tellaro_query_language/mutators/

network.rs

//! Network and security mutators for TQL.
//!
//! Provides transformations for defanging and refanging URLs and indicators.

use super::{Mutator, MutatorParams};
use crate::error::Result;
use once_cell::sync::Lazy;
use regex::Regex;
use serde_json::{json, Value as JsonValue};
use std::net::IpAddr;

// ============================================================================
// Pre-compiled regex patterns for refang/defang operations
// ============================================================================

// Refang: protocol patterns
static RE_REFANG_HTTPS: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)h[xX]{1,2}ps://").unwrap());
static RE_REFANG_HTTP: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)h[xX]{1,2}p://").unwrap());
static RE_REFANG_FTP: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)f[xX]p://").unwrap());

// Refang: bracketed replacements
static RE_REFANG_BRACKET_DOT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\[\.\]\s*").unwrap());
static RE_REFANG_BRACKET_COLON: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\[:\]\s*").unwrap());
static RE_REFANG_BRACKET_AT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\[@\]\s*").unwrap());
static RE_REFANG_BRACKET_SLASH: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\[/\]\s*").unwrap());

// Refang: parentheses replacements
static RE_REFANG_PAREN_DOT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\(\.\)\s*").unwrap());
static RE_REFANG_PAREN_COLON: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\(:\)\s*").unwrap());
static RE_REFANG_PAREN_AT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\(@\)\s*").unwrap());
static RE_REFANG_PAREN_SLASH: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\(/\)\s*").unwrap());

// Refang: braces replacements
static RE_REFANG_BRACE_DOT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\{\.\}\s*").unwrap());
static RE_REFANG_BRACE_COLON: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\{:\}\s*").unwrap());
static RE_REFANG_BRACE_AT: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\{@\}\s*").unwrap());
static RE_REFANG_BRACE_SLASH: Lazy<Regex> = Lazy::new(|| Regex::new(r"\s*\{/\}\s*").unwrap());

// Refang: word replacements
static RE_REFANG_WORD_AT_BRACKET: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\[at\]\s*").unwrap());
static RE_REFANG_WORD_AT_PAREN: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\(at\)\s*").unwrap());
static RE_REFANG_WORD_AT_BRACE: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\{at\}\s*").unwrap());
static RE_REFANG_WORD_DOT_BRACKET: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\[dot\]\s*").unwrap());
static RE_REFANG_WORD_DOT_PAREN: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\(dot\)\s*").unwrap());
static RE_REFANG_WORD_DOT_BRACE: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"(?i)\s*\{dot\}\s*").unwrap());

// Defang: protocol patterns
static RE_DEFANG_HTTPS: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)https://").unwrap());
static RE_DEFANG_HTTP: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)http://").unwrap());
static RE_DEFANG_FTP: Lazy<Regex> = Lazy::new(|| Regex::new(r"(?i)ftp://").unwrap());

// Defang: URL and port patterns
static RE_DEFANG_URL: Lazy<Regex> =
    Lazy::new(|| Regex::new(r"((?:hxxps?|fxp|https?|ftp)://[^\s]+)").unwrap());
static RE_DEFANG_PORT: Lazy<Regex> = Lazy::new(|| Regex::new(r":(\d+)").unwrap());

/// Mutator that refangs (un-defangs) URLs and indicators
///
/// Reverses common defanging patterns to make URLs and indicators active again:
/// - hXXp:// -> http://
/// - hXXps:// -> https://
/// - [.] -> .
/// - [:] -> :
/// - [at] -> @
/// - fXp:// -> ftp://
pub struct RefangMutator {
    _params: MutatorParams,
}

impl RefangMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn refang_string(&self, s: &str) -> String {
        let mut result = s.to_string();

        // Handle various protocol defanging patterns (case insensitive)
        // Important: Check for 'ps' suffix first to avoid false matches
        result = RE_REFANG_HTTPS.replace_all(&result, "https://").to_string();
        result = RE_REFANG_HTTP.replace_all(&result, "http://").to_string();
        result = RE_REFANG_FTP.replace_all(&result, "ftp://").to_string();

        // Handle bracketed replacements with optional spaces
        let patterns: &[(&Lazy<Regex>, &str)] = &[
            (&RE_REFANG_BRACKET_DOT, "."),
            (&RE_REFANG_BRACKET_COLON, ":"),
            (&RE_REFANG_BRACKET_AT, "@"),
            (&RE_REFANG_BRACKET_SLASH, "/"),
            (&RE_REFANG_PAREN_DOT, "."),
            (&RE_REFANG_PAREN_COLON, ":"),
            (&RE_REFANG_PAREN_AT, "@"),
            (&RE_REFANG_PAREN_SLASH, "/"),
            (&RE_REFANG_BRACE_DOT, "."),
            (&RE_REFANG_BRACE_COLON, ":"),
            (&RE_REFANG_BRACE_AT, "@"),
            (&RE_REFANG_BRACE_SLASH, "/"),
        ];

        for (re, replacement) in patterns {
            result = re.replace_all(&result, *replacement).to_string();
        }

        // Handle word replacements with optional brackets/parentheses/braces (case insensitive)
        result = RE_REFANG_WORD_AT_BRACKET
            .replace_all(&result, "@")
            .to_string();
        result = RE_REFANG_WORD_AT_PAREN
            .replace_all(&result, "@")
            .to_string();
        result = RE_REFANG_WORD_AT_BRACE
            .replace_all(&result, "@")
            .to_string();
        result = RE_REFANG_WORD_DOT_BRACKET
            .replace_all(&result, ".")
            .to_string();
        result = RE_REFANG_WORD_DOT_PAREN
            .replace_all(&result, ".")
            .to_string();
        result = RE_REFANG_WORD_DOT_BRACE
            .replace_all(&result, ".")
            .to_string();

        result
    }
}

impl Mutator for RefangMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::String(s) => Ok(JsonValue::String(self.refang_string(s))),
            JsonValue::Array(arr) => {
                let transformed: Vec<JsonValue> = arr
                    .iter()
                    .map(|item| {
                        if let JsonValue::String(s) = item {
                            JsonValue::String(self.refang_string(s))
                        } else {
                            item.clone()
                        }
                    })
                    .collect();
                Ok(JsonValue::Array(transformed))
            }
            _ => Ok(value.clone()),
        }
    }

    fn name(&self) -> &str {
        "refang"
    }
}

/// Mutator that defangs URLs and indicators to make them unclickable
///
/// Applies common defanging patterns to prevent accidental clicks:
/// - http:// -> hxxp://
/// - https:// -> hxxps://
/// - . -> [.]
/// - : -> [:]
/// - @ -> [at]
/// - ftp:// -> fxp://
pub struct DefangMutator {
    _params: MutatorParams,
}

impl DefangMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn defang_string(&self, s: &str) -> String {
        let mut result = s.to_string();

        // Check if already defanged to avoid double-defanging
        let has_defanged_protocol =
            result.to_lowercase().contains("hxxp") || result.to_lowercase().contains("fxp");
        let has_defanged_dots = result.contains("[.]");
        let has_defanged_at = result.contains("[at]");

        // If it's a URL with protocol, check if dots are defanged
        if has_defanged_protocol && result.contains("://") {
            if let Some(after_protocol) = result.split("://").nth(1) {
                if !after_protocol.contains('.') || has_defanged_dots {
                    return result;
                }
            }
        } else if has_defanged_dots && has_defanged_at {
            return result;
        }

        // Replace protocols (case-insensitive) with lowercase hxxp/hxxps/fxp
        result = RE_DEFANG_HTTPS.replace_all(&result, "hxxps://").to_string();
        result = RE_DEFANG_HTTP.replace_all(&result, "hxxp://").to_string();
        result = RE_DEFANG_FTP.replace_all(&result, "fxp://").to_string();

        let mut defanged_result = String::new();
        let mut last_end = 0;

        for cap in RE_DEFANG_URL.captures_iter(&result) {
            let url_match = cap.get(0).unwrap();

            // Add text before the URL
            defanged_result.push_str(&result[last_end..url_match.start()]);

            // Process the URL
            let url = url_match.as_str();
            if let Some((protocol, rest)) = url.split_once("://") {
                defanged_result.push_str(protocol);
                defanged_result.push_str("://");

                // Defang dots in the domain/path (avoid double-defanging)
                let mut rest_defanged = if !rest.contains("[.]") {
                    rest.replace('.', "[.]")
                } else {
                    rest.to_string()
                };

                // Defang @ if present (for URLs with auth)
                if !rest_defanged.contains("[at]") {
                    rest_defanged = rest_defanged.replace('@', "[at]");
                }

                // Defang colons in port numbers (e.g., :8080)
                rest_defanged = RE_DEFANG_PORT
                    .replace_all(&rest_defanged, "[:]$1")
                    .to_string();

                defanged_result.push_str(&rest_defanged);
            } else {
                defanged_result.push_str(url);
            }

            last_end = url_match.end();
        }

        // Add remaining text
        defanged_result.push_str(&result[last_end..]);

        // If no URLs were found, defang the whole string
        if last_end == 0 {
            // Defang dots, @ signs, and colons for emails and domains
            if !defanged_result.contains("[.]") {
                defanged_result = defanged_result.replace('.', "[.]");
            }
            if !defanged_result.contains("[at]") {
                defanged_result = defanged_result.replace('@', "[at]");
            }
        }

        defanged_result
    }
}

impl Mutator for DefangMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::String(s) => Ok(JsonValue::String(self.defang_string(s))),
            JsonValue::Array(arr) => {
                let transformed: Vec<JsonValue> = arr
                    .iter()
                    .map(|item| {
                        if let JsonValue::String(s) = item {
                            JsonValue::String(self.defang_string(s))
                        } else {
                            item.clone()
                        }
                    })
                    .collect();
                Ok(JsonValue::Array(transformed))
            }
            _ => Ok(value.clone()),
        }
    }

    fn name(&self) -> &str {
        "defang"
    }
}

// ---------------------------------------------------------------------------
// Special-use address ranges (ui#584)
// ---------------------------------------------------------------------------
//
// `is_private` and `is_global` are defined here as "not globally reachable",
// matching Python's `ipaddress` module, which is the definition the platform
// converged on. Rust previously hand-rolled RFC1918 + loopback + link-local +
// IPv6 ULA and called everything else public, so the two shipped engines
// returned DIFFERENT records for the same query: `tellaro-backend` evaluates
// with Python and `tellaro-agent` with this crate.
//
// The tables mirror CPython's `_private_networks` / `_private_networks_exceptions`
// / `_reserved_networks` verbatim so the two can be diffed by eye. Do not
// "tidy" them into prefix arithmetic — the point is that they are checkable
// against the upstream source.
//
// NOTE the counter-intuitive member: 100.64.0.0/10 (CGNAT / RFC 6598 shared
// address space) is deliberately NOT here. CPython does not count it as
// private, so neither do we; it is nonetheless not GLOBAL, and `is_global`
// excludes it separately. An address can be neither private nor global.

/// IPv4 networks CPython's `IPv4Address.is_private` covers, as (network, prefix).
const V4_PRIVATE: &[(u32, u8)] = &[
    (0x0000_0000, 8),  // 0.0.0.0/8        "this" network
    (0x0A00_0000, 8),  // 10.0.0.0/8       RFC 1918
    (0x7F00_0000, 8),  // 127.0.0.0/8      loopback
    (0xA9FE_0000, 16), // 169.254.0.0/16   link-local
    (0xAC10_0000, 12), // 172.16.0.0/12    RFC 1918
    (0xC000_0000, 24), // 192.0.0.0/24     IETF protocol assignments
    (0xC000_00AA, 31), // 192.0.0.170/31   NAT64/DNS64 discovery
    (0xC000_0200, 24), // 192.0.2.0/24     TEST-NET-1
    (0xC0A8_0000, 16), // 192.168.0.0/16   RFC 1918
    (0xC612_0000, 15), // 198.18.0.0/15    benchmarking
    (0xC633_6400, 24), // 198.51.100.0/24  TEST-NET-2
    (0xCB00_7100, 24), // 203.0.113.0/24   TEST-NET-3
    (0xF000_0000, 4),  // 240.0.0.0/4      reserved / class E
    (0xFFFF_FFFF, 32), // 255.255.255.255  broadcast
];

/// Carve-outs CPython applies on top of [`V4_PRIVATE`] — these ARE global.
const V4_PRIVATE_EXCEPTIONS: &[(u32, u8)] = &[
    (0xC000_0009, 32), // 192.0.0.9/32   PCP anycast
    (0xC000_000A, 32), // 192.0.0.10/32  NAT64/DNS64 anycast
];

/// IPv6 networks CPython's `IPv6Address.is_private` covers.
const V6_PRIVATE: &[(u128, u8)] = &[
    (0x0000_0000_0000_0000_0000_0000_0000_0001, 128), // ::1/128        loopback
    (0x0000_0000_0000_0000_0000_0000_0000_0000, 128), // ::/128         unspecified
    (0x0000_0000_0000_0000_0000_FFFF_0000_0000, 96),  // ::ffff:0:0/96  v4-mapped
    (0x0064_FF9B_0001_0000_0000_0000_0000_0000, 48),  // 64:ff9b:1::/48 local v4/v6 xlat
    (0x0100_0000_0000_0000_0000_0000_0000_0000, 64),  // 100::/64       discard-only
    (0x2001_0000_0000_0000_0000_0000_0000_0000, 23),  // 2001::/23      IETF protocol
    (0x2001_0DB8_0000_0000_0000_0000_0000_0000, 32),  // 2001:db8::/32  documentation
    (0x2002_0000_0000_0000_0000_0000_0000_0000, 16),  // 2002::/16      6to4
    (0x3FFF_0000_0000_0000_0000_0000_0000_0000, 20),  // 3fff::/20      documentation
    (0xFC00_0000_0000_0000_0000_0000_0000_0000, 7),   // fc00::/7       unique local
    (0xFE80_0000_0000_0000_0000_0000_0000_0000, 10),  // fe80::/10      link-local
];

/// Carve-outs CPython applies on top of [`V6_PRIVATE`] — these ARE global.
const V6_PRIVATE_EXCEPTIONS: &[(u128, u8)] = &[
    (0x2001_0001_0000_0000_0000_0000_0000_0001, 128), // 2001:1::1/128     PCP anycast
    (0x2001_0001_0000_0000_0000_0000_0000_0002, 128), // 2001:1::2/128     TURN anycast
    (0x2001_0003_0000_0000_0000_0000_0000_0000, 32),  // 2001:3::/32       AMT
    (0x2001_0004_0112_0000_0000_0000_0000_0000, 48),  // 2001:4:112::/48   AS112-v6
    (0x2001_0020_0000_0000_0000_0000_0000_0000, 28),  // 2001:20::/28      ORCHIDv2
    (0x2001_0030_0000_0000_0000_0000_0000_0000, 28),  // 2001:30::/28      drone remote id
];

/// IPv6 networks CPython's `IPv6Address.is_reserved` covers.
///
/// Everything outside 2000::/3 (global unicast), essentially.
const V6_RESERVED: &[(u128, u8)] = &[
    (0x0000_0000_0000_0000_0000_0000_0000_0000, 8),
    (0x0100_0000_0000_0000_0000_0000_0000_0000, 8),
    (0x0200_0000_0000_0000_0000_0000_0000_0000, 7),
    (0x0400_0000_0000_0000_0000_0000_0000_0000, 6),
    (0x0800_0000_0000_0000_0000_0000_0000_0000, 5),
    (0x1000_0000_0000_0000_0000_0000_0000_0000, 4),
    (0x4000_0000_0000_0000_0000_0000_0000_0000, 3),
    (0x6000_0000_0000_0000_0000_0000_0000_0000, 3),
    (0x8000_0000_0000_0000_0000_0000_0000_0000, 3),
    (0xA000_0000_0000_0000_0000_0000_0000_0000, 3),
    (0xC000_0000_0000_0000_0000_0000_0000_0000, 3),
    (0xE000_0000_0000_0000_0000_0000_0000_0000, 4),
    (0xF000_0000_0000_0000_0000_0000_0000_0000, 5),
    (0xF800_0000_0000_0000_0000_0000_0000_0000, 6),
    (0xFE00_0000_0000_0000_0000_0000_0000_0000, 9),
];

/// Is `addr` inside `network/prefix`? A /0 matches everything.
fn v4_in(addr: u32, network: u32, prefix: u8) -> bool {
    if prefix == 0 {
        return true;
    }
    let mask = u32::MAX << (32 - prefix);
    (addr & mask) == (network & mask)
}

/// Is `addr` inside `network/prefix`? A /0 matches everything.
fn v6_in(addr: u128, network: u128, prefix: u8) -> bool {
    if prefix == 0 {
        return true;
    }
    let mask = u128::MAX << (128 - prefix);
    (addr & mask) == (network & mask)
}

fn v4_in_any(addr: u32, nets: &[(u32, u8)]) -> bool {
    nets.iter().any(|&(n, p)| v4_in(addr, n, p))
}

fn v6_in_any(addr: u128, nets: &[(u128, u8)]) -> bool {
    nets.iter().any(|&(n, p)| v6_in(addr, n, p))
}

/// CPython's `IPv4Address.is_private`.
fn v4_is_private(addr: u32) -> bool {
    v4_in_any(addr, V4_PRIVATE) && !v4_in_any(addr, V4_PRIVATE_EXCEPTIONS)
}

/// CPython's `IPv6Address.is_private`.
fn v6_is_private(addr: u128) -> bool {
    v6_in_any(addr, V6_PRIVATE) && !v6_in_any(addr, V6_PRIVATE_EXCEPTIONS)
}

/// CPython's `IPv6Address.is_reserved`.
fn v6_is_reserved(addr: u128) -> bool {
    v6_in_any(addr, V6_RESERVED)
}

/// CPython's `IPv4Address.is_reserved` — 240.0.0.0/4.
fn v4_is_reserved(addr: u32) -> bool {
    v4_in(addr, 0xF000_0000, 4)
}

/// Mutator that checks if an IP address is private
///
/// "Private" means **not globally reachable**, matching Python's `ipaddress`
/// module. That is broader than RFC 1918 and covers:
/// - RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
/// - Loopback: 127.0.0.0/8, ::1
/// - Link-local: 169.254.0.0/16, fe80::/10
/// - IPv6 unique local: fc00::/7
/// - "This" network 0.0.0.0/8 and broadcast 255.255.255.255
/// - IETF protocol assignments 192.0.0.0/24 (except the PCP and NAT64
///   anycast carve-outs 192.0.0.9/32 and 192.0.0.10/32, which ARE global)
/// - Documentation ranges TEST-NET-1/2/3 and 2001:db8::/32
/// - Benchmarking 198.18.0.0/15
/// - Reserved / class E 240.0.0.0/4
///
/// **CGNAT 100.64.0.0/10 is deliberately NOT private** — Python does not count
/// it as private, and neither do we. It is not global either; see
/// [`IsGlobalMutator`]. An address can be neither.
pub struct IsPrivateMutator {
    _params: MutatorParams,
}

impl IsPrivateMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    /// "Not globally reachable", matching Python's `ipaddress`.
    ///
    /// Mirrors the Python mutator exactly: private OR loopback OR link-local OR
    /// reserved. Loopback and link-local are already inside the private tables,
    /// but they are named here because the Python side names them and the two
    /// must stay diffable.
    fn is_private_ip(&self, ip_str: &str) -> bool {
        match ip_str.parse::<IpAddr>() {
            Ok(IpAddr::V4(v4)) => {
                let a = u32::from(v4);
                v4_is_private(a) || v4.is_loopback() || v4.is_link_local() || v4_is_reserved(a)
            }
            Ok(IpAddr::V6(v6)) => {
                let a = u128::from(v6);
                v6_is_private(a) || v6.is_loopback() || v6_is_reserved(a)
            }
            Err(_) => false,
        }
    }
}

impl Mutator for IsPrivateMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::Null => Ok(json!(false)),
            JsonValue::String(s) => Ok(json!(self.is_private_ip(s))),
            JsonValue::Array(arr) => {
                // Return true if any IP in the array is private
                let result = arr.iter().any(|item| {
                    if let JsonValue::String(s) = item {
                        self.is_private_ip(s)
                    } else {
                        false
                    }
                });
                Ok(json!(result))
            }
            _ => Ok(json!(false)),
        }
    }

    fn name(&self) -> &str {
        "is_private"
    }

    /// Answers a boolean ABOUT the address, so `ip | is_private` with no
    /// operator is a FILTER (`eq true`), not a projection. See
    /// [`Mutator::returns_boolean`].
    fn returns_boolean(&self) -> bool {
        true
    }
}

/// Mutator that checks if an IP address is globally routable
///
/// Returns true if the IP is a public, globally routable address.
/// This is the inverse of is_private - it excludes:
/// - Private addresses (RFC 1918)
/// - Loopback
/// - Link-local
/// - Multicast
/// - Reserved ranges
pub struct IsGlobalMutator {
    _params: MutatorParams,
}

impl IsGlobalMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn is_global_ip(&self, ip_str: &str) -> bool {
        // The exact inverse of the Python mutator's checks, in the same order.
        // Note this is NOT `!is_private_ip`: an address can be neither private
        // nor global — 100.64.0.0/10 (CGNAT) and multicast are both.
        match ip_str.parse::<IpAddr>() {
            Ok(IpAddr::V4(v4)) => {
                let a = u32::from(v4);
                if v4_is_private(a)
                    || v4.is_loopback()
                    || v4.is_link_local()
                    || v4.is_multicast()
                    || v4.is_unspecified()
                    || v4.is_broadcast()
                    || v4_is_reserved(a)
                {
                    return false;
                }
                // Ranges Python checks on top of `is_private`.
                if v4_in(a, 0x0000_0000, 8)      // 0.0.0.0/8
                    || v4_in(a, 0x6440_0000, 10) // 100.64.0.0/10 shared address space
                    || v4_in(a, 0xC612_0000, 15) // 198.18.0.0/15 benchmarking
                    || v4_in(a, 0xF000_0000, 4)
                // 240.0.0.0/4
                {
                    return false;
                }
                true
            }
            Ok(IpAddr::V6(v6)) => {
                let a = u128::from(v6);
                !(v6_is_private(a)
                    || v6.is_loopback()
                    || v6.is_multicast()
                    || v6.is_unspecified()
                    || v6_is_reserved(a))
            }
            Err(_) => false,
        }
    }
}

impl Mutator for IsGlobalMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::Null => Ok(json!(false)),
            JsonValue::String(s) => Ok(json!(self.is_global_ip(s))),
            JsonValue::Array(arr) => {
                // Return true if any IP in the array is global
                let result = arr.iter().any(|item| {
                    if let JsonValue::String(s) = item {
                        self.is_global_ip(s)
                    } else {
                        false
                    }
                });
                Ok(json!(result))
            }
            _ => Ok(json!(false)),
        }
    }

    fn name(&self) -> &str {
        "is_global"
    }

    /// Answers a boolean ABOUT the address, so `ip | is_global` with no
    /// operator is a FILTER (`eq true`), not a projection. See
    /// [`Mutator::returns_boolean`].
    fn returns_boolean(&self) -> bool {
        true
    }
}

/// Mutator that checks if an IP address is a multicast address.
///
/// Returns true if the IP is in a multicast range:
/// - IPv4: 224.0.0.0/4 (224.0.0.0 – 239.255.255.255)
/// - IPv6: ff00::/8
pub struct IsMulticastMutator {
    _params: MutatorParams,
}

impl IsMulticastMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn is_multicast_ip(&self, ip_str: &str) -> bool {
        if let Ok(ip) = ip_str.parse::<IpAddr>() {
            match ip {
                IpAddr::V4(ipv4) => ipv4.is_multicast(),
                IpAddr::V6(ipv6) => ipv6.is_multicast(),
            }
        } else {
            false
        }
    }
}

impl Mutator for IsMulticastMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::Null => Ok(json!(false)),
            JsonValue::String(s) => Ok(json!(self.is_multicast_ip(s))),
            JsonValue::Array(arr) => {
                let result = arr.iter().any(|item| {
                    if let JsonValue::String(s) = item {
                        self.is_multicast_ip(s)
                    } else {
                        false
                    }
                });
                Ok(json!(result))
            }
            _ => Ok(json!(false)),
        }
    }

    fn name(&self) -> &str {
        "is_multicast"
    }

    /// Answers a boolean ABOUT the address, so `ip | is_multicast` with no
    /// operator is a FILTER (`eq true`), not a projection. See
    /// [`Mutator::returns_boolean`].
    fn returns_boolean(&self) -> bool {
        true
    }
}

/// Mutator that checks if an IP address is a loopback address.
///
/// Returns true if the IP is a loopback address:
/// - IPv4: 127.0.0.0/8
/// - IPv6: ::1
pub struct IsLoopbackMutator {
    _params: MutatorParams,
}

impl IsLoopbackMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn is_loopback_ip(&self, ip_str: &str) -> bool {
        if let Ok(ip) = ip_str.parse::<IpAddr>() {
            ip.is_loopback()
        } else {
            false
        }
    }
}

impl Mutator for IsLoopbackMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::Null => Ok(json!(false)),
            JsonValue::String(s) => Ok(json!(self.is_loopback_ip(s))),
            JsonValue::Array(arr) => {
                let result = arr.iter().any(|item| {
                    if let JsonValue::String(s) = item {
                        self.is_loopback_ip(s)
                    } else {
                        false
                    }
                });
                Ok(json!(result))
            }
            _ => Ok(json!(false)),
        }
    }

    fn name(&self) -> &str {
        "is_loopback"
    }

    /// Answers a boolean ABOUT the address, so `ip | is_loopback` with no
    /// operator is a FILTER (`eq true`), not a projection. See
    /// [`Mutator::returns_boolean`].
    fn returns_boolean(&self) -> bool {
        true
    }
}

/// Mutator that checks if an IP address is a link-local address.
///
/// Returns true if the IP is link-local:
/// - IPv4: 169.254.0.0/16
/// - IPv6: fe80::/10
pub struct IsLinkLocalMutator {
    _params: MutatorParams,
}

impl IsLinkLocalMutator {
    pub fn new(params: MutatorParams) -> Self {
        Self { _params: params }
    }

    fn is_link_local_ip(&self, ip_str: &str) -> bool {
        if let Ok(ip) = ip_str.parse::<IpAddr>() {
            match ip {
                IpAddr::V4(ipv4) => ipv4.is_link_local(),
                IpAddr::V6(ipv6) => {
                    // fe80::/10
                    let segments = ipv6.segments();
                    (segments[0] & 0xffc0) == 0xfe80
                }
            }
        } else {
            false
        }
    }
}

impl Mutator for IsLinkLocalMutator {
    fn apply(
        &self,
        _field_name: &str,
        _record: &JsonValue,
        value: &JsonValue,
    ) -> Result<JsonValue> {
        match value {
            JsonValue::Null => Ok(json!(false)),
            JsonValue::String(s) => Ok(json!(self.is_link_local_ip(s))),
            JsonValue::Array(arr) => {
                let result = arr.iter().any(|item| {
                    if let JsonValue::String(s) = item {
                        self.is_link_local_ip(s)
                    } else {
                        false
                    }
                });
                Ok(json!(result))
            }
            _ => Ok(json!(false)),
        }
    }

    fn name(&self) -> &str {
        "is_link_local"
    }

    /// Answers a boolean ABOUT the address, so `ip | is_link_local` with no
    /// operator is a FILTER (`eq true`), not a projection. See
    /// [`Mutator::returns_boolean`].
    fn returns_boolean(&self) -> bool {
        true
    }
}

#[cfg(test)]
mod tests {
    use super::*;
    use serde_json::json;
    use std::collections::HashMap;

    #[test]
    fn test_refang_http() {
        let mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("hXXp://example[.]com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("http://example.com"));

        let value = json!("hxxp://test[.]org");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("http://test.org"));
    }

    #[test]
    fn test_refang_https() {
        let mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("hXXps://secure[.]example[.]com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("https://secure.example.com"));
    }

    #[test]
    fn test_refang_email() {
        let mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("user[at]example[.]com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("user@example.com"));
    }

    #[test]
    fn test_refang_brackets_and_parentheses() {
        let mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("example(.)com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("example.com"));

        let value = json!("test{.}org");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("test.org"));
    }

    #[test]
    fn test_refang_array() {
        let mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!(["hXXp://example[.]com", "user[at]test[.]org"]);
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!(["http://example.com", "user@test.org"]));
    }

    #[test]
    fn test_defang_http() {
        let mutator = DefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("http://example.com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("hxxp://example[.]com"));
    }

    #[test]
    fn test_defang_https() {
        let mutator = DefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("https://secure.example.com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("hxxps://secure[.]example[.]com"));
    }

    #[test]
    fn test_defang_email() {
        let mutator = DefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("user@example.com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("user[at]example[.]com"));
    }

    #[test]
    fn test_defang_already_defanged() {
        let mutator = DefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!("hxxp://example[.]com");
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(result, json!("hxxp://example[.]com"));
    }

    #[test]
    fn test_defang_refang_round_trip() {
        let defang_mutator = DefangMutator::new(HashMap::new());
        let refang_mutator = RefangMutator::new(HashMap::new());
        let record = json!({});

        let original = json!("https://example.com/path");
        let defanged = defang_mutator.apply("field", &record, &original).unwrap();
        let refanged = refang_mutator.apply("field", &record, &defanged).unwrap();

        // Should get back to original
        assert_eq!(refanged, original);
    }

    #[test]
    fn test_defang_array() {
        let mutator = DefangMutator::new(HashMap::new());
        let record = json!({});

        let value = json!(["http://example.com", "user@test.org"]);
        let result = mutator.apply("field", &record, &value).unwrap();
        assert_eq!(
            result,
            json!(["hxxp://example[.]com", "user[at]test[.]org"])
        );
    }

    // Tests for IsPrivateMutator
    #[test]
    fn test_is_private_rfc1918() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // 10.0.0.0/8
        assert_eq!(
            mutator.apply("ip", &record, &json!("10.0.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("10.255.255.254"))
                .unwrap(),
            json!(true)
        );

        // 172.16.0.0/12
        assert_eq!(
            mutator.apply("ip", &record, &json!("172.16.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("172.31.255.254"))
                .unwrap(),
            json!(true)
        );

        // 192.168.0.0/16
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.168.1.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("192.168.255.254"))
                .unwrap(),
            json!(true)
        );

        // Non-private in between ranges
        assert_eq!(
            mutator.apply("ip", &record, &json!("172.32.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("172.15.255.254"))
                .unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_private_special_ranges() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // Loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("127.0.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("127.255.255.254"))
                .unwrap(),
            json!(true)
        );

        // Link-local
        assert_eq!(
            mutator.apply("ip", &record, &json!("169.254.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("169.254.255.254"))
                .unwrap(),
            json!(true)
        );
    }

    #[test]
    fn test_is_private_public_ips() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // Common public IPs
        assert_eq!(
            mutator.apply("ip", &record, &json!("8.8.8.8")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("1.1.1.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("93.184.216.34"))
                .unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_private_ipv6() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // IPv6 private (unique local)
        assert_eq!(
            mutator.apply("ip", &record, &json!("fc00::1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("fd00::1")).unwrap(),
            json!(true)
        );

        // IPv6 link-local
        assert_eq!(
            mutator.apply("ip", &record, &json!("fe80::1")).unwrap(),
            json!(true)
        );

        // IPv6 loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("::1")).unwrap(),
            json!(true)
        );

        // IPv6 public
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2001:4860:4860::8888"))
                .unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_private_invalid_ips() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // Invalid IPs should return false
        assert_eq!(
            mutator.apply("ip", &record, &json!("not-an-ip")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("256.256.256.256"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("example.com")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_private_lists() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});

        // List with at least one private IP
        assert_eq!(
            mutator
                .apply(
                    "ips",
                    &record,
                    &json!(["8.8.8.8", "192.168.1.1", "1.1.1.1"])
                )
                .unwrap(),
            json!(true)
        );

        // List with only public IPs
        assert_eq!(
            mutator
                .apply("ips", &record, &json!(["8.8.8.8", "1.1.1.1"]))
                .unwrap(),
            json!(false)
        );

        // Empty list
        assert_eq!(
            mutator.apply("ips", &record, &json!([])).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_private_none_input() {
        let mutator = IsPrivateMutator::new(HashMap::new());
        let record = json!({});
        assert_eq!(
            mutator.apply("ip", &record, &JsonValue::Null).unwrap(),
            json!(false)
        );
    }

    // Tests for IsGlobalMutator
    #[test]
    fn test_is_global_public_ips() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // Common public IPs
        assert_eq!(
            mutator.apply("ip", &record, &json!("8.8.8.8")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("1.1.1.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("93.184.216.34"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("151.101.1.140"))
                .unwrap(),
            json!(true)
        );
    }

    #[test]
    fn test_is_global_private_ips() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // RFC 1918
        assert_eq!(
            mutator.apply("ip", &record, &json!("10.0.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("172.16.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.168.1.1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_global_special_ranges() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // Loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("127.0.0.1")).unwrap(),
            json!(false)
        );

        // Link-local
        assert_eq!(
            mutator.apply("ip", &record, &json!("169.254.0.1")).unwrap(),
            json!(false)
        );

        // Multicast
        assert_eq!(
            mutator.apply("ip", &record, &json!("224.0.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("239.255.255.255"))
                .unwrap(),
            json!(false)
        );

        // Unspecified
        assert_eq!(
            mutator.apply("ip", &record, &json!("0.0.0.0")).unwrap(),
            json!(false)
        );

        // This network (0.0.0.0/8)
        assert_eq!(
            mutator.apply("ip", &record, &json!("0.1.2.3")).unwrap(),
            json!(false)
        );

        // Shared address space (CGN)
        assert_eq!(
            mutator.apply("ip", &record, &json!("100.64.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("100.127.255.254"))
                .unwrap(),
            json!(false)
        );

        // Benchmarking
        assert_eq!(
            mutator.apply("ip", &record, &json!("198.18.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("198.19.255.254"))
                .unwrap(),
            json!(false)
        );

        // Reserved (Class E)
        assert_eq!(
            mutator.apply("ip", &record, &json!("240.0.0.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("255.255.255.254"))
                .unwrap(),
            json!(false)
        );

        // TEST-NET ranges
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.0.2.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("198.51.100.1"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("203.0.113.1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_global_ipv6() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // IPv6 global
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2001:4860:4860::8888"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2606:4700:4700::1111"))
                .unwrap(),
            json!(true)
        );

        // IPv6 not global
        assert_eq!(
            mutator.apply("ip", &record, &json!("fc00::1")).unwrap(),
            json!(false)
        ); // Unique local
        assert_eq!(
            mutator.apply("ip", &record, &json!("fe80::1")).unwrap(),
            json!(false)
        ); // Link-local
        assert_eq!(
            mutator.apply("ip", &record, &json!("::1")).unwrap(),
            json!(false)
        ); // Loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("::")).unwrap(),
            json!(false)
        ); // Unspecified
        assert_eq!(
            mutator.apply("ip", &record, &json!("ff02::1")).unwrap(),
            json!(false)
        ); // Multicast
    }

    #[test]
    fn test_is_global_invalid_ips() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // Invalid IPs should return false
        assert_eq!(
            mutator.apply("ip", &record, &json!("not-an-ip")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("256.256.256.256"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("example.com")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_global_lists() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // List with at least one global IP
        assert_eq!(
            mutator
                .apply(
                    "ips",
                    &record,
                    &json!(["192.168.1.1", "8.8.8.8", "10.0.0.1"])
                )
                .unwrap(),
            json!(true)
        );

        // List with only private IPs
        assert_eq!(
            mutator
                .apply("ips", &record, &json!(["192.168.1.1", "10.0.0.1"]))
                .unwrap(),
            json!(false)
        );

        // Empty list
        assert_eq!(
            mutator.apply("ips", &record, &json!([])).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_global_none_input() {
        let mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});
        assert_eq!(
            mutator.apply("ip", &record, &JsonValue::Null).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_boundary_addresses() {
        let private_mutator = IsPrivateMutator::new(HashMap::new());
        let global_mutator = IsGlobalMutator::new(HashMap::new());
        let record = json!({});

        // RFC 1918 boundaries
        assert_eq!(
            private_mutator
                .apply("ip", &record, &json!("10.0.0.0"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            private_mutator
                .apply("ip", &record, &json!("10.255.255.255"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            private_mutator
                .apply("ip", &record, &json!("9.255.255.255"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            private_mutator
                .apply("ip", &record, &json!("11.0.0.0"))
                .unwrap(),
            json!(false)
        );

        // Global boundaries
        assert_eq!(
            global_mutator
                .apply("ip", &record, &json!("1.0.0.0"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            global_mutator
                .apply("ip", &record, &json!("223.255.255.255"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            global_mutator
                .apply("ip", &record, &json!("224.0.0.0"))
                .unwrap(),
            json!(false)
        ); // Multicast starts
    }

    // Tests for IsMulticastMutator
    #[test]
    fn test_is_multicast_ipv4() {
        let mutator = IsMulticastMutator::new(HashMap::new());
        let record = json!({});

        // Multicast range: 224.0.0.0 - 239.255.255.255
        assert_eq!(
            mutator.apply("ip", &record, &json!("224.0.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("239.255.255.255"))
                .unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("230.0.0.1")).unwrap(),
            json!(true)
        );

        // Non-multicast
        assert_eq!(
            mutator.apply("ip", &record, &json!("8.8.8.8")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.168.1.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("127.0.0.1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_multicast_ipv6() {
        let mutator = IsMulticastMutator::new(HashMap::new());
        let record = json!({});

        // IPv6 multicast (ff00::/8)
        assert_eq!(
            mutator.apply("ip", &record, &json!("ff02::1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("ff05::1")).unwrap(),
            json!(true)
        );

        // Non-multicast IPv6
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2001:4860:4860::8888"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("::1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_multicast_invalid_and_special() {
        let mutator = IsMulticastMutator::new(HashMap::new());
        let record = json!({});

        assert_eq!(
            mutator.apply("ip", &record, &json!("not-an-ip")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &JsonValue::Null).unwrap(),
            json!(false)
        );
    }

    // Tests for IsLoopbackMutator
    #[test]
    fn test_is_loopback_ipv4() {
        let mutator = IsLoopbackMutator::new(HashMap::new());
        let record = json!({});

        // Loopback: 127.0.0.0/8
        assert_eq!(
            mutator.apply("ip", &record, &json!("127.0.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("127.255.255.254"))
                .unwrap(),
            json!(true)
        );

        // Non-loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("8.8.8.8")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.168.1.1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_loopback_ipv6() {
        let mutator = IsLoopbackMutator::new(HashMap::new());
        let record = json!({});

        // IPv6 loopback
        assert_eq!(
            mutator.apply("ip", &record, &json!("::1")).unwrap(),
            json!(true)
        );

        // Non-loopback IPv6
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2001:4860:4860::8888"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("fe80::1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_loopback_invalid_and_special() {
        let mutator = IsLoopbackMutator::new(HashMap::new());
        let record = json!({});

        assert_eq!(
            mutator.apply("ip", &record, &json!("not-an-ip")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &JsonValue::Null).unwrap(),
            json!(false)
        );
    }

    // Tests for IsLinkLocalMutator
    #[test]
    fn test_is_link_local_ipv4() {
        let mutator = IsLinkLocalMutator::new(HashMap::new());
        let record = json!({});

        // Link-local: 169.254.0.0/16
        assert_eq!(
            mutator.apply("ip", &record, &json!("169.254.0.1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("169.254.255.254"))
                .unwrap(),
            json!(true)
        );

        // Non-link-local
        assert_eq!(
            mutator.apply("ip", &record, &json!("8.8.8.8")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("192.168.1.1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("127.0.0.1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_link_local_ipv6() {
        let mutator = IsLinkLocalMutator::new(HashMap::new());
        let record = json!({});

        // IPv6 link-local (fe80::/10)
        assert_eq!(
            mutator.apply("ip", &record, &json!("fe80::1")).unwrap(),
            json!(true)
        );
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("fe80::abcd:1234"))
                .unwrap(),
            json!(true)
        );

        // Non-link-local IPv6
        assert_eq!(
            mutator
                .apply("ip", &record, &json!("2001:4860:4860::8888"))
                .unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("::1")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &json!("fc00::1")).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_link_local_invalid_and_special() {
        let mutator = IsLinkLocalMutator::new(HashMap::new());
        let record = json!({});

        assert_eq!(
            mutator.apply("ip", &record, &json!("not-an-ip")).unwrap(),
            json!(false)
        );
        assert_eq!(
            mutator.apply("ip", &record, &JsonValue::Null).unwrap(),
            json!(false)
        );
    }

    #[test]
    fn test_is_link_local_array() {
        let mutator = IsLinkLocalMutator::new(HashMap::new());
        let record = json!({});

        // Array with at least one link-local IP
        assert_eq!(
            mutator
                .apply(
                    "ips",
                    &record,
                    &json!(["8.8.8.8", "169.254.1.1", "1.1.1.1"])
                )
                .unwrap(),
            json!(true)
        );

        // Array with no link-local IPs
        assert_eq!(
            mutator
                .apply("ips", &record, &json!(["8.8.8.8", "1.1.1.1"]))
                .unwrap(),
            json!(false)
        );
    }
}