From 172914e5ee7280980f5728a04ed4bf265207e169 Mon Sep 17 00:00:00 2001 From: Viktor Liu Date: Sun, 26 Jul 2026 07:28:59 +0200 Subject: [PATCH] Preserve allow_match in restriction conversions when it is the only field set --- .../modules/reverseproxy/service/service.go | 4 ++-- .../modules/reverseproxy/service/service_test.go | 15 +++++++++++++++ 2 files changed, 17 insertions(+), 2 deletions(-) diff --git a/management/internals/modules/reverseproxy/service/service.go b/management/internals/modules/reverseproxy/service/service.go index 1504845b1..bc54aa240 100644 --- a/management/internals/modules/reverseproxy/service/service.go +++ b/management/internals/modules/reverseproxy/service/service.go @@ -825,7 +825,7 @@ func restrictionsFromAPI(r *api.AccessRestrictions) (AccessRestrictions, error) func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions { if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 && len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 && - r.CrowdSecMode == "" { + r.CrowdSecMode == "" && r.AllowMatch == "" { return nil } res := &api.AccessRestrictions{} @@ -855,7 +855,7 @@ func restrictionsToAPI(r AccessRestrictions) *api.AccessRestrictions { func restrictionsToProto(r AccessRestrictions) *proto.AccessRestrictions { if len(r.AllowedCIDRs) == 0 && len(r.BlockedCIDRs) == 0 && len(r.AllowedCountries) == 0 && len(r.BlockedCountries) == 0 && - r.CrowdSecMode == "" { + r.CrowdSecMode == "" && r.AllowMatch == "" { return nil } return &proto.AccessRestrictions{ diff --git a/management/internals/modules/reverseproxy/service/service_test.go b/management/internals/modules/reverseproxy/service/service_test.go index 4756c1106..5151956a6 100644 --- a/management/internals/modules/reverseproxy/service/service_test.go +++ b/management/internals/modules/reverseproxy/service/service_test.go @@ -1337,6 +1337,21 @@ func TestRestrictions_AllowMatch_EmptyDefaultsToAll(t *testing.T) { assert.Nil(t, apiOut.AllowMatch, "empty allow_match is omitted from the API response") } +func TestRestrictions_AllowMatchOnly_Preserved(t *testing.T) { + // allow_match set without any list must not be dropped by the emptiness + // guards, so it round-trips through both the API and proto conversions. + model := AccessRestrictions{AllowMatch: "any"} + + apiOut := restrictionsToAPI(model) + require.NotNil(t, apiOut, "allow-match-only restriction must not be omitted from the API response") + require.NotNil(t, apiOut.AllowMatch) + assert.Equal(t, api.AccessRestrictionsAllowMatchAny, *apiOut.AllowMatch) + + protoOut := restrictionsToProto(model) + require.NotNil(t, protoOut, "allow-match-only restriction must not be omitted from the proto output") + assert.Equal(t, "any", protoOut.AllowMatch) +} + func TestValidate_RejectsInvalidAllowMatch(t *testing.T) { rp := validProxy() rp.Restrictions = AccessRestrictions{