@oneuptime/common 12.0.7 → 12.0.9

package/Tests/Server/Utils/VM/VMAPISubstitution.test.ts

@@ -0,0 +1,243 @@
+/*
+ * Substitution behaviour of VMUtil.replaceValueInPlace, focused on the three
+ * ways a resolved value used to come out wrong: unescaped quotes when the
+ * caller passed an object, `$`-patterns in the replacement text, and
+ * `[last]` against a key that is not an array.
+ */
+
+jest.mock("../../../../Server/Utils/VM/VMRunner", () => {
+  return {
+    __esModule: true,
+    default: {
+      runCodeInSandbox: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      error: jest.fn(),
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+    },
+  };
+});
+
+jest.mock("../../../../Server/Utils/Telemetry/CaptureSpan", () => {
+  return {
+    __esModule: true,
+    default: () => {
+      return (
+        _target: any,
+        _propertyKey: string,
+        descriptor: PropertyDescriptor,
+      ) => {
+        return descriptor;
+      };
+    },
+  };
+});
+
+import VMUtil from "../../../../Server/Utils/VM/VMAPI";
+import { JSONObject, JSONValue } from "../../../../Types/JSON";
+import { describe, expect, it } from "@jest/globals";
+
+type MakeStorageFunction = (variables: JSONObject) => JSONObject;
+
+const makeStorage: MakeStorageFunction = (
+  variables: JSONObject,
+): JSONObject => {
+  return {
+    local: {
+      variables: variables,
+      components: {},
+    },
+    global: {
+      variables: {},
+    },
+  };
+};
+
+describe("replaceValueInPlace — object input (the key/value headers shape)", () => {
+  it("returns an object, not a string", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ token: "abc" }),
+      { Authorization: "Bearer {{local.variables.token}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect(typeof result).toBe("object");
+    expect(result).toEqual({ Authorization: "Bearer abc" });
+  });
+
+  /*
+   * The regression this guards: the object is stringified, so every
+   * placeholder sits inside a JSON string literal. A resolved value carrying a
+   * quote used to be spliced in raw, the JSON.parse on the way back out threw,
+   * and the caller silently received a corrupted string where it asked for an
+   * object — which then spread into per-character HTTP headers.
+   */
+  it("escapes a resolved value containing a double quote", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ note: 'he said "hi"' }),
+      { "X-Note": "{{local.variables.note}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect(typeof result).toBe("object");
+    expect(result).toEqual({ "X-Note": 'he said "hi"' });
+  });
+
+  it("escapes a resolved value containing a newline", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ note: "line1\nline2" }),
+      { "X-Note": "{{local.variables.note}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect(typeof result).toBe("object");
+    expect(result).toEqual({ "X-Note": "line1\nline2" });
+  });
+
+  it("escapes a resolved value containing a backslash", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ path: "C:\\Users" }),
+      { "X-Path": "{{local.variables.path}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect(typeof result).toBe("object");
+    expect((result as JSONObject)["X-Path"]).toBe("C:\\Users");
+  });
+
+  it("escapes a resolved value containing a regex", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ pattern: "\\d+\\s" }),
+      { "X-Pattern": "{{local.variables.pattern}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect((result as JSONObject)["X-Pattern"]).toBe("\\d+\\s");
+  });
+
+  it("escapes a value carrying a backslash and a quote together", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({ v: 'a\\b"c' }),
+      { "X-V": "{{local.variables.v}}" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect((result as JSONObject)["X-V"]).toBe('a\\b"c');
+  });
+
+  it("leaves an object with no placeholders untouched", () => {
+    const result: JSONValue = VMUtil.replaceValueInPlace(
+      makeStorage({}),
+      { A: "b" } as never,
+      false,
+    ) as unknown as JSONValue;
+
+    expect(result).toEqual({ A: "b" });
+  });
+});
+
+describe("replaceValueInPlace — $ in resolved values", () => {
+  /*
+   * String.replace treats $&, $', $` and $1 in the REPLACEMENT as substitution
+   * patterns. A resolved value of "A$&B" used to render as "A{{v}}B", pasting
+   * the matched placeholder back into the output.
+   */
+  it("does not treat $& in a value as a substitution pattern", () => {
+    const result: string = VMUtil.replaceValueInPlace(
+      makeStorage({ v: "A$&B" }),
+      "start {{local.variables.v}} end",
+      false,
+    );
+
+    expect(result).toBe("start A$&B end");
+  });
+
+  it("does not treat $` or $' as substitution patterns", () => {
+    expect(
+      VMUtil.replaceValueInPlace(
+        makeStorage({ v: "x$`y" }),
+        "a {{local.variables.v}} b",
+        false,
+      ),
+    ).toBe("a x$`y b");
+
+    expect(
+      VMUtil.replaceValueInPlace(
+        makeStorage({ v: "x$'y" }),
+        "a {{local.variables.v}} b",
+        false,
+      ),
+    ).toBe("a x$'y b");
+  });
+
+  it("keeps a plain dollar amount intact", () => {
+    expect(
+      VMUtil.replaceValueInPlace(
+        makeStorage({ price: "$50" }),
+        "Total: {{local.variables.price}} today",
+        false,
+      ),
+    ).toBe("Total: $50 today");
+  });
+});
+
+describe("deepFind — [last] accessor", () => {
+  type FindFunction = (storage: JSONObject, path: string) => JSONValue;
+
+  const find: FindFunction = (storage: JSONObject, path: string): JSONValue => {
+    return VMUtil.deepFind(storage, path);
+  };
+
+  it("resolves the final element of an array", () => {
+    expect(find({ items: ["a", "b", "c"] }, "items[last]")).toBe("c");
+  });
+
+  it("returns undefined rather than throwing when the key is missing", () => {
+    expect(find({}, "items[last]")).toBeUndefined();
+  });
+
+  it("returns undefined rather than throwing when the key is not an array", () => {
+    expect(find({ items: "not an array" }, "items[last]")).toBeUndefined();
+    expect(find({ items: 5 }, "items[last]")).toBeUndefined();
+    expect(find({ items: null }, "items[last]")).toBeUndefined();
+  });
+
+  it("returns undefined for an empty array", () => {
+    expect(find({ items: [] }, "items[last]")).toBeUndefined();
+  });
+
+  it("still resolves a numeric accessor", () => {
+    expect(find({ items: ["a", "b"] }, "items[0]")).toBe("a");
+    expect(find({ items: ["a", "b"] }, "items[9]")).toBeUndefined();
+  });
+});
+
+describe("replaceValueInPlace — unresolved references", () => {
+  it("leaves the braces in place, which is what the builder warns about", () => {
+    expect(
+      VMUtil.replaceValueInPlace(
+        makeStorage({}),
+        "hello {{local.variables.missing}}",
+        false,
+      ),
+    ).toBe("hello {{local.variables.missing}}");
+  });
+
+  it("does not resolve a reference padded with spaces", () => {
+    expect(
+      VMUtil.replaceValueInPlace(
+        makeStorage({ v: "x" }),
+        "a {{ local.variables.v }} b",
+        false,
+      ),
+    ).toBe("a {{ local.variables.v }} b");
+  });
+});

package/Tests/Types/IP/IP.test.ts

@@ -1,4 +1,5 @@
 import IP from "../../../Types/IP/IP";
+import { ObjectType } from "../../../Types/JSON";
 
 describe("IP()", () => {
   test("expect ip to be defined", () => {
@@ -79,3 +80,265 @@ describe("IP()", () => {
     expect(IP.getDatabaseTransformer().to("")).toBe(null);
   });
 });
+
+/*
+ * The validators are anchored, so a value only counts as an address when the
+ * WHOLE string is one. These cases pin that down: the IPv6 pattern used to be
+ * unanchored and reported anything merely containing an address-shaped
+ * substring as valid.
+ */
+describe("IP.isIP() anchoring", () => {
+  const VALID_IPV4: Array<string> = [
+    "0.0.0.0",
+    "127.0.0.1",
+    "10.0.0.4",
+    "196.223.149.8",
+    "203.0.113.7",
+    "255.255.255.255",
+  ];
+
+  const VALID_IPV6: Array<string> = [
+    "::",
+    "::1",
+    "fd00::1",
+    "fe80::1",
+    "2001:db8::1",
+    "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+    "2001:db8:0:0:0:0:0:1",
+    "a:b:c:d:e:f:1:2",
+    // Uppercase hex is valid.
+    "2001:DB8::1",
+    // Zone identifier, as reported for link-local addresses.
+    "fe80::1%eth0",
+    // IPv4-mapped, the form Node reports for a dual-stack socket.
+    "::ffff:127.0.0.1",
+    "::ffff:203.0.113.7",
+    "::11.22.33.44",
+    "2001:db8::192.168.0.1",
+  ];
+
+  test.each(VALID_IPV4)("accepts the IPv4 address %s", (value: string) => {
+    expect(IP.isIP(value)).toBe(true);
+    expect(new IP(value).isIPv4()).toBe(true);
+    expect(new IP(value).isIPv6()).toBe(false);
+  });
+
+  test.each(VALID_IPV6)("accepts the IPv6 address %s", (value: string) => {
+    expect(IP.isIP(value)).toBe(true);
+    expect(new IP(value).isIPv6()).toBe(true);
+    expect(new IP(value).isIPv4()).toBe(false);
+  });
+
+  /*
+   * Every one of these was accepted before the pattern was anchored. They are
+   * the whole point of the change, so they are listed out rather than folded
+   * into the generic invalid list below.
+   */
+  const ADDRESS_SHAPED_SUBSTRINGS: Array<string> = [
+    "evil 2001:db8::1 evil",
+    "not-an-ip-::1",
+    "x2001:db8::1",
+    "2001:db8::1x",
+    "<script>::1</script>",
+    // Leading/trailing whitespace is not part of an address.
+    "  ::1  ",
+    "::1 ",
+    " ::1",
+    // A whole forwarded-for chain is a list, not an address.
+    "::1, 1.2.3.4",
+    "2001:db8::1, 198.51.100.5",
+    // A newline is the classic way to smuggle a second value past a check.
+    "2001:db8::1\n1.2.3.4",
+    // Bracketed host:port, which is what a proxy emits for IPv6.
+    "[2001:db8::1]:443",
+    "[2001:db8::1]",
+    // Triple colon is not valid IPv6 -- only one "::" run is allowed.
+    "2001:0db8:85a3:::8a2e:0370:7334",
+    // A CIDR entry is a range, not a single address.
+    "2001:db8::/32",
+    // Out-of-range hex group.
+    "gggg::1",
+    "2001:db8::1::2",
+  ];
+
+  test.each(ADDRESS_SHAPED_SUBSTRINGS)(
+    "rejects %j, which only contains something address-shaped",
+    (value: string) => {
+      expect(IP.isIP(value)).toBe(false);
+    },
+  );
+
+  const NOT_ADDRESSES: Array<string> = [
+    "",
+    " ",
+    "hello",
+    "Invalid IP",
+    "unknown",
+    "localhost",
+    "example.com",
+    "1.2.3.4.5",
+    "1.2.3",
+    "256.1.1.1",
+    "10.0.0.0/8",
+    "203.0.113.7:51234",
+    "-1.0.0.0",
+    "01.02.03.04.05",
+  ];
+
+  test.each(NOT_ADDRESSES)("rejects %j", (value: string) => {
+    expect(IP.isIP(value)).toBe(false);
+  });
+
+  test.each([...ADDRESS_SHAPED_SUBSTRINGS, ...NOT_ADDRESSES])(
+    "constructing an IP from %j throws",
+    (value: string) => {
+      expect(() => {
+        return new IP(value);
+      }).toThrow("IP is not a valid address");
+    },
+  );
+
+  /*
+   * The validators no longer carry the `g` flag. `.test()` on a `g` regex
+   * advances lastIndex between calls, so the same input could otherwise
+   * answer differently depending on how many times it had been asked.
+   */
+  test("answers the same for repeated calls with the same input", () => {
+    for (let i: number = 0; i < 5; i++) {
+      expect(IP.isIP("2001:db8::1")).toBe(true);
+      expect(IP.isIP("127.0.0.1")).toBe(true);
+      expect(IP.isIP("evil 2001:db8::1 evil")).toBe(false);
+    }
+  });
+
+  test("answers the same when interleaving valid and invalid input", () => {
+    const inputs: Array<[string, boolean]> = [
+      ["2001:db8::1", true],
+      ["[2001:db8::1]:443", false],
+      ["2001:db8::1", true],
+      ["::1, 1.2.3.4", false],
+      ["::1", true],
+    ];
+
+    for (const [value, expected] of inputs) {
+      expect(IP.isIP(value)).toBe(expected);
+    }
+  });
+});
+
+describe("IP deserialization rejects invalid addresses", () => {
+  test("fromDatabase throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.fromDatabase("[2001:db8::1]:443");
+    }).toThrow("IP is not a valid address");
+  });
+
+  test("fromJSON throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.fromJSON({ _type: ObjectType.IP, value: "evil ::1 evil" });
+    }).toThrow("IP is not a valid address");
+  });
+
+  test("fromJSON round-trips a valid address", () => {
+    const ip: IP = new IP("2001:db8::1");
+    expect(IP.fromJSON(ip.toJSON()).toString()).toBe("2001:db8::1");
+  });
+
+  test("the database transformer throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.getDatabaseTransformer().from("evil 2001:db8::1 evil");
+    }).toThrow("IP is not a valid address");
+  });
+});
+
+describe("IP.isInWhitelist()", () => {
+  test("matches an exact IPv4 entry", () => {
+    expect(
+      IP.isInWhitelist({ ip: "203.0.113.7", whitelist: ["203.0.113.7"] }),
+    ).toBe(true);
+  });
+
+  test("matches an exact IPv6 entry", () => {
+    expect(
+      IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["2001:db8::1"] }),
+    ).toBe(true);
+  });
+
+  test("does not match a different address", () => {
+    expect(
+      IP.isInWhitelist({ ip: "198.51.100.5", whitelist: ["203.0.113.7"] }),
+    ).toBe(false);
+  });
+
+  test("matches an IPv4 CIDR range", () => {
+    expect(
+      IP.isInWhitelist({ ip: "10.1.2.3", whitelist: ["10.0.0.0/8"] }),
+    ).toBe(true);
+  });
+
+  test("does not match an address outside the CIDR range", () => {
+    expect(
+      IP.isInWhitelist({ ip: "11.1.2.3", whitelist: ["10.0.0.0/8"] }),
+    ).toBe(false);
+  });
+
+  test("returns false for an empty whitelist", () => {
+    expect(IP.isInWhitelist({ ip: "203.0.113.7", whitelist: [] })).toBe(false);
+  });
+
+  test("skips blank whitelist entries", () => {
+    expect(
+      IP.isInWhitelist({
+        ip: "203.0.113.7",
+        whitelist: ["", "   ", "203.0.113.7"],
+      }),
+    ).toBe(true);
+  });
+
+  /*
+   * The caller is expected to hand this one address it has already resolved.
+   * A value that merely contains an address is not one, and asking about it
+   * is a caller bug -- it throws rather than quietly answering false, which
+   * an access check would then read as a clean deny.
+   */
+  test("throws for an address-shaped substring", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "evil 2001:db8::1 evil",
+        whitelist: ["2001:db8::1"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  test("throws for a bracketed host:port", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "[2001:db8::1]:443",
+        whitelist: ["2001:db8::1"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  test("throws for a whole forwarded-for chain passed as one value", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: "203.0.113.7, 198.51.100.5",
+        whitelist: ["203.0.113.7"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+
+  /*
+   * A bracketed or padded spelling of an allowlisted address never matched an
+   * entry anyway -- it just used to reach the comparison instead of being
+   * rejected. Either way it is not granted access.
+   */
+  test("does not grant access to a padded spelling of a listed address", () => {
+    expect(() => {
+      return IP.isInWhitelist({
+        ip: " 203.0.113.7 ",
+        whitelist: ["203.0.113.7"],
+      });
+    }).toThrow("Invalid IP address");
+  });
+});

package/Tests/Types/IP/IPWhitelist.test.ts

@@ -0,0 +1,197 @@
+import BadDataException from "../../../Types/Exception/BadDataException";
+import IP from "../../../Types/IP/IP";
+import { describe, expect, it } from "@jest/globals";
+
+describe("IP.isInWhitelist", () => {
+  describe("single-address contract", () => {
+    /*
+     * This used to take an array and return true if ANY member matched.
+     * Callers fed it a whole X-Forwarded-For chain, and because a caller
+     * writes the left-hand end of that header themselves, "any member
+     * matches" meant "the caller names the address". Taking one address is
+     * what makes the check mean anything.
+     */
+    it("checks exactly the address it is given", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "198.51.100.5",
+          whitelist: ["203.0.113.7"],
+        }),
+      ).toBe(false);
+
+      expect(
+        IP.isInWhitelist({
+          ip: "203.0.113.7",
+          whitelist: ["203.0.113.7"],
+        }),
+      ).toBe(true);
+    });
+
+    it("cannot be handed a chain", () => {
+      /*
+       * A chain is not an address, so the old bypass input is now rejected
+       * outright rather than quietly matching on its first entry.
+       */
+      expect(() => {
+        return IP.isInWhitelist({
+          ip: "203.0.113.7, 198.51.100.5",
+          whitelist: ["203.0.113.7"],
+        });
+      }).toThrow(BadDataException);
+    });
+  });
+
+  describe("exact matches", () => {
+    it("matches an IPv4 entry", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1"] }),
+      ).toBe(true);
+    });
+
+    it("matches an IPv6 entry", () => {
+      expect(
+        IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["2001:db8::1"] }),
+      ).toBe(true);
+    });
+
+    it("does not match a different address", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.2", whitelist: ["10.0.0.1"] }),
+      ).toBe(false);
+    });
+
+    it("finds the entry wherever it sits in the list", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "10.0.0.3",
+          whitelist: ["10.0.0.1", "10.0.0.2", "10.0.0.3", "10.0.0.4"],
+        }),
+      ).toBe(true);
+    });
+
+    it("tolerates surrounding whitespace on an entry", () => {
+      /*
+       * Entries come from splitting a textarea on newlines, so a trailing
+       * \r or a stray space is routine.
+       */
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["  10.0.0.1  "] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1\r"] }),
+      ).toBe(true);
+    });
+  });
+
+  describe("CIDR ranges", () => {
+    it("matches an address inside the range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.4.5.6", whitelist: ["10.0.0.0/8"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.1.55", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(true);
+    });
+
+    it("does not match an address outside the range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "11.4.5.6", whitelist: ["10.0.0.0/8"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.2.55", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(false);
+    });
+
+    it("handles the boundaries of a range", () => {
+      expect(
+        IP.isInWhitelist({ ip: "192.168.1.0", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({
+          ip: "192.168.1.255",
+          whitelist: ["192.168.1.0/24"],
+        }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({
+          ip: "192.168.0.255",
+          whitelist: ["192.168.1.0/24"],
+        }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "192.168.2.0", whitelist: ["192.168.1.0/24"] }),
+      ).toBe(false);
+    });
+
+    it("treats /32 as an exact match", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.1/32"] }),
+      ).toBe(true);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.2", whitelist: ["10.0.0.1/32"] }),
+      ).toBe(false);
+    });
+
+    it("never matches an IPv6 address against an IPv4 CIDR", () => {
+      expect(
+        IP.isInWhitelist({ ip: "2001:db8::1", whitelist: ["0.0.0.0/1"] }),
+      ).toBe(false);
+    });
+
+    it("skips malformed CIDR entries instead of matching on them", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/33"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["10.0.0.0/abc"] }),
+      ).toBe(false);
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["not-an-ip/8"] }),
+      ).toBe(false);
+    });
+
+    it("keeps checking later entries after a malformed one", () => {
+      expect(
+        IP.isInWhitelist({
+          ip: "10.0.0.1",
+          whitelist: ["10.0.0.0/99", "", "10.0.0.1"],
+        }),
+      ).toBe(true);
+    });
+  });
+
+  describe("empty and invalid input", () => {
+    it("denies when the allowlist is empty", () => {
+      expect(IP.isInWhitelist({ ip: "10.0.0.1", whitelist: [] })).toBe(false);
+    });
+
+    it("denies when the allowlist holds only blank entries", () => {
+      expect(
+        IP.isInWhitelist({ ip: "10.0.0.1", whitelist: ["", "   ", "\n"] }),
+      ).toBe(false);
+    });
+
+    it("throws rather than guessing when the address is not an address", () => {
+      /*
+       * Callers making an access decision treat a throw as a denial; the
+       * services wrap this in a fail-closed catch.
+       */
+      for (const notAnIp of ["unknown", "", "10.0.0", "10.0.0.256", "abc"]) {
+        expect(() => {
+          return IP.isInWhitelist({ ip: notAnIp, whitelist: ["10.0.0.1"] });
+        }).toThrow(BadDataException);
+      }
+    });
+
+    it("checks the empty allowlist before validating the address", () => {
+      /*
+       * No allowlist means no restriction to evaluate, so an unparseable
+       * address is not an error worth raising.
+       */
+      expect(IP.isInWhitelist({ ip: "unknown", whitelist: [] })).toBe(false);
+    });
+  });
+});