import { describe, expect, it } from 'vitest';
import { isIpAllowed } from '../../security/ip-allowlist.js';
describe('isIpAllowed', () => {
    it('allows everything when allowlist is empty', () => {
        expect(isIpAllowed('203.0.113.5', [])).toBe(true);
    });
    it('rejects the literal "unknown" sentinel against a non-empty allowlist', () => {
        expect(isIpAllowed('unknown', ['203.0.113.5'])).toBe(false);
    });
    it('still allows "unknown" when no allowlist is configured', () => {
        // Empty allowlist means "no IP restriction at all". The middleware
        // separately decides whether unknown IPs should be allowed via
        // isResolvedIp() before consulting this helper.
        expect(isIpAllowed('unknown', [])).toBe(true);
    });
    it('matches a literal IPv4 address', () => {
        expect(isIpAllowed('203.0.113.5', ['203.0.113.5'])).toBe(true);
        expect(isIpAllowed('203.0.113.6', ['203.0.113.5'])).toBe(false);
    });
    it('matches an IPv4 CIDR range', () => {
        expect(isIpAllowed('203.0.113.42', ['203.0.113.0/24'])).toBe(true);
        expect(isIpAllowed('203.0.114.42', ['203.0.113.0/24'])).toBe(false);
    });
    it('matches a literal IPv6 address with normalisation', () => {
        expect(isIpAllowed('2001:db8::1', ['2001:db8:0:0:0:0:0:1'])).toBe(true);
    });
    it('matches an IPv6 CIDR range', () => {
        expect(isIpAllowed('2001:db8:abcd::1', ['2001:db8::/32'])).toBe(true);
        expect(isIpAllowed('2001:db9::1', ['2001:db8::/32'])).toBe(false);
    });
    it('normalises IPv4-mapped IPv6 addresses', () => {
        expect(isIpAllowed('::ffff:203.0.113.5', ['203.0.113.5'])).toBe(true);
        expect(isIpAllowed('::ffff:203.0.113.5', ['203.0.113.0/24'])).toBe(true);
    });
    it('rejects malformed CIDR values', () => {
        expect(isIpAllowed('203.0.113.5', ['203.0.113.0/abc'])).toBe(false);
        expect(isIpAllowed('203.0.113.5', ['203.0.113.0/-1'])).toBe(false);
    });
});
//# sourceMappingURL=ip-allowlist.test.js.map