spb/tendril Public

1// author: simon-pierre boucher <contact@spboucher.ai>2import { describe, expect, it } from "vitest";3import { isBlockedIp } from "./ip.js";45describe("isBlockedIp", () => {6  it("blocks loopback", () => {7    expect(isBlockedIp("127.0.0.1")).toBe(true);8    expect(isBlockedIp("127.10.20.30")).toBe(true);9    expect(isBlockedIp("::1")).toBe(true);10  });1112  it("blocks RFC1918 ranges", () => {13    expect(isBlockedIp("10.0.0.1")).toBe(true);14    expect(isBlockedIp("172.16.5.4")).toBe(true);15    expect(isBlockedIp("172.31.255.255")).toBe(true);16    expect(isBlockedIp("192.168.1.1")).toBe(true);17  });1819  it("does not block 172.32.x (outside the /12)", () => {20    expect(isBlockedIp("172.32.0.1")).toBe(false);21  });2223  it("blocks the cloud metadata address", () => {24    expect(isBlockedIp("169.254.169.254")).toBe(true);25  });2627  it("blocks link-local and CGNAT", () => {28    expect(isBlockedIp("169.254.1.1")).toBe(true);29    expect(isBlockedIp("100.64.0.1")).toBe(true);30  });3132  it("blocks IPv6 ULA and link-local", () => {33    expect(isBlockedIp("fc00::1")).toBe(true);34    expect(isBlockedIp("fd12:3456::1")).toBe(true);35    expect(isBlockedIp("fe80::1")).toBe(true);36  });3738  it("unwraps IPv4-mapped IPv6 and blocks private embeds", () => {39    expect(isBlockedIp("::ffff:127.0.0.1")).toBe(true);40    expect(isBlockedIp("::ffff:10.0.0.1")).toBe(true);41  });4243  it("allows public addresses", () => {44    expect(isBlockedIp("8.8.8.8")).toBe(false);45    expect(isBlockedIp("1.1.1.1")).toBe(false);46    expect(isBlockedIp("93.184.216.34")).toBe(false);47    expect(isBlockedIp("2606:4700:4700::1111")).toBe(false);48  });4950  it("blocks garbage input", () => {51    expect(isBlockedIp("not-an-ip")).toBe(true);52    expect(isBlockedIp("999.1.1.1")).toBe(true);53  });54});55