node/test/parallel/test-blocklist.js

'use strict';

require('../common');

const {
  BlockList,
  SocketAddress,
} = require('net');
const assert = require('assert');
const util = require('util');

{
  const blockList = new BlockList();

  [1, [], {}, null, 1n, undefined, null].forEach((i) => {
    assert.throws(() => blockList.addAddress(i), {
      code: 'ERR_INVALID_ARG_TYPE'
    });
  });

  [1, [], {}, null, 1n, null].forEach((i) => {
    assert.throws(() => blockList.addAddress('1.1.1.1', i), {
      code: 'ERR_INVALID_ARG_TYPE'
    });
  });

  assert.throws(() => blockList.addAddress('1.1.1.1', 'foo'), {
    code: 'ERR_INVALID_ARG_VALUE'
  });

  [1, [], {}, null, 1n, undefined, null].forEach((i) => {
    assert.throws(() => blockList.addRange(i), {
      code: 'ERR_INVALID_ARG_TYPE'
    });
    assert.throws(() => blockList.addRange('1.1.1.1', i), {
      code: 'ERR_INVALID_ARG_TYPE'
    });
  });

  [1, [], {}, null, 1n, null].forEach((i) => {
    assert.throws(() => blockList.addRange('1.1.1.1', '1.1.1.2', i), {
      code: 'ERR_INVALID_ARG_TYPE'
    });
  });

  assert.throws(() => blockList.addRange('1.1.1.1', '1.1.1.2', 'foo'), {
    code: 'ERR_INVALID_ARG_VALUE'
  });
}

{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addAddress('8592:757c:efae:4e45:fb5d:d62a:0d00:8e17', 'ipv6');
  blockList.addAddress('::ffff:1.1.1.2', 'ipv6');

  assert(blockList.check('1.1.1.1'));
  assert(!blockList.check('1.1.1.1', 'ipv6'));
  assert(!blockList.check('8592:757c:efae:4e45:fb5d:d62a:0d00:8e17'));
  assert(blockList.check('8592:757c:efae:4e45:fb5d:d62a:0d00:8e17', 'ipv6'));

  assert(blockList.check('::ffff:1.1.1.1', 'ipv6'));
  assert(blockList.check('::ffff:1.1.1.1', 'IPV6'));

  assert(blockList.check('1.1.1.2'));

  assert(!blockList.check('1.2.3.4'));
  assert(!blockList.check('::1', 'ipv6'));
}

{
  const blockList = new BlockList();
  const sa1 = new SocketAddress({ address: '1.1.1.1' });
  const sa2 = new SocketAddress({
    address: '8592:757c:efae:4e45:fb5d:d62a:0d00:8e17',
    family: 'ipv6'
  });
  const sa3 = new SocketAddress({ address: '1.1.1.2' });

  blockList.addAddress(sa1);
  blockList.addAddress(sa2);
  blockList.addAddress('::ffff:1.1.1.2', 'ipv6');

  assert(blockList.check('1.1.1.1'));
  assert(blockList.check(sa1));
  assert(!blockList.check('1.1.1.1', 'ipv6'));
  assert(!blockList.check('8592:757c:efae:4e45:fb5d:d62a:0d00:8e17'));
  assert(blockList.check('8592:757c:efae:4e45:fb5d:d62a:0d00:8e17', 'ipv6'));
  assert(blockList.check(sa2));

  assert(blockList.check('::ffff:1.1.1.1', 'ipv6'));
  assert(blockList.check('::ffff:1.1.1.1', 'IPV6'));

  assert(blockList.check('1.1.1.2'));
  assert(blockList.check(sa3));

  assert(!blockList.check('1.2.3.4'));
  assert(!blockList.check('::1', 'ipv6'));
}

{
  const blockList = new BlockList();
  blockList.addRange('1.1.1.1', '1.1.1.10');
  blockList.addRange('::1', '::f', 'ipv6');

  assert(!blockList.check('1.1.1.0'));
  for (let n = 1; n <= 10; n++)
    assert(blockList.check(`1.1.1.${n}`));
  assert(!blockList.check('1.1.1.11'));

  assert(!blockList.check('::0', 'ipv6'));
  for (let n = 0x1; n <= 0xf; n++) {
    assert(blockList.check(`::${n.toString(16)}`, 'ipv6'),
           `::${n.toString(16)} check failed`);
  }
  assert(!blockList.check('::10', 'ipv6'));
}

{
  const blockList = new BlockList();
  const sa1 = new SocketAddress({ address: '1.1.1.1' });
  const sa2 = new SocketAddress({ address: '1.1.1.10' });
  const sa3 = new SocketAddress({ address: '::1', family: 'ipv6' });
  const sa4 = new SocketAddress({ address: '::f', family: 'ipv6' });

  blockList.addRange(sa1, sa2);
  blockList.addRange(sa3, sa4);

  assert(!blockList.check('1.1.1.0'));
  for (let n = 1; n <= 10; n++)
    assert(blockList.check(`1.1.1.${n}`));
  assert(!blockList.check('1.1.1.11'));

  assert(!blockList.check('::0', 'ipv6'));
  for (let n = 0x1; n <= 0xf; n++) {
    assert(blockList.check(`::${n.toString(16)}`, 'ipv6'),
           `::${n.toString(16)} check failed`);
  }
  assert(!blockList.check('::10', 'ipv6'));
}

{
  const blockList = new BlockList();
  blockList.addSubnet('1.1.1.0', 16);
  blockList.addSubnet('8592:757c:efae:4e45::', 64, 'ipv6');

  assert(blockList.check('1.1.0.1'));
  assert(blockList.check('1.1.1.1'));
  assert(!blockList.check('1.2.0.1'));
  assert(blockList.check('::ffff:1.1.0.1', 'ipv6'));

  assert(blockList.check('8592:757c:efae:4e45:f::', 'ipv6'));
  assert(blockList.check('8592:757c:efae:4e45::f', 'ipv6'));
  assert(!blockList.check('8592:757c:efae:4f45::f', 'ipv6'));
}

{
  const blockList = new BlockList();
  const sa1 = new SocketAddress({ address: '1.1.1.0' });
  const sa2 = new SocketAddress({ address: '1.1.1.1' });
  blockList.addSubnet(sa1, 16);
  blockList.addSubnet('8592:757c:efae:4e45::', 64, 'ipv6');

  assert(blockList.check('1.1.0.1'));
  assert(blockList.check(sa2));
  assert(!blockList.check('1.2.0.1'));
  assert(blockList.check('::ffff:1.1.0.1', 'ipv6'));

  assert(blockList.check('8592:757c:efae:4e45:f::', 'ipv6'));
  assert(blockList.check('8592:757c:efae:4e45::f', 'ipv6'));
  assert(!blockList.check('8592:757c:efae:4f45::f', 'ipv6'));
}

{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addRange('10.0.0.1', '10.0.0.10');
  blockList.addSubnet('8592:757c:efae:4e45::', 64, 'IpV6'); // Case insensitive

  const rulesCheck = [
    'Address: IPv4 1.1.1.1',
    'Subnet: IPv6 8592:757c:efae:4e45::/64',
    'Range: IPv4 10.0.0.1-10.0.0.10',
  ];
  assert.deepStrictEqual(blockList.rules.sort(), rulesCheck.sort());

  assert(blockList.check('1.1.1.1'));
  assert(blockList.check('10.0.0.5'));
  assert(blockList.check('::ffff:10.0.0.5', 'ipv6'));
  assert(blockList.check('8592:757c:efae:4e45::f', 'ipv6'));

  assert(!blockList.check('123.123.123.123'));
  assert(!blockList.check('8592:757c:efaf:4e45:fb5d:d62a:0d00:8e17', 'ipv6'));
  assert(!blockList.check('::ffff:123.123.123.123', 'ipv6'));
}

{
  // This test validates boundaries of non-aligned CIDR bit prefixes
  const blockList = new BlockList();
  blockList.addSubnet('10.0.0.0', 27);
  blockList.addSubnet('8592:757c:efaf::', 51, 'ipv6');

  for (let n = 0; n <= 31; n++)
    assert(blockList.check(`10.0.0.${n}`));
  assert(!blockList.check('10.0.0.32'));

  assert(blockList.check('8592:757c:efaf:0:0:0:0:0', 'ipv6'));
  assert(blockList.check('8592:757c:efaf:1fff:ffff:ffff:ffff:ffff', 'ipv6'));
  assert(!blockList.check('8592:757c:efaf:2fff:ffff:ffff:ffff:ffff', 'ipv6'));
}

{
  // Regression test for https://github.com/nodejs/node/issues/39074
  const blockList = new BlockList();

  blockList.addRange('10.0.0.2', '10.0.0.10');

  // IPv4 checks against IPv4 range.
  assert(blockList.check('10.0.0.2'));
  assert(blockList.check('10.0.0.10'));
  assert(!blockList.check('192.168.0.3'));
  assert(!blockList.check('2.2.2.2'));
  assert(!blockList.check('255.255.255.255'));

  // IPv6 checks against IPv4 range.
  assert(blockList.check('::ffff:0a00:0002', 'ipv6'));
  assert(blockList.check('::ffff:0a00:000a', 'ipv6'));
  assert(!blockList.check('::ffff:c0a8:0003', 'ipv6'));
  assert(!blockList.check('::ffff:0202:0202', 'ipv6'));
  assert(!blockList.check('::ffff:ffff:ffff', 'ipv6'));
}

{
  const blockList = new BlockList();
  assert.throws(() => blockList.addRange('1.1.1.2', '1.1.1.1'), /ERR_INVALID_ARG_VALUE/);
}

{
  const blockList = new BlockList();
  assert.throws(() => blockList.addSubnet(1), /ERR_INVALID_ARG_TYPE/);
  assert.throws(() => blockList.addSubnet('1.1.1.1', ''),
                /ERR_INVALID_ARG_TYPE/);
  assert.throws(() => blockList.addSubnet('1.1.1.1', NaN), /ERR_OUT_OF_RANGE/);
  assert.throws(() => blockList.addSubnet('', 1, 1), /ERR_INVALID_ARG_TYPE/);
  assert.throws(() => blockList.addSubnet('', 1, ''), /ERR_INVALID_ARG_VALUE/);

  assert.throws(() => blockList.addSubnet('1.1.1.1', -1, 'ipv4'),
                /ERR_OUT_OF_RANGE/);
  assert.throws(() => blockList.addSubnet('1.1.1.1', 33, 'ipv4'),
                /ERR_OUT_OF_RANGE/);

  assert.throws(() => blockList.addSubnet('::', -1, 'ipv6'),
                /ERR_OUT_OF_RANGE/);
  assert.throws(() => blockList.addSubnet('::', 129, 'ipv6'),
                /ERR_OUT_OF_RANGE/);
}

{
  const blockList = new BlockList();
  assert.throws(() => blockList.check(1), /ERR_INVALID_ARG_TYPE/);
  assert.throws(() => blockList.check('', 1), /ERR_INVALID_ARG_TYPE/);
}

{
  const blockList = new BlockList();
  const ret = util.inspect(blockList, { depth: -1 });
  assert.strictEqual(ret, '[BlockList]');
}

{
  const blockList = new BlockList();
  const ret = util.inspect(blockList, { depth: null });
  assert(ret.includes('rules: []'));
}

{
  // Test for https://github.com/nodejs/node/issues/43360
  const blocklist = new BlockList();
  blocklist.addSubnet('1.1.1.1', 32, 'ipv4');

  assert(blocklist.check('1.1.1.1'));
  assert(!blocklist.check('1.1.1.2'));
  assert(!blocklist.check('2.3.4.5'));
}

{
  assert(BlockList.isBlockList(new BlockList()));
  assert(!BlockList.isBlockList({}));
}

{
  // Test that adding the same address twice does not create duplicate rules.
  // Previously, the second add would orphan the first rule in the internal
  // list while overwriting its index entry, making it unreachable for removal
  // but still evaluated during checks.
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addAddress('1.1.1.1');

  // Should have exactly one rule, not two.
  assert.strictEqual(blockList.rules.length, 1);
  assert(blockList.check('1.1.1.1'));
}

{
  // Test clear() removes all rules.
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addRange('10.0.0.1', '10.0.0.10');
  blockList.addSubnet('192.168.0.0', 16);

  assert.strictEqual(blockList.rules.length, 3);
  assert(blockList.check('1.1.1.1'));
  assert(blockList.check('10.0.0.5'));
  assert(blockList.check('192.168.1.1'));

  blockList.clear();

  assert.strictEqual(blockList.rules.length, 0);
  assert(!blockList.check('1.1.1.1'));
  assert(!blockList.check('10.0.0.5'));
  assert(!blockList.check('192.168.1.1'));

  // Can add new rules after clearing.
  blockList.addAddress('2.2.2.2');
  assert.strictEqual(blockList.rules.length, 1);
  assert(blockList.check('2.2.2.2'));
  assert(!blockList.check('1.1.1.1'));
}

{
  // addAddresses() validation: non-array argument throws.
  const blockList0 = new BlockList();
  assert.throws(() => blockList0.addAddresses('not-an-array'), {
    code: 'ERR_INVALID_ARG_TYPE',
  });
  assert.throws(() => blockList0.addAddresses(123), {
    code: 'ERR_INVALID_ARG_TYPE',
  });
}

{
  // addAddresses() and addCIDRs() must throw the same errors for non-array
  // input regardless of how the checks are implemented internally.
  const blockList = new BlockList();
  for (const [value, received] of [
    ['x', "type string ('x')"],
    [123, 'type number (123)'],
    [{}, 'an instance of Object'],
    [null, 'null'],
    [undefined, 'undefined'],
    [1n, 'type bigint (1n)'],
    [true, 'type boolean (true)'],
  ]) {
    assert.throws(() => blockList.addAddresses(value), {
      code: 'ERR_INVALID_ARG_TYPE',
      name: 'TypeError',
      message: 'The "addresses" argument must be an instance of Array. ' +
               `Received ${received}`,
    });
    assert.throws(() => blockList.addCIDRs(value), {
      code: 'ERR_INVALID_ARG_TYPE',
      name: 'TypeError',
      message: 'The "cidrs" argument must be an instance of Array. ' +
               `Received ${received}`,
    });
  }
}

{
  // Test addAddresses() batch insert.
  const blockList = new BlockList();
  blockList.addAddresses(['1.1.1.1', '2.2.2.2', '3.3.3.3']);

  assert(blockList.check('1.1.1.1'));
  assert(blockList.check('2.2.2.2'));
  assert(blockList.check('3.3.3.3'));
  assert(!blockList.check('4.4.4.4'));
  assert.strictEqual(blockList.rules.length, 3);

  // Cross-family works with batch insert.
  assert(blockList.check('::ffff:1.1.1.1', 'ipv6'));

  // Batch with SocketAddress objects.
  const blockList2 = new BlockList();
  const sa1 = new SocketAddress({ address: '10.0.0.1' });
  const sa2 = new SocketAddress({ address: '10.0.0.2' });
  blockList2.addAddresses([sa1, sa2]);
  assert(blockList2.check('10.0.0.1'));
  assert(blockList2.check('10.0.0.2'));
  assert(!blockList2.check('10.0.0.3'));

  // IPv6 batch.
  const blockList3 = new BlockList();
  blockList3.addAddresses(['::1', '::2'], 'ipv6');
  assert(blockList3.check('::1', 'ipv6'));
  assert(blockList3.check('::2', 'ipv6'));
  assert(!blockList3.check('::3', 'ipv6'));
}

// Test exporting and importing the rule list to/from JSON
{
  const ruleList = [
    'Address: IPv4 10.0.0.5',
    'Address: IPv6 ::',
    'Subnet: IPv4 192.168.1.0/24',
    'Subnet: IPv6 8592:757c:efae:4e45::/64',
  ];

  const test2 = new BlockList();
  const test3 = new BlockList();
  const test4 = new BlockList();
  const test5 = new BlockList();

  const bl = new BlockList();
  bl.addAddress('10.0.0.5');
  bl.addAddress('::', 'ipv6');
  bl.addSubnet('192.168.1.0', 24);
  bl.addSubnet('8592:757c:efae:4e45::', 64, 'ipv6');

  // Test invalid inputs (input to fromJSON must be an array of
  // string rules or a serialized json string of an array of
  // string rules.
  [
    1, null, Symbol(), [1, 2, 3], '123', [Symbol()], new Map(),
  ].forEach((i) => {
    assert.throws(() => test2.fromJSON(i), {
      code: 'ERR_INVALID_ARG_TYPE',
    });
  });

  // Invalid rules are ignored.
  test2.fromJSON(['1', '2', '3']);
  assert.deepStrictEqual(test2.rules, []);

  // Direct output from toJSON method works
  test2.fromJSON(bl.toJSON());
  assert.deepStrictEqual(test2.rules.sort(), ruleList);

  // JSON stringified output works
  test3.fromJSON(JSON.stringify(bl));
  assert.deepStrictEqual(test3.rules.sort(), ruleList);

  // A raw array works
  test4.fromJSON(ruleList);
  assert.deepStrictEqual(test4.rules.sort(), ruleList);

  // Individual rules work
  ruleList.forEach((item) => {
    test5.fromJSON([item]);
  });
  assert.deepStrictEqual(test5.rules.sort(), ruleList);

  // Each of the created blocklists should handle the checks identically.
  [
    ['10.0.0.5', 'ipv4', true],
    ['10.0.0.6', 'ipv4', false],
    ['::', 'ipv6', true],
    ['::1', 'ipv6', false],
    ['192.168.1.0', 'ipv4', true],
    ['193.168.1.0', 'ipv4', false],
    ['8592:757c:efae:4e45::', 'ipv6', true],
    ['1111:1111:1111:1111::', 'ipv6', false],
  ].forEach((i) => {
    assert.strictEqual(bl.check(i[0], i[1]), i[2]);
    assert.strictEqual(test2.check(i[0], i[1]), i[2]);
    assert.strictEqual(test3.check(i[0], i[1]), i[2]);
    assert.strictEqual(test4.check(i[0], i[1]), i[2]);
    assert.strictEqual(test5.check(i[0], i[1]), i[2]);
  });
}

// removeRange: basic removal
{
  const blockList = new BlockList();
  blockList.addRange('10.0.0.1', '10.0.0.100');
  blockList.addRange('192.168.1.1', '192.168.1.50');
  assert(blockList.check('10.0.0.50'));
  assert(blockList.check('192.168.1.25'));

  blockList.removeRange('10.0.0.1', '10.0.0.100');
  assert(!blockList.check('10.0.0.50'));
  assert(blockList.check('192.168.1.25'));
  assert.strictEqual(blockList.rules.length, 1);
}

// removeRange: non-existent range is a no-op
{
  const blockList = new BlockList();
  blockList.addRange('10.0.0.1', '10.0.0.10');
  assert.strictEqual(blockList.rules.length, 1);
  blockList.removeRange('99.99.99.1', '99.99.99.10');
  assert.strictEqual(blockList.rules.length, 1);
  assert(blockList.check('10.0.0.5'));
}

// removeRange: IPv6 range
{
  const blockList = new BlockList();
  blockList.addRange('2001:db8::1', '2001:db8::ff', 'ipv6');
  assert(blockList.check('2001:db8::50', 'ipv6'));

  blockList.removeRange('2001:db8::1', '2001:db8::ff', 'ipv6');
  assert(!blockList.check('2001:db8::50', 'ipv6'));
  assert.strictEqual(blockList.rules.length, 0);
}

// removeRange: with SocketAddress objects
{
  const blockList = new BlockList();
  const start = new SocketAddress({ address: '10.0.0.1' });
  const end = new SocketAddress({ address: '10.0.0.10' });
  blockList.addRange(start, end);
  assert(blockList.check('10.0.0.5'));

  blockList.removeRange(start, end);
  assert(!blockList.check('10.0.0.5'));
}

// removeSubnet: basic IPv4 removal
{
  const blockList = new BlockList();
  blockList.addSubnet('10.0.0.0', 8);
  blockList.addSubnet('192.168.0.0', 16);
  assert(blockList.check('10.1.2.3'));
  assert(blockList.check('192.168.5.5'));

  blockList.removeSubnet('10.0.0.0', 8);
  assert(!blockList.check('10.1.2.3'));
  assert(blockList.check('192.168.5.5'));
  assert.strictEqual(blockList.rules.length, 1);
}

// removeSubnet: IPv6
{
  const blockList = new BlockList();
  blockList.addSubnet('2001:db8::', 32, 'ipv6');
  assert(blockList.check('2001:db8::1', 'ipv6'));

  blockList.removeSubnet('2001:db8::', 32, 'ipv6');
  assert(!blockList.check('2001:db8::1', 'ipv6'));
  assert.strictEqual(blockList.rules.length, 0);
}

// removeSubnet: cross-family cleanup
{
  const blockList = new BlockList();
  blockList.addSubnet('10.0.0.0', 8);
  assert(blockList.check('::ffff:10.0.0.1', 'ipv6'));

  blockList.removeSubnet('10.0.0.0', 8);
  assert(!blockList.check('10.0.0.1'));
  assert(!blockList.check('::ffff:10.0.0.1', 'ipv6'));
}

// removeSubnet: non-existent subnet is a no-op
{
  const blockList = new BlockList();
  blockList.addSubnet('10.0.0.0', 8);
  blockList.removeSubnet('172.16.0.0', 12);
  assert(blockList.check('10.1.2.3'));
  assert.strictEqual(blockList.rules.length, 1);
}

// removeSubnet: with SocketAddress objects
{
  const blockList = new BlockList();
  const net = new SocketAddress({ address: '10.0.0.0' });
  blockList.addSubnet(net, 8);
  assert(blockList.check('10.1.2.3'));

  blockList.removeSubnet(net, 8);
  assert(!blockList.check('10.1.2.3'));
}

// removeRange/removeSubnet don't affect other rule types
{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addRange('10.0.0.1', '10.0.0.100');
  blockList.addSubnet('192.168.0.0', 16);

  blockList.removeRange('10.0.0.1', '10.0.0.100');
  blockList.removeSubnet('192.168.0.0', 16);

  // Address rule should still work
  assert(blockList.check('1.1.1.1'));
  assert(!blockList.check('10.0.0.50'));
  assert(!blockList.check('192.168.1.1'));
}

// addCIDR: IPv4
{
  const blockList = new BlockList();
  blockList.addCIDR('10.0.0.0/8');
  blockList.addCIDR('192.168.1.0/24');
  assert(blockList.check('10.1.2.3'));
  assert(blockList.check('192.168.1.50'));
  assert(!blockList.check('192.168.2.1'));
  assert(!blockList.check('11.0.0.1'));
}

// addCIDR: IPv6 auto-detected
{
  const blockList = new BlockList();
  blockList.addCIDR('2001:db8::/32');
  assert(blockList.check('2001:db8::1', 'ipv6'));
  assert(blockList.check('2001:db8:ffff::1', 'ipv6'));
  assert(!blockList.check('2001:db9::1', 'ipv6'));
}

// addCIDR: cross-family
{
  const blockList = new BlockList();
  blockList.addCIDR('10.0.0.0/8');
  assert(blockList.check('::ffff:10.0.0.1', 'ipv6'));
}

// addCIDR: validation errors
{
  const blockList = new BlockList();
  assert.throws(() => blockList.addCIDR('10.0.0.0'), {
    code: 'ERR_INVALID_ARG_VALUE',
  });
  assert.throws(() => blockList.addCIDR('10.0.0.0/abc'), {
    code: 'ERR_INVALID_ARG_VALUE',
  });
  assert.throws(() => blockList.addCIDR(123), {
    code: 'ERR_INVALID_ARG_TYPE',
  });
  assert.throws(() => blockList.addCIDR('10.0.0.0/'), {
    code: 'ERR_INVALID_ARG_VALUE',
  });
}

// removeCIDR: basic
{
  const blockList = new BlockList();
  blockList.addCIDR('10.0.0.0/8');
  blockList.addCIDR('192.168.0.0/16');
  assert(blockList.check('10.1.2.3'));

  blockList.removeCIDR('10.0.0.0/8');
  assert(!blockList.check('10.1.2.3'));
  assert(blockList.check('192.168.1.1'));
  assert.strictEqual(blockList.rules.length, 1);
}

// removeCIDR: IPv6
{
  const blockList = new BlockList();
  blockList.addCIDR('2001:db8::/32');
  assert(blockList.check('2001:db8::1', 'ipv6'));

  blockList.removeCIDR('2001:db8::/32');
  assert(!blockList.check('2001:db8::1', 'ipv6'));
  assert.strictEqual(blockList.rules.length, 0);
}

// removeCIDR: non-existent is a no-op
{
  const blockList = new BlockList();
  blockList.addCIDR('10.0.0.0/8');
  blockList.removeCIDR('172.16.0.0/12');
  assert(blockList.check('10.1.2.3'));
  assert.strictEqual(blockList.rules.length, 1);
}

// addCIDR interoperates with removeSubnet, and vice versa
{
  const blockList = new BlockList();
  blockList.addCIDR('10.0.0.0/8');
  blockList.removeSubnet('10.0.0.0', 8);
  assert(!blockList.check('10.1.2.3'));

  blockList.addSubnet('192.168.0.0', 16);
  blockList.removeCIDR('192.168.0.0/16');
  assert(!blockList.check('192.168.1.1'));
}

// removeAddress: basic
{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addAddress('2.2.2.2');
  assert(blockList.check('1.1.1.1'));

  blockList.removeAddress('1.1.1.1');
  assert(!blockList.check('1.1.1.1'));
  assert(blockList.check('2.2.2.2'));
}

// removeAddress: cross-family cleanup
{
  const blockList = new BlockList();
  blockList.addAddress('3.3.3.3');
  assert(blockList.check('::ffff:3.3.3.3', 'ipv6'));

  blockList.removeAddress('3.3.3.3');
  assert(!blockList.check('3.3.3.3'));
  assert(!blockList.check('::ffff:3.3.3.3', 'ipv6'));
}

// removeAddress: IPv6
{
  const blockList = new BlockList();
  blockList.addAddress('::1', 'ipv6');
  assert(blockList.check('::1', 'ipv6'));

  blockList.removeAddress('::1', 'ipv6');
  assert(!blockList.check('::1', 'ipv6'));
}

// removeAddress: non-existent is a no-op
{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.removeAddress('9.9.9.9');
  assert(blockList.check('1.1.1.1'));
}

// removeAddress: with SocketAddress object
{
  const blockList = new BlockList();
  const addr = new SocketAddress({ address: '5.5.5.5' });
  blockList.addAddress(addr);
  assert(blockList.check('5.5.5.5'));

  blockList.removeAddress(addr);
  assert(!blockList.check('5.5.5.5'));
}

// addCIDRs: batch
{
  const blockList = new BlockList();
  blockList.addCIDRs(['10.0.0.0/8', '192.168.0.0/16', '2001:db8::/32']);
  assert(blockList.check('10.1.2.3'));
  assert(blockList.check('192.168.1.1'));
  assert(blockList.check('2001:db8::1', 'ipv6'));
  assert(!blockList.check('11.0.0.1'));
  assert.strictEqual(blockList.rules.length, 3);
}

// addCIDRs: validation
{
  const blockList = new BlockList();
  assert.throws(() => blockList.addCIDRs('not-an-array'), {
    code: 'ERR_INVALID_ARG_TYPE',
  });
  assert.throws(() => blockList.addCIDRs([123]), {
    code: 'ERR_INVALID_ARG_TYPE',
  });
  assert.throws(() => blockList.addCIDRs(['10.0.0.0']), {
    code: 'ERR_INVALID_ARG_VALUE',
  });
}

// addCIDRs: empty array is a no-op
{
  const blockList = new BlockList();
  blockList.addCIDRs([]);
  assert.strictEqual(blockList.size, 0);
}

// addCIDRs: invalid entry mid-array does not half-apply
{
  const blockList = new BlockList();
  assert.throws(() => blockList.addCIDRs(['10.0.0.0/8', 'bad', '1.1.1.0/24']), {
    code: 'ERR_INVALID_ARG_VALUE',
  });
  // Nothing should have been applied.
  assert.strictEqual(blockList.size, 0);
  assert(!blockList.check('10.0.0.1'));
}

// size: tracks all rule types
{
  const blockList = new BlockList();
  assert.strictEqual(blockList.size, 0);

  blockList.addAddress('1.1.1.1');
  assert.strictEqual(blockList.size, 1);

  blockList.addRange('10.0.0.1', '10.0.0.10');
  assert.strictEqual(blockList.size, 2);

  blockList.addSubnet('192.168.0.0', 16);
  assert.strictEqual(blockList.size, 3);

  // Matches rules.length
  assert.strictEqual(blockList.size, blockList.rules.length);

  blockList.removeAddress('1.1.1.1');
  assert.strictEqual(blockList.size, 2);

  blockList.removeRange('10.0.0.1', '10.0.0.10');
  assert.strictEqual(blockList.size, 1);

  blockList.removeSubnet('192.168.0.0', 16);
  assert.strictEqual(blockList.size, 0);

  // After clear
  blockList.addAddress('5.5.5.5');
  blockList.clear();
  assert.strictEqual(blockList.size, 0);
}

// size: duplicate addAddress does not double-count
{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  blockList.addAddress('1.1.1.1');
  assert.strictEqual(blockList.size, 1);
}

// PRIVATE_RANGES: is a frozen array of CIDR strings
{
  assert(Array.isArray(BlockList.PRIVATE_RANGES));
  assert(Object.isFrozen(BlockList.PRIVATE_RANGES));
  assert(BlockList.PRIVATE_RANGES.length > 0);
  for (const cidr of BlockList.PRIVATE_RANGES) {
    assert.strictEqual(typeof cidr, 'string');
    assert(cidr.includes('/'));
  }
}

// PRIVATE_RANGES: covers expected addresses
{
  const blockList = new BlockList();
  blockList.addCIDRs(BlockList.PRIVATE_RANGES);

  // IPv4 private (RFC 1918)
  assert(blockList.check('10.0.0.1'));
  assert(blockList.check('10.255.255.255'));
  assert(blockList.check('172.16.0.1'));
  assert(blockList.check('172.31.255.255'));
  assert(blockList.check('192.168.0.1'));
  assert(blockList.check('192.168.255.255'));

  // Loopback
  assert(blockList.check('127.0.0.1'));
  assert(blockList.check('127.255.255.255'));
  assert(blockList.check('::1', 'ipv6'));

  // Link-local
  assert(blockList.check('169.254.0.1'));
  assert(blockList.check('fe80::1', 'ipv6'));

  // ULA
  assert(blockList.check('fc00::1', 'ipv6'));
  assert(blockList.check('fd00::1', 'ipv6'));

  // Public addresses should not match
  assert(!blockList.check('8.8.8.8'));
  assert(!blockList.check('1.1.1.1'));
  assert(!blockList.check('203.0.113.1'));
  assert(!blockList.check('2001:db8::1', 'ipv6'));
}

// check() with invalid address string returns false (exercises checkString
// error path in C++ — SocketAddress::New fails, returns false).
{
  const blockList = new BlockList();
  blockList.addAddress('1.1.1.1');
  assert.strictEqual(blockList.check('not_a_valid_ip'), false);
  assert.strictEqual(blockList.check('', 'ipv4'), false);
  assert.strictEqual(blockList.check('999.999.999.999'), false);
  assert.strictEqual(blockList.check('not_valid_ipv6', 'ipv6'), false);
}

// uv_ip6_addr ignores an unknown/overlong zone (scope_id 0). A Fast API
// stack limit must not turn that into a miss after JIT.
{
  const blockList = new BlockList();
  blockList.addAddress('fe80::1', 'ipv6');
  const longZone = `fe80::1%${'z'.repeat(200)}`;
  assert.strictEqual(blockList.check('fe80::1', 'ipv6'), true);
  assert.strictEqual(blockList.check(longZone, 'ipv6'), true);
  assert.strictEqual(blockList.check('x'.repeat(200), 'ipv6'), false);

  // uv_ip4_addr rejects zone suffixes. The Fast API overflow path
  // must not strip %zone and treat this as 1.1.1.1.
  blockList.addAddress('1.1.1.1');
  assert.strictEqual(blockList.check(`1.1.1.1%${'z'.repeat(200)}`), false);

  // Mixed-notation IPv6 is 45 chars. uv_ip6_addr truncates the
  // address part to 39 when a zone is present, so this is a miss.
  const mixed = 'ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255';
  blockList.addAddress(mixed, 'ipv6');
  assert.strictEqual(blockList.check(mixed, 'ipv6'), true);
  assert.strictEqual(blockList.check(`${mixed}%${'z'.repeat(200)}`, 'ipv6'),
                     // This returns true as of libuv 1.53.0 (there are no 0.53.0 version)
                     (([major, minor]) => major > 1 || minor > 52)(process.versions.uv.split('.')));
}

// check() family parameter is case-insensitive.
{
  const blockList = new BlockList();
  blockList.addAddress('10.0.0.1');
  blockList.addAddress('::1', 'ipv6');

  assert(blockList.check('10.0.0.1', 'ipv4'));
  assert(blockList.check('10.0.0.1', 'IPv4'));
  assert(blockList.check('10.0.0.1', 'IPV4'));
  assert(blockList.check('::1', 'ipv6'));
  assert(blockList.check('::1', 'IPv6'));
  assert(blockList.check('::1', 'IPV6'));
}

// SocketAddress constructor with invalid address throws ERR_INVALID_ADDRESS.
{
  assert.throws(() => new SocketAddress({ address: 'not_a_valid_ip' }), {
    code: 'ERR_INVALID_ADDRESS',
  });
  assert.throws(
    () => new SocketAddress({ address: 'not_valid', family: 'ipv6' }), {
      code: 'ERR_INVALID_ADDRESS',
    });
}

// check() with SocketAddress objects across family boundaries.
{
  const blockList = new BlockList();
  const ipv4 = new SocketAddress({ address: '10.0.0.1' });
  const mapped = new SocketAddress({
    address: '::ffff:10.0.0.1',
    family: 'ipv6',
  });

  blockList.addAddress(ipv4);

  // Check with SocketAddress objects (exercises the check() -> C++ fast path).
  assert(blockList.check(ipv4));
  assert(blockList.check(mapped));

  blockList.removeAddress(ipv4);
  assert(!blockList.check(ipv4));
  assert(!blockList.check(mapped));
}

// Subnet with IPv4-mapped IPv6 network.
{
  const blockList = new BlockList();
  blockList.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');

  // IPv4-mapped IPv6 within the subnet should match.
  assert(blockList.check('::ffff:10.0.0.5', 'ipv6'));
  // The plain IPv4 form should also match (cross-family trie lookup).
  assert(blockList.check('10.0.0.5'));
  // Outside the subnet.
  assert(!blockList.check('10.0.1.0'));
}

// Range with IPv6 addresses.
{
  const blockList = new BlockList();
  blockList.addRange('::1', '::ff', 'ipv6');
  assert(blockList.check('::1', 'ipv6'));
  assert(blockList.check('::a0', 'ipv6'));
  assert(blockList.check('::ff', 'ipv6'));
  assert(!blockList.check('::100', 'ipv6'));
  assert(!blockList.check('::0', 'ipv6'));

  blockList.removeRange('::1', '::ff', 'ipv6');
  assert(!blockList.check('::a0', 'ipv6'));
}

// Removing a broader subnet must restore subsumed narrower subnets.
{
  const blockList = new BlockList();
  blockList.addSubnet('10.0.0.0', 8);   // /8 subsumes /16 in the trie
  blockList.addSubnet('10.1.0.0', 16);
  assert(blockList.check('10.1.2.3'));

  blockList.removeSubnet('10.0.0.0', 8);

  // /16 must still work after /8 is removed.
  assert(blockList.check('10.1.2.3'));
  // Address outside /16 but inside old /8 should no longer match.
  assert(!blockList.check('10.2.0.1'));
  assert.strictEqual(blockList.rules.length, 1);
}

{
  // IPv4-mapped / mixed-notation IPv6 rules must survive a toJSON/fromJSON
  // round-trip. toJSON() emits these addresses in mixed dotted-quad form
  // (e.g. "::ffff:192.0.2.128"), so the rule parser must accept the "." used
  // in that notation.
  const bl = new BlockList();
  bl.addAddress('::ffff:192.0.2.128', 'ipv6');
  bl.addSubnet('::ffff:10.0.0.0', 120, 'ipv6');
  bl.addRange('::ffff:172.16.0.1', '::ffff:172.16.0.10', 'ipv6');

  const expected = [
    'Address: IPv6 ::ffff:192.0.2.128',
    'Range: IPv6 ::ffff:172.16.0.1-::ffff:172.16.0.10',
    'Subnet: IPv6 ::ffff:10.0.0.0/120',
  ];
  assert.deepStrictEqual(bl.toJSON().sort(), expected);

  const restored = new BlockList();
  restored.fromJSON(bl.toJSON());

  // The restored rules must be identical (lossless round-trip).
  assert.deepStrictEqual(restored.toJSON().sort(), expected);

  // And it must still match the same addresses as the original.
  [
    ['::ffff:192.0.2.128', true],  // the single address
    ['::ffff:192.0.2.129', false],
    ['::ffff:10.0.0.50', true],    // inside the subnet
    ['::ffff:10.0.1.0', false],
    ['::ffff:172.16.0.5', true],   // inside the range
    ['::ffff:172.16.0.20', false],
  ].forEach(([address, result]) => {
    assert.strictEqual(bl.check(address, 'ipv6'), result);
    assert.strictEqual(restored.check(address, 'ipv6'), result);
  });
}