gunnar-grpc 2.0.0

//! **The guard on the loopback default.**
//!
//! gRPC v1 is unauthenticated on purpose. The one thing that keeps that a
//! *local* hole rather than a *remote* one is the loopback default bind. If
//! someone changes it to `0.0.0.0`, this file goes red.
//!
//! Every assertion here is written to be able to fail. A test that only said
//! "the default is the default" would pass forever while proving nothing.

use std::net::{IpAddr, Ipv4Addr, SocketAddr};

use gunnar_grpc::{ServerConfig, AUTHENTICATION_ENABLED, DEFAULT_BIND};

#[test]
fn default_bind_is_loopback() {
    let config = ServerConfig::default();

    assert!(
        config.is_loopback_bind(),
        "gunnar-grpc's default bind is {}, which is NOT loopback. gRPC v1 is \
         unauthenticated: every control-plane mutation — principals, keys, grants, branch \
         protection, repo create/delete — would be served to anyone who can reach it. Bind \
         127.0.0.1 until gRPC authentication ships.",
        config.bind
    );

    // Pinned by value, not just by predicate: `is_loopback` would also accept
    // 127.0.0.2, and the port is part of what dwarves/korp connect to.
    assert_eq!(
        config.bind,
        SocketAddr::new(IpAddr::V4(Ipv4Addr::new(127, 0, 0, 1)), 50051),
        "the documented default is 127.0.0.1:50051"
    );
    assert_eq!(config.bind, DEFAULT_BIND);
}

#[test]
fn the_default_is_not_a_wildcard_bind() {
    // The specific mistake the two-listener split names. `is_unspecified()` is true for both
    // 0.0.0.0 and [::], which are the two ways to make this remote.
    assert!(
        !DEFAULT_BIND.ip().is_unspecified(),
        "DEFAULT_BIND is a wildcard address ({}), exposing the unauthenticated control plane \
         to the network",
        DEFAULT_BIND.ip()
    );
}

#[test]
fn the_loopback_predicate_can_say_no() {
    // The identity-value trap: a predicate that returned true for
    // everything would satisfy `default_bind_is_loopback` while detecting
    // nothing. Prove it distinguishes.
    let wildcard = ServerConfig::default().with_bind("0.0.0.0:50051".parse().unwrap());
    assert!(
        !wildcard.is_loopback_bind(),
        "0.0.0.0 must not be reported as loopback"
    );

    let routable = ServerConfig::default().with_bind("10.0.0.5:50051".parse().unwrap());
    assert!(
        !routable.is_loopback_bind(),
        "a LAN address must not be reported as loopback"
    );

    let v6_wildcard = ServerConfig::default().with_bind("[::]:50051".parse().unwrap());
    assert!(!v6_wildcard.is_loopback_bind());

    // …and still says yes where it should, including over IPv6.
    let v6_loopback = ServerConfig::default().with_bind("[::1]:50051".parse().unwrap());
    assert!(v6_loopback.is_loopback_bind());
}

#[test]
// The constant IS the assertion: this test exists so that flipping
// AUTHENTICATION_ENABLED cannot be done as a side effect of something else.
#[allow(clippy::assertions_on_constants)]
fn this_build_authenticates_grpc() {
    // Revisited deliberately on 2026-08-03, which is what the previous version
    // of this test asked for: the hole is closed, the gate is `gunnar_grpc::auth`,
    // and `tests/auth.rs` proves it refuses in both directions. Flipping this
    // back would mean deleting that gate, and nobody gets to do that as a side
    // effect either.
    assert!(
        AUTHENTICATION_ENABLED,
        "AUTHENTICATION_ENABLED is false, but gunnar-grpc has an auth gate. Either it was \
         deleted (then delete tests/auth.rs too, and say so in the README) or the constant \
         is lying to `Admin.Health`."
    );
}

#[test]
fn the_default_config_requires_a_credential() {
    // The load-bearing default. `AUTHENTICATION_ENABLED` is about the build;
    // this is about what a config nobody has spoken to actually does.
    assert!(
        ServerConfig::default().authentication_enabled(),
        "a freshly constructed ServerConfig serves allow-all. Deny by default is the whole \
         point of closing the allow-all hole."
    );

    // …and the predicate can say no, so the assertion above is not sitting on
    // an identity value (measured, not asserted).
    assert!(
        !ServerConfig::default()
            .insecure_allow_all_for_local_development()
            .authentication_enabled(),
        "the development escape hatch did not turn authentication off, so the assertion \
         above proves nothing"
    );
}

#[test]
fn event_buffer_default_is_bounded_and_nonzero() {
    let config = ServerConfig::default();
    assert!(
        config.event_buffer > 0,
        "a zero-capacity ring cannot deliver"
    );
    assert!(
        config.event_buffer <= 65_536,
        "the event buffer is a HARD bound on retained events, not a growth budget"
    );
    // A zero passed in must not become a channel that panics on construction.
    assert_eq!(ServerConfig::default().with_event_buffer(0).event_buffer, 1);
}