gitfor/platform

import { describe, expect, mock, test } from "bun:test";

mock.module("cloudflare:workers", () => ({
  env: { PUBLIC_URL: "https://gitfor.example.com", INTEGRATIONS_ALLOW_LOOPBACK: "false", SECRETS_KEY: "test" },
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

const { assertResolvesPublic, isNonPublicAddress } = await import("../net/resolve-guard");
const { screenMirrorPush, withoutHiddenRefs, rewritableUpdates, isPolicyRefusal } = await import("./mirror-screen");
const { reportRefName } = await import("./github-sync");
const { protectionVerdicts } = await import("../git/proxy");
const { postToTargets } = await import("./deliver");
const { stableId } = await import("./queue");

type Resolver = Parameters<typeof assertResolvesPublic>[1];
type Answer = { type: number; data: string };

function fakeDns(records: Record<string, { A?: Answer[]; AAAA?: Answer[] }>): Resolver {
  return async (name, type) => ({ Status: records[name] ? 0 : 3, Answer: records[name]?.[type] ?? [] });
}

const A = (data: string): Answer => ({ type: 1, data });
const AAAA = (data: string): Answer => ({ type: 28, data });
const CNAME = (data: string): Answer => ({ type: 5, data });

describe("DNS resolution guard", () => {
  test("classifies non-public addresses", () => {
    for (const address of [
      "127.0.0.1",
      "10.1.2.3",
      "172.16.0.1",
      "172.31.255.255",
      "192.168.1.1",
      "169.254.169.254",
      "100.64.0.1",
      "0.0.0.0",
      "224.0.0.1",