '*.example.com',
    'matrix.org',
    '1.2.3.*',
    '10.0.0.?',
    '*.evil.*',
    '*bad*',
  ]) {
    assert.equal(isValidServerPattern(v), true, v);
  }
});

test('isValidServerPattern: rejects empty, malformed, and non-glob junk', () => {
  for (const v of ['', '   ', '.foo', 'foo.', 'a..b', '-', ':', 'under_score', 'a,b', 'a b']) {
    assert.equal(isValidServerPattern(v), false, v);
  }
});

test('globToRegExp: * = any run, ? = single char, other metachars escaped', () => {
  assert.equal(globToRegExp('*').test('anything.org'), true);
  assert.equal(globToRegExp('*.evil.com').test('a.evil.com'), true);
  assert.equal(globToRegExp('*.evil.com').test('evil.com'), false); // needs the leading label
  assert.equal(globToRegExp('1.2.3.?').test('1.2.3.4'), true);
  assert.equal(globToRegExp('1.2.3.?').test('1.2.3.45'), false);
  // The dot is a literal, not a regex wildcard.
  assert.equal(globToRegExp('a.b').test('axb'), false);
});

test('globToRegExp: case-insensitive (hostnames + Synapse IGNORECASE)', () => {
  assert.equal(globToRegExp('MATRIX.foo.org').test('matrix.foo.org'), true);
});

test('matchesAnyGlob: true if any glob matches (self-ban detection)', () => {
  assert.equal(matchesAnyGlob('lotusguild.org', ['*']), true);
  assert.equal(matchesAnyGlob('lotusguild.org', ['*.evil.com', 'lotus*.org']), true);
  assert.equal(matchesAnyGlob('lotusguild.org', ['*.evil.com']), false);
  assert.equal(matchesAnyGlob('lotusguild.org', []), false);
});

test('no ACL event: every server allowed, IP literals allowed (#261)', () => {
  assert.deepEqual(normalizeServerAcl(undefined), {
    allow: ['*'],
    deny: [],
    allow_ip_literals: true,
  });
});

test('a missing allow_ip_literals defaults to true, per the spec (#261)', () => {
  assert.equal(normalizeServerAcl({ allow: ['*'], deny: ['bad.example'] }).allow_ip_literals, true);
});

test('an explicit allow_ip_literals is kept', () => {
  assert.equal(
    normalizeServerAcl({ allow: ['*'], allow_ip_literals: false }).allow_ip_literals,
    false,
  );
  assert.equal(
    normalizeServerAcl({ allow: ['*'], allow_ip_literals: true }).allow_ip_literals,
    true,
  );
});

test('missing or malformed lists become empty, non-strings are dropped', () => {
  assert.deepEqual(normalizeServerAcl({ allow: ['a.example', 3, null] }), {
    allow: ['a.example'],
    deny: [],
    allow_ip_literals: true,
  });
  assert.deepEqual(normalizeServerAcl({ allow: 'a.example', deny: {} }).allow, []);
});