SVI/netbird
1
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-08-04 03:35:09 -04:00
Code Issues 3.0k Packages Projects Releases 10 Wiki Activity

Preserve allow_match in restriction conversions when it is the only field set

Browse Source
This commit is contained in:
Viktor Liu
2026-07-26 07:28:59 +02:00
parent 2243d1c3bb
commit 172914e5ee
2 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
management/internals/modules/reverseproxy/service/service.go
View File

@@ -825,7 +825,7 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error)
func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
r.CrowdSecMode == "" {
r.CrowdSecMode == "" && r.AllowMatch == "" {
return nil
}
res := &api.AccessRestrictions{}
@@ -855,7 +855,7 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions {
func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions {
if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 &&
len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 &&
r.CrowdSecMode == "" {
r.CrowdSecMode == "" && r.AllowMatch == "" {
return nil
}
return &proto.AccessRestrictions{

15
management/internals/modules/reverseproxy/service/service_test.go
View File

@@ -1337,6 +1337,21 @@ func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) {
assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response")
}
func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) {
// allow_match set without any list must not be dropped by the emptiness
// guards, so it round-trips through both the API and proto conversions.
model := AccessRestrictions{AllowMatch: "any"}
apiOut := restrictionsToAPI(model)
require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response")
require.NotNil(t, apiOut.AllowMatch)
assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch)
protoOut := restrictionsToProto(model)
require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output")
assert.Equal(t, "any", protoOut.AllowMatch)
}
func TestValidate_RejectsInvalidAllowMatch(t *testing.T) {
rp := validProxy()
rp.Restrictions = AccessRestrictions{