Initial curated CertScope source from fe2bbe3ca5c98bf64be26a09c6c58ee805a7f87e

lib/inspect/policy.test.ts

@@ -0,0 +1,18 @@
+import { describe, expect, it } from "vitest";
+import { assertPublicAddress, normalizeHost, validateResolvedAddresses } from "./policy";
+
+describe("hostname policy",()=>{
+  it("normalizes public hostnames",()=>expect(normalizeHost("Example.COM.")).toBe("example.com"));
+  it("normalizes IDN input to its ASCII form",()=>expect(normalizeHost("münich.example")).toBe("xn--mnich-kva.example"));
+  it("rejects oversized input before IDN conversion",()=>expect(()=>normalizeHost("a".repeat(254)+".example")).toThrow());
+  it.each(["https://example.com","localhost","127.0.0.1","::1"])("rejects non-hostname input %s",(value)=>expect(()=>normalizeHost(value)).toThrow());
+});
+
+describe("address policy",()=>{
+  it.each(["127.0.0.1","10.0.0.1","192.168.1.5","169.254.1.1","100.64.0.1","224.0.0.1","::1","fc00::1","fe80::1","::ffff:127.0.0.1"])("rejects non-public address %s",(value)=>expect(()=>assertPublicAddress(value)).toThrow());
+  it.each(["1.1.1.1","8.8.8.8","2606:4700:4700::1111"])("accepts public unicast address %s",(value)=>expect(()=>assertPublicAddress(value)).not.toThrow());
+  it("validates every resolved address before returning any candidate", () => {
+    expect(() => validateResolvedAddresses(["1.1.1.1", "192.168.1.10"])).toThrow(/non-public address space/);
+    expect(validateResolvedAddresses(["1.1.1.1", "1.1.1.1"])).toEqual(["1.1.1.1"]);
+  });
+});