Function TestValidateStrictNetwork

pkg/workflow/strict_mode_validation_test.go:208–290

TestValidateStrictNetwork tests the validateStrictNetwork function

(t *testing.T)

// TestValidateStrictNetwork tests the validateStrictNetwork function
func TestValidateStrictNetwork(t *testing.T) {
	tests := []struct {
		name               string
		networkPermissions *NetworkPermissions
		expectError        bool
		errorMsg           string
	}{
		{
			name:               "nil network permissions triggers internal error",
			networkPermissions: nil,
			expectError:        true,
			errorMsg:           "internal error: network permissions not initialized",
		},
		{
			name: "defaults mode is allowed",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{"defaults"},
			},
			expectError: false,
		},
		{
			name: "specific allowed domains are allowed",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{"api.example.com", "github.com"},
			},
			expectError: false,
		},
		{
			name: "wildcard in allowed domains is refused",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{"*"},
			},
			expectError: true,
			errorMsg:    "strict mode: wildcard '*' is not allowed in network.allowed domains to prevent unrestricted internet access",
		},
		{
			name: "wildcard among other domains is refused",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{"api.example.com", "*", "github.com"},
			},
			expectError: true,
			errorMsg:    "strict mode: wildcard '*' is not allowed in network.allowed domains to prevent unrestricted internet access",
		},
		{
			name: "empty allowed list is allowed",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{},
			},
			expectError: false,
		},
		{
			name: "domain patterns with wildcards are allowed (not exact *)",
			networkPermissions: &NetworkPermissions{
				Allowed: []string{"*.example.com", "api.*.com"},
			},
			expectError: false,
		},
		{