v0.29.2

src/vhost/tests.rs

@@ -147,6 +147,44 @@ mod default_listener_tests {
         .unwrap();
         assert!(vhost.validate().is_ok());
     }
+
+    #[test]
+    fn error_fallback_requires_internal_target_and_rejects_cycles() {
+        let base = json!({
+            "id": "fallback-test",
+            "frontend": {"hosts": ["example.test"], "listener_ids": ["http"]},
+            "backends": [{"id": "origin", "url": "http://127.0.0.1:9001", "allow_private": true}],
+            "error_fallback": {"target": "redirect-check", "statuses": [503, 404, 404]},
+            "routes": [{
+                "id": "redirect-check",
+                "internal": true,
+                "path_prefix": "/",
+                "source": {"type": "reverse_proxy"}
+            }]
+        });
+        let mut valid: Vhost = serde_json::from_value(base.clone()).unwrap();
+        valid.validate().unwrap();
+        assert_eq!(valid.error_fallback.as_ref().unwrap().statuses, vec![404, 503]);
+
+        let mut public_target: Vhost = serde_json::from_value(base.clone()).unwrap();
+        public_target.routes[0].internal = false;
+        assert!(public_target
+            .validate()
+            .unwrap_err()
+            .to_string()
+            .contains("internal location"));
+
+        let mut cyclic: Vhost = serde_json::from_value(base).unwrap();
+        cyclic.routes[0].error_fallback = Some(ErrorFallback {
+            target: "redirect-check".into(),
+            statuses: vec![404],
+        });
+        assert!(cyclic
+            .validate()
+            .unwrap_err()
+            .to_string()
+            .contains("recursive error fallback"));
+    }
     #[test]
     fn collision_explains_addresses_owners_and_protocol_limits() {
         let mut config = Config::default();