@jrpool/kilotest 50.0.0 → 52.0.0

package/index.test.ts

@@ -15,9 +15,23 @@ process.env.DB_DIR = fixtureDBDir;
 process.env.AUTH_CODE = 'test-auth-code';
 process.env.TUTORIAL_WEB_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialWeb.json');
 process.env.TUTORIAL_AI_COMMENTS_PATH = path.join(testCommentsDir, 'tutorialAI.json');
+process.env.FEATURE_REQUESTS_PATH = path.join(testCommentsDir, 'featureRequests.json');
 process.env.TESTARO_WORKERS = JSON.stringify({
   worker1: {secret: 'secret1', name: 'Worker One'}
 });
+// Allow internal targets by default, so tests that submit an ordinary https://example.com/...
+// URL do not depend on real DNS/network access to pass the resolution check that
+// isAllowedTarget performs. Tests of the check itself (below) override this per test.
+process.env.ALLOW_INTERNAL_TARGETS = 'true';
+// Blank the alert configuration unconditionally, so this file sends no real alert
+// emails (e.g. from the requestTest/requestRetest/tutorial-comment tests below) even
+// when run directly (e.g. `npx tsx --test index.test.ts`) rather than via `npm test`,
+// which normally guards against this by --require-ing test/setup.ts first. dotenv does
+// not override an already-set env var, so setting these here, before index.ts is ever
+// imported, prevents a real .env file's alert credentials from ever taking effect.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
 
 // IMPORTS
 
@@ -58,6 +72,7 @@ beforeEach(async () => {
   await fs.mkdir(testCommentsDir, {recursive: true});
   await fs.writeFile(path.join(testCommentsDir, 'tutorialWeb.json'), '[]\n');
   await fs.writeFile(path.join(testCommentsDir, 'tutorialAI.json'), '[]\n');
+  await fs.writeFile(path.join(testCommentsDir, 'featureRequests.json'), '[]\n');
 });
 
 after(async () => {
@@ -215,6 +230,30 @@ test('GET /index.html serves the home page', async () => {
   assert.ok(res.headers['content-type'].includes('text/html'));
 });
 
+// TESTS: HEAD routes
+
+test('HEAD / returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /index.html returns the same status and headers as GET /, with no body', async () => {
+  const getRes = await request('GET', '/');
+  const headRes = await request('HEAD', '/index.html');
+  assert.equal(headRes.statusCode, getRes.statusCode);
+  assert.equal(headRes.headers['content-type'], getRes.headers['content-type']);
+  assert.equal(headRes.body, '');
+});
+
+test('HEAD /robots.txt returns an invalid HEAD request error, since only the home page supports HEAD', async () => {
+  const res = await request('HEAD', '/robots.txt');
+  assert.equal(res.statusCode, 400);
+  assert.equal(res.body, '');
+});
+
 test('GET /robots.txt serves the robots file as text', async () => {
   const res = await request('GET', '/robots.txt');
   assert.equal(res.statusCode, 200);
@@ -870,6 +909,21 @@ test('POST /requestTest.html with non-https URL returns an error', async () => {
   assert.ok(res.body.includes('Invalid test request'));
 });
 
+test('POST /requestTest.html with a private-address URL returns an error unless internal targets are allowed', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  try {
+    const res = await formRequest('POST', '/requestTest.html', {
+      description: 'Internal Page',
+      url: 'https://192.168.1.1/page',
+      why: 'Because accessibility matters'
+    });
+    assert.equal(res.statusCode, 400);
+    assert.ok(res.body.includes('Invalid test request'));
+  } finally {
+    process.env.ALLOW_INTERNAL_TARGETS = 'true';
+  }
+});
+
 test('POST /requestRetest.html/260202T0000/new with missing why returns an error', async () => {
   const res = await formRequest('POST', '/requestRetest.html/260202T0000/new', {
     why: ''
@@ -1192,6 +1246,62 @@ test('POST /worker/report with a claimed job but an unusable report returns an e
   await fs.unlink(failedJobPath).catch(() => {});
 });
 
+test('POST /worker/report with a report on a disallowed target rejects it and reclassifies the job', {timeout: 500}, async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  // Use a unique job ID that does not conflict with existing fixtures.
+  const jobID = '990101T0002-ssr';
+  const reportPath = path.join(fixtureDBDir, 'reports', `${jobID}.json`);
+  const claimedDir = path.join(fixtureDBDir, 'jobs', 'claimed');
+  const failedDir = path.join(fixtureDBDir, 'jobs', 'failed');
+  const jobFile = `${jobID}.json`;
+  const claimedJobPath = path.join(claimedDir, jobFile);
+  const failedJobPath = path.join(failedDir, jobFile);
+  try {
+    // Clean up any leftover files.
+    await fs.unlink(reportPath).catch(() => {});
+    await fs.unlink(failedJobPath).catch(() => {});
+    // Create a claimed job assigned to Worker One.
+    await fs.writeFile(claimedJobPath, JSON.stringify({
+      id: jobID,
+      target: {what: 'Test', url: 'https://example.com/test'},
+      sources: {worker: 'Worker One'}
+    }));
+    const auth = Buffer.from('worker1:secret1').toString('base64');
+    // A report that is otherwise usable, but whose test act was redirected (actualURL)
+    // to a private address that this deployment does not allow as a testing target.
+    const report = {
+      id: jobID,
+      target: {what: 'Test', url: 'https://example.com/test'},
+      acts: [{
+        type: 'test', which: 'axe', actualURL: 'https://192.168.1.1/test',
+        result: {standardResult: {instances: []}}
+      }],
+      jobData: {endTime: '26-01-01T00:00'},
+      catalog: {}
+    };
+    const res = await request('POST', '/worker/report', {report}, {
+      authorization: `Basic ${auth}`
+    });
+    assert.equal(res.statusCode, 400);
+    const body = jsonBody(res);
+    assert.ok(body.error.message.includes('disallowed target'));
+    // The report should not have been recorded.
+    const reportExists = await fs.access(reportPath).then(() => true).catch(() => false);
+    assert.equal(reportExists, false, 'Report on a disallowed target should not be saved');
+    // Wait for the async rename to complete.
+    await new Promise<void>(resolve => setTimeout(resolve, 100));
+    // The job should have been reclassified as failed rather than left claimed.
+    const failedExists = await fs.access(failedJobPath).then(() => true).catch(() => false);
+    assert.ok(failedExists, 'Job should be moved to the failed directory');
+    const claimedExists = await fs.access(claimedJobPath).then(() => true).catch(() => false);
+    assert.equal(claimedExists, false, 'Job should be removed from the claimed directory');
+  } finally {
+    process.env.ALLOW_INTERNAL_TARGETS = 'true';
+    // Clean up.
+    await fs.unlink(failedJobPath).catch(() => {});
+  }
+});
+
 // TESTS: remaining error branches and web pages
 
 test('GET /style.css with a read error returns an error page', async () => {
@@ -1247,6 +1357,7 @@ const htmlPagePaths = [
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
   '/ai0BalanceForm.html',
+  '/deleteNotesForm.html',
   '/metrics.html'
 ];
 
@@ -1424,6 +1535,32 @@ test('POST /rewindReportsForm.html with no selections shows the form and records
   assert.equal(await getManagerActivityCount('rewindReportsForm', 'ok'), countBefore + 1);
 });
 
+test('POST /deleteNotesForm.html deletes multiple selected notes across sources in one submission', async () => {
+  await fs.writeFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(process.env.FEATURE_REQUESTS_PATH!, JSON.stringify([
+    {timeStamp: '260101T0001', content: 'A feature request'},
+    {timeStamp: '260101T0001', content: 'A different feature request'}
+  ]));
+  // Reconstructing the POST body's query string uses querystring.stringify, which (unlike
+  // the URLSearchParams object constructor) preserves multiple values for the same field
+  // name as repeated key=value pairs rather than collapsing them into one comma-joined
+  // value, so this exercises that multi-checkbox submission actually deletes every
+  // selected note, not just the one whose value happens to survive the collapse.
+  const res = await formRequest('POST', '/deleteNotesForm.html', [
+    ['authCode', 'test-auth-code'],
+    ['note', `tutorialWeb\t${encodeURIComponent('A web tutorial comment')}`],
+    ['note', `featureRequest\t${encodeURIComponent('A feature request')}`]
+  ]);
+  assert.equal(res.statusCode, 200);
+  const webComments = JSON.parse(await fs.readFile(process.env.TUTORIAL_WEB_COMMENTS_PATH!, 'utf8'));
+  assert.equal(webComments.length, 0);
+  const featureRequests = JSON.parse(await fs.readFile(process.env.FEATURE_REQUESTS_PATH!, 'utf8'));
+  assert.equal(featureRequests.length, 1);
+  assert.equal(featureRequests[0].content, 'A different feature request');
+});
+
 test('GET /pruneReportsForm.html records a managerActivity failure when a report file is corrupt', {timeout: 500}, async () => {
   const reportPath = path.join(fixtureDBDir, 'reports', '260101T0001-ct.json');
   const backup = await fs.readFile(reportPath, 'utf8');

package/index.ts

@@ -17,6 +17,8 @@ import {
   getObject,
   getPOSTData,
   getReport,
+  isAllowedReport,
+  isAllowedTarget,
   isReportError,
   getReportPath,
   hiddenReportsPath,
@@ -42,7 +44,9 @@ import {answer as tutorialAI, handleComment as handleTutorialAIComment} from './
 import http, {type IncomingMessage, type ServerResponse} from 'node:http';
 import https from 'node:https';
 import path from 'node:path';
+import querystring from 'node:querystring';
 import {answer as ai0BalanceForm} from './web/ai0BalanceForm/index.ts';
+import {answer as deleteNotesForm} from './web/deleteNotesForm/index.ts';
 import {answer as enqueue} from './web/enqueue/index.ts';
 import {answer as enqueueForm} from './web/enqueueForm/index.ts';
 import {answer as expungeReportsForm} from './web/expungeReportsForm/index.ts';
@@ -97,6 +101,7 @@ type PageHandler = (...args: any[]) => Promise<AnswerData>;
 
 const answer: {
   ai0BalanceForm: PageHandler;
+  deleteNotesForm: PageHandler;
   enqueue: PageHandler;
   enqueueForm: PageHandler;
   expungeReportsForm: PageHandler;
@@ -126,6 +131,7 @@ const answer: {
   [key: string]: PageHandler | undefined;
 } = {
   ai0BalanceForm,
+  deleteNotesForm,
   enqueue,
   enqueueForm,
   expungeReportsForm,
@@ -207,6 +213,7 @@ export const routes = {
     '/api/*',
     '/mcp',
     '/ai0BalanceForm.html',
+    '/deleteNotesForm.html',
     '/expungeReportsForm.html',
     '/hideReportForm.html',
     '/metrics.html',
@@ -240,6 +247,7 @@ const managerPages = new Set([
   'unhideReportForm',
   'ai0BalanceForm',
   'renewWCAGForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The set of manager pages (a subset of managerPages) whose single answer() function both
@@ -255,6 +263,7 @@ const selfSubmittingManagerPages = new Set([
   'showHiddenReportsForm',
   'unhideReportForm',
   'ai0BalanceForm',
+  'deleteNotesForm',
   'metrics'
 ]);
 // The subset of selfSubmittingManagerPages that must never be served on a direct GET
@@ -857,6 +866,19 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       );
     }
   }
+  // Otherwise, if the request is a HEAD request: only the home page supports HEAD, since
+  // UptimeRobot's uptime check is the only known HEAD caller and it targets only that path
+  // (see "Health monitoring" in docs/SERVICE.md). Its response must match what GET / would
+  // send, minus the body, so that a monitor reading headers alone sees the real page state.
+  else if (method === 'HEAD') {
+    if (['/', '/index.html'].includes(pathname)) {
+      setHeaders('text/html', '/index.html', 'medium');
+      response.end();
+    }
+    else {
+      await serveError({message: `ERROR: Invalid HEAD request (${pathname})`}, response, true);
+    }
+  }
   // Otherwise, if the request is a POST request:
   else if (method === 'POST') {
     // If the path is not authorized for POST requests:
@@ -879,7 +901,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       else if (pageName === 'requestTest.html') {
         const {description, url, why} = postData as {description?: string; url: string; why?: string};
         // If the request is valid:
-        if (description && isURL(url) && why) {
+        if (description && isURL(url) && why && await isAllowedTarget(url)) {
           // If a report on the page is already available:
           if (await isReportAvailable(description, url)) {
             // Report the error.
@@ -1023,7 +1045,12 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
         setHeaders('text/html', pathname, 'ultra');
         // Reconstruct a query string from the POST body, so the page's answer() function
         // can read its submitted parameters the same way it reads a GET query string.
-        const search = `?${new URLSearchParams(postData as Record<string, string>).toString()}`;
+        // querystring.stringify (rather than the URLSearchParams object constructor) is
+        // required here, because postData, from querystring.parse in getPOSTData, holds
+        // repeated form fields (e.g. multiple checked checkboxes sharing a name) as an
+        // array; the URLSearchParams constructor would join such an array into a single
+        // comma-separated value instead of preserving it as repeated key=value pairs.
+        const search = `?${querystring.stringify(postData as Record<string, string | string[]>)}`;
         // Get the answer data. The method is passed so the handler only processes a
         // submission for POST, never for GET, regardless of what its query string contains.
         const answerData = await answer[topic]!(pathTail, search, method);
@@ -1078,8 +1105,28 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
               }
               // If the job was actually assigned to this worker:
               if (typeof claimedJob === 'object' && claimedJob !== null && (claimedJob as {sources?: {worker?: string}}).sources?.worker === workerName) {
-                // If the report is usable by Kilotest (as any report of an assigned job should be):
-                if (isUsableReport(reportObj)) {
+                // If the report is on a target this deployment allows (a redirect during
+                // navigation, possibly via DNS rebinding, can take a worker to a target that
+                // was disallowed even though the originally submitted URL passed that check
+                // at submission time):
+                if (!(await isAllowedReport(reportObj))) {
+                  console.error(`ERROR: Report ${id} from worker ${workerName} is on a disallowed target`);
+                  // Alert a manager, since this indicates an attempted or accidental SSRF
+                  // rather than an ordinary usability problem with the report.
+                  await sendAlert(
+                    'Kilotest: report on disallowed target rejected',
+                    `Job ${id} from worker ${workerName} resulted in a visit to a target this deployment does not allow (e.g. a private, loopback, or link-local address), possibly via a redirect. The report was discarded and the job was reclassified as failed.`
+                  );
+                  // Reclassify the job as failed, instead of recording the disallowed report or
+                  // leaving the job claimed indefinitely.
+                  await fs.rename(
+                    path.join(claimedPath(), `${id}.json`), path.join(failedPath(), `${id}.json`)
+                  );
+                  // Report the error.
+                  await serveError({message: `ERROR: Report ${id} is on a disallowed target`}, response, false);
+                }
+                // Otherwise, if the report is usable by Kilotest (as any report of an assigned job should be):
+                else if (isUsableReport(reportObj)) {
                   console.log(`Testaro report ${id} was received from worker ${workerName}`);
                   // Add the public worker name to the report.
                   report!.sources = {...report!.sources, worker: workerName};
@@ -1214,7 +1261,7 @@ const handleRequest = async (request: IncomingMessage, response: ServerResponse)
       }
     }
   }
-  // Otherwise, i.e. if it is neither a GET nor a POST request:
+  // Otherwise, i.e. if it is none of GET, HEAD, or POST:
   else {
     // Report its invalidity. (Caddy handles OPTIONS requests.)
     await serveError({message: 'ERROR: Invalid request method'}, response, true);

package/linkValidation.test.ts

@@ -60,6 +60,7 @@ const htmlRoutes = [
   '/expungeReportsForm.html',
   '/pruneReportsForm.html',
   '/rewindReportsForm.html',
+  '/deleteNotesForm.html',
   '/renewWCAG.html',
   '/renewWCAGForm.html',
   '/enqueue.html',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jrpool/kilotest",
-  "version": "50.0.0",
+  "version": "52.0.0",
   "description": "Ensemble testing for front-end web quality",
   "type": "module",
   "main": "index.ts",

package/robots.txt

@@ -2,6 +2,7 @@
 User-agent: *
 Allow: /
 Disallow: /ai0BalanceForm.html
+Disallow: /deleteNotesForm.html
 Disallow: /enqueueForm.html
 Disallow: /recAction.html
 Disallow: /reannotateForm.html

package/smokeTest.ts

@@ -41,6 +41,7 @@ const concretePaths: Record<string, Record<string, string>> = {
     '/api/*': '/api/requestFeature',
     '/mcp': '/mcp',
     '/ai0BalanceForm.html': '/ai0BalanceForm.html',
+    '/deleteNotesForm.html': '/deleteNotesForm.html',
     '/expungeReportsForm.html': '/expungeReportsForm.html',
     '/hideReportForm.html': '/hideReportForm.html',
     '/metrics.html': '/metrics.html',
@@ -64,6 +65,7 @@ const postBodies: Record<string, object> = {
   '/api/requestFeature': {feature: 'smoke test'},
   '/mcp': {},
   '/ai0BalanceForm.html': {authCode: 'invalid'},
+  '/deleteNotesForm.html': {authCode: 'invalid'},
   '/expungeReportsForm.html': {authCode: 'invalid'},
   '/hideReportForm.html': {authCode: 'invalid'},
   '/metrics.html': {authCode: 'invalid'},
@@ -229,20 +231,23 @@ const isMCPErrorResponse = (result: {statusCode: number | undefined, body: strin
     console.log(`FAIL: POST ${mcpPath} initialize -> error: ${message}`);
     failures++;
   }
-  // Send a browser-style GET to verify that invalid MCP requests get JSON-RPC errors end-to-end.
+  // Send a POST with an Accept header the MCP SDK itself rejects (missing text/event-stream)
+  // to verify that invalid MCP requests get JSON-RPC errors end-to-end. A browser-style GET
+  // is not used here because index.ts deliberately intercepts it before handleMCP, serving a
+  // human-readable explainer page instead of a JSON-RPC error.
   try {
-    const probe = await sendMCPRequest('GET', 'text/html');
+    const probe = await sendMCPRequest('POST', 'application/json', mcpInitialize);
     if (isMCPErrorResponse(probe)) {
-      console.log(`PASS: GET ${mcpPath} browser -> ${probe.statusCode} (JSON-RPC error)`);
+      console.log(`PASS: POST ${mcpPath} bad accept -> ${probe.statusCode} (JSON-RPC error)`);
     }
     else {
-      console.log(`FAIL: GET ${mcpPath} browser -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
+      console.log(`FAIL: POST ${mcpPath} bad accept -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
       failures++;
     }
   }
   catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.log(`FAIL: GET ${mcpPath} browser -> error: ${message}`);
+    console.log(`FAIL: POST ${mcpPath} bad accept -> error: ${message}`);
     failures++;
   }
   console.log(`\n=== ${failures === 0 ? 'All checks passed' : `${failures} failure(s)`} ===`);

package/test/setup.ts

@@ -12,3 +12,8 @@
 for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
   process.env[key] = '';
 }
+// Allow internal targets by default, so that tests submitting an ordinary
+// https://example.com/... URL for testing do not depend on real DNS/network access
+// to pass the resolution check that isAllowedTarget performs. A test of that check
+// itself sets this env var back to unset (or false) around the specific call being tested.
+process.env.ALLOW_INTERNAL_TARGETS = 'true';

package/util.test.ts

@@ -7,8 +7,18 @@
 
 import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
+import net from 'node:net';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+
+// Blank the alert configuration unconditionally, before util.ts (which processTestRequest
+// calls sendAlert from) is ever imported below, so this file sends no real alert emails
+// even when run directly (e.g. `npx tsx --test util.test.ts`) rather than via `npm test`,
+// which normally guards against this via test/setup.ts.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 import {
   annotateReportObject,
   checkCommentDuplicate,
@@ -42,6 +52,8 @@ import {
   getWeightName,
   hiddenReportsPath,
   htmlSafe,
+  isAllowedReport,
+  isAllowedTarget,
   isJobID,
   isReportAvailable,
   isTimeStamp,
@@ -116,26 +128,18 @@ test('checkCommentDuplicate accepts a comment with no existing comments', () =>
   assert.deepEqual(result, {status: 'ok'});
 });
 
-test('checkCommentDuplicate rejects a comment repeating one submitted within the last 1000 seconds', () => {
+test('checkCommentDuplicate rejects a comment identical to one already stored, regardless of when', () => {
   const content = 'a'.repeat(20);
-  const comments = [{timeStamp: getNowStamp(), content}];
+  const comments = [{content}];
   const result = checkCommentDuplicate(comments, content);
   assert.deepEqual(result, {
     status: 'error',
-    message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
   });
 });
 
-test('checkCommentDuplicate accepts a comment repeating one submitted more than 1000 seconds ago', () => {
-  const content = 'a'.repeat(20);
-  const oldTimeStamp = getTimeStamp(new Date(Date.now() - 2000000));
-  const comments = [{timeStamp: oldTimeStamp, content}];
-  const result = checkCommentDuplicate(comments, content);
-  assert.deepEqual(result, {status: 'ok'});
-});
-
-test('checkCommentDuplicate accepts a comment that differs from a recent one', () => {
-  const comments = [{timeStamp: getNowStamp(), content: 'a'.repeat(20)}];
+test('checkCommentDuplicate accepts a comment that differs from a stored one', () => {
+  const comments = [{content: 'a'.repeat(20)}];
   const result = checkCommentDuplicate(comments, 'b'.repeat(20));
   assert.deepEqual(result, {status: 'ok'});
 });
@@ -365,6 +369,160 @@ test('isURL returns false for an invalid URL', () => {
   assert.equal(isURL('not-a-url'), false);
 });
 
+// A fake resolver, so isAllowedTarget tests need no real DNS/network access.
+const fakeLookup = (address: string) => async () => [{address, family: net.isIP(address)}];
+
+// isAllowedTarget and isAllowedReport branch on ALLOW_INTERNAL_TARGETS, which other test
+// files (sharing this process) set to "true" for their own unrelated tests, so every test
+// below sets the env var itself, rather than relying on it being unset by default, and
+// restores whatever value preceded it.
+let savedAllowInternalTargets: string | undefined;
+
+before(() => {
+  savedAllowInternalTargets = process.env.ALLOW_INTERNAL_TARGETS;
+});
+
+after(() => {
+  if (savedAllowInternalTargets === undefined) {
+    delete process.env.ALLOW_INTERNAL_TARGETS;
+  }
+  else {
+    process.env.ALLOW_INTERNAL_TARGETS = savedAllowInternalTargets;
+  }
+});
+
+test('isAllowedTarget returns true for a URL resolving to a public address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('93.184.216.34')), true);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a loopback address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('127.0.0.1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('10.0.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a 172.16/12 private address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('172.20.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a carrier-grade NAT address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('100.70.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to a link-local/cloud-metadata address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('169.254.169.254')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 loopback address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 unspecified address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv4-mapped private IPv6 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('::ffff:10.0.0.5')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 unique-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fd12:3456:789a:1::1')), false);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an IPv6 link-local address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('fe80::1')), false);
+});
+
+test('isAllowedTarget returns true for a URL resolving to a public IPv6 address', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', fakeLookup('2606:2800:220:1:248:1893:25c8:1946')), true);
+});
+
+test('isAllowedTarget returns false for a URL resolving to an address family net.isIP does not recognize', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://example.com/page', async () => [{address: 'not-an-ip', family: 0}]), false);
+});
+
+test('isAllowedTarget returns false when the DNS lookup rejects', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const lookup = async () => { throw new Error('lookup failed'); };
+  assert.equal(await isAllowedTarget('https://nonexistent.invalid/page', lookup), false);
+});
+
+test('isAllowedTarget returns false for a URL whose literal host is a private IP', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://192.168.1.1/page'), false);
+});
+
+test('isAllowedTarget returns true for a URL whose literal host is a public IP', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('https://93.184.216.34/page'), true);
+});
+
+test('isAllowedTarget returns false for a syntactically invalid URL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  assert.equal(await isAllowedTarget('not-a-url'), false);
+});
+
+test('isAllowedTarget returns true for a private-address target when ALLOW_INTERNAL_TARGETS is true', async () => {
+  process.env.ALLOW_INTERNAL_TARGETS = 'true';
+  assert.equal(await isAllowedTarget('https://192.168.1.1/page'), true);
+});
+
+test('isAllowedReport returns true when every act has a public actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [
+      {type: 'test', actualURL: 'https://example.com/page'},
+      {type: 'test', actualURL: 'https://example.com/page2'}
+    ]
+  };
+  assert.equal(await isAllowedReport(report, fakeLookup('93.184.216.34')), true);
+});
+
+test('isAllowedReport returns false when any act has a disallowed actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [
+      {type: 'test', actualURL: 'https://example.com/page'},
+      {type: 'test', actualURL: 'https://internal.example.net/page'}
+    ]
+  };
+  let callCount = 0;
+  const lookup = async (hostname: string) => {
+    callCount++;
+    return hostname === 'internal.example.net'
+      ? [{address: '10.0.0.5', family: 4}]
+      : [{address: '93.184.216.34', family: 4}];
+  };
+  assert.equal(await isAllowedReport(report, lookup), false);
+  assert.ok(callCount > 0);
+});
+
+test('isAllowedReport falls back to the report target URL when an act has no actualURL', async () => {
+  delete process.env.ALLOW_INTERNAL_TARGETS;
+  const report = {
+    target: {what: 'Example', url: 'https://example.com/page'},
+    acts: [{type: 'test'}]
+  };
+  assert.equal(await isAllowedReport(report, fakeLookup('93.184.216.34')), true);
+});
+
 test('isValidAuthCode returns true when the code matches AUTH_CODE', () => {
   const saved = process.env.AUTH_CODE;
   process.env.AUTH_CODE = 'secret-code';