probo/pkg/server/trustedproxy/trustedproxy_test.go

// Copyright (c) 2026 Probo Inc <hello@probo.com>.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy
// of this software and associated documentation files (the "Software"), to deal
// in the Software without restriction, including without limitation the rights
// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
// copies of the Software, and to permit persons to whom the Software is
// furnished to do so, subject to the following conditions:
//
// The above copyright notice and this permission notice shall be included in
// all copies or substantial portions of the Software.
//
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
// SOFTWARE.

package trustedproxy_test

import (
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"go.probo.inc/probo/pkg/server/trustedproxy"
)

func runMiddleware(t *testing.T, trusted []string, remoteAddr string, headers map[string]string) *http.Request {
	t.Helper()

	middleware, err := trustedproxy.NewMiddleware(trusted)
	require.NoError(t, err)

	var captured *http.Request

	handler := middleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		captured = r
	}))

	req := httptest.NewRequest(http.MethodGet, "/", nil)

	req.RemoteAddr = remoteAddr
	for k, v := range headers {
		req.Header.Set(k, v)
	}

	handler.ServeHTTP(httptest.NewRecorder(), req)

	require.NotNil(t, captured)

	return captured
}

func TestNewMiddleware_HeaderHandling(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name             string
		trusted          []string
		remoteAddr       string
		expectPreserved  bool
		forwardedHeaders map[string]string
	}{
		{
			name:            "untrusted proxy strips forwarded headers",
			trusted:         []string{"10.0.0.1"},
			remoteAddr:      "192.168.1.1:1234",
			expectPreserved: false,
		},
		{
			name:            "trusted proxy preserves forwarded headers",
			trusted:         []string{"10.0.0.1"},
			remoteAddr:      "10.0.0.1:1234",
			expectPreserved: true,
		},
		{
			name:            "empty trusted list strips all forwarded headers",
			trusted:         nil,
			remoteAddr:      "10.0.0.1:1234",
			expectPreserved: false,
		},
		{
			name:            "multiple trusted IPs",
			trusted:         []string{"10.0.0.1", "10.0.0.2"},
			remoteAddr:      "10.0.0.2:5678",
			expectPreserved: true,
		},
		{
			name:            "CIDR range trusts addresses within the range",
			trusted:         []string{"10.0.0.0/24"},
			remoteAddr:      "10.0.0.50:1234",
			expectPreserved: true,
		},
		{
			name:            "CIDR range strips addresses outside the range",
			trusted:         []string{"10.0.0.0/24"},
			remoteAddr:      "10.0.1.50:1234",
			expectPreserved: false,
		},
		{
			name:            "mixed IP and CIDR list trusts plain IP",
			trusted:         []string{"192.168.1.1", "10.0.0.0/24"},
			remoteAddr:      "192.168.1.1:1234",
			expectPreserved: true,
		},
		{
			name:            "mixed IP and CIDR list trusts address in CIDR",
			trusted:         []string{"192.168.1.1", "10.0.0.0/24"},
			remoteAddr:      "10.0.0.99:1234",
			expectPreserved: true,
		},
		{
			name:            "IPv6 CIDR range trusts addresses within the range",
			trusted:         []string{"fd00::/8"},
			remoteAddr:      "[fd12:3456::1]:1234",
			expectPreserved: true,
		},
		{
			name:            "IPv6 CIDR range strips addresses outside the range",
			trusted:         []string{"fd00::/8"},
			remoteAddr:      "[2001:db8::1]:1234",
			expectPreserved: false,
		},
	}

	const (
		xff = "203.0.113.50"
		fwd = "for=198.51.100.17"
	)

	for _, tc := range tests {
		t.Run(
			tc.name,
			func(t *testing.T) {
				t.Parallel()

				captured := runMiddleware(
					t,
					tc.trusted,
					tc.remoteAddr,
					map[string]string{
						"X-Forwarded-For": xff,
						"Forwarded":       fwd,
					},
				)

				if tc.expectPreserved {
					assert.Equal(t, xff, captured.Header.Get("X-Forwarded-For"))
					assert.Equal(t, fwd, captured.Header.Get("Forwarded"))
				} else {
					assert.Empty(t, captured.Header.Get("X-Forwarded-For"))
					assert.Empty(t, captured.Header.Get("Forwarded"))
				}
			},
		)
	}
}

func TestNewMiddleware_InvalidInput(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name    string
		trusted []string
	}{
		{
			name:    "invalid IP",
			trusted: []string{"not-an-ip"},
		},
		{
			name:    "invalid CIDR mask",
			trusted: []string{"10.0.0.0/99"},
		},
	}

	for _, tc := range tests {
		t.Run(
			tc.name,
			func(t *testing.T) {
				t.Parallel()

				_, err := trustedproxy.NewMiddleware(tc.trusted)
				require.Error(t, err)
			},
		)
	}
}