v0.34.4

src/acl/tests.rs

@@ -272,4 +272,92 @@ mod tests {
         assert!(matches!(routing_path_view("/%61").unwrap(), Cow::Owned(_)));
         assert!(routing_path_view(&format!("/{}", "x".repeat(8192))).is_err());
     }
+    fn profile(default: Action, rules: &[(&str, Action)], mode: crate::rate_limit::CountryMode, countries: &[&str]) -> ProfileAccess {
+        ProfileAccess {
+            acl: Some(Acl {
+                default,
+                rules: rules.iter().map(|(network, action)| Rule {
+                    network: (*network).into(), action: *action,
+                }).collect(),
+            }.compile().unwrap()),
+            countries: crate::rate_limit::CountryAccess {
+                mode,
+                countries: countries.iter().map(|s| (*s).into()).collect(),
+            },
+        }
+    }
+
+    #[test]
+    fn two_acl_profiles_union_explicit_allow_but_retain_default_deny() {
+        use crate::rate_limit::CountryMode::Off;
+        let profiles = vec![
+            profile(Action::Deny, &[("10.0.0.0/8", Action::Allow)], Off, &[]),
+            profile(Action::Deny, &[("192.0.2.0/24", Action::Allow)], Off, &[]),
+        ];
+        assert!(allows_profiles_with_country(&profiles, "10.1.2.3".parse().unwrap(), None));
+        assert!(allows_profiles_with_country(&profiles, "192.0.2.1".parse().unwrap(), None));
+        assert!(!allows_profiles_with_country(&profiles, "203.0.113.9".parse().unwrap(), None));
+    }
+
+    #[test]
+    fn explicit_deny_has_priority_over_any_matching_allow() {
+        use crate::rate_limit::CountryMode::Off;
+        let profiles = vec![
+            profile(Action::Allow, &[("0.0.0.0/0", Action::Allow)], Off, &[]),
+            profile(Action::Deny, &[("198.51.100.0/24", Action::Deny)], Off, &[]),
+        ];
+        assert!(!allows_profiles_with_country(&profiles, "198.51.100.5".parse().unwrap(), Some("PL")));
+        assert!(allows_profiles_with_country(&profiles, "203.0.113.5".parse().unwrap(), Some("PL")));
+        let conflicting = vec![
+            profiles[0].clone(),
+            profile(Action::Deny, &[("0.0.0.0/0", Action::Deny)], Off, &[]),
+        ];
+        assert!(!allows_profiles_with_country(&conflicting, "203.0.113.5".parse().unwrap(), None));
+    }
+
+    #[test]
+    fn country_block_wins_across_profiles_and_geo_allow_merges_with_ip_allow() {
+        use crate::rate_limit::CountryMode::{Allow, Block};
+        let profiles = vec![
+            profile(Action::Deny, &[("10.0.0.0/8", Action::Allow)], Allow, &["PL"]),
+            profile(Action::Deny, &[], Block, &["CN"]),
+        ];
+        assert!(allows_profiles_with_country(&profiles, "203.0.113.7".parse().unwrap(), Some("pl")));
+        assert!(allows_profiles_with_country(&profiles, "10.2.3.4".parse().unwrap(), Some("US")));
+        assert!(!allows_profiles_with_country(&profiles, "10.2.3.4".parse().unwrap(), Some("CN")));
+        assert!(!allows_profiles_with_country(&profiles, "203.0.113.7".parse().unwrap(), Some("US")));
+    }
+
+    #[test]
+    fn defaults_require_consensus_and_inline_restrictions_still_deny() {
+        use crate::rate_limit::CountryMode::Off;
+        let profiles = vec![profile(Action::Allow, &[], Off, &[]), profile(Action::Deny, &[], Off, &[])];
+        let peer = "203.0.113.5".parse().unwrap();
+        assert!(!allows_profiles_with_country(&profiles, peer, None));
+        let all_allow = vec![profile(Action::Allow, &[], Off, &[]), profile(Action::Allow, &[], Off, &[])];
+        assert!(allows_profiles_with_country(&all_allow, peer, None));
+        let inline = Acl { default: Action::Deny, rules: vec![] }.compile().unwrap();
+        assert!(!(allows_profiles_with_country(&all_allow, peer, None) && inline.allows(peer)));
+        assert!(allows_profiles_with_country(&[], peer, None));
+    }
+
+    #[test]
+    fn singular_profile_keeps_legacy_behavior_and_ids_validate() {
+        use crate::rate_limit::CountryMode::Allow;
+        let single = profile(Action::Allow, &[], Allow, &["DE"]);
+        for country in [None, Some("DE"), Some("PL")] {
+            for peer in ["10.1.2.3", "203.0.113.5"] {
+                let peer = peer.parse().unwrap();
+                assert_eq!(
+                    allows_profiles_with_country(&[single.clone()], peer, country),
+                    allows_with_country(single.acl.as_ref(), &single.countries, peer, country),
+                );
+            }
+        }
+        assert!(validate_profile_ids(Some("old"), &["new".into()]).is_ok());
+        assert!(validate_profile_ids(Some("same"), &["same".into()]).is_err());
+        assert!(validate_profile_ids(None, &vec!["id".into(); 2]).is_err());
+        assert!(validate_profile_ids(Some("old"), &(0..8).map(|v| format!("profile{v}")).collect::<Vec<_>>()).is_err());
+    }
+
 }