chore: import upstream snapshot with attribution

apps/sim/app/api/tools/onepassword/utils.test.ts

@@ -0,0 +1,108 @@
+/**
+ * @vitest-environment node
+ */
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockDnsLookup, hostedFlag } = vi.hoisted(() => ({
+  mockDnsLookup: vi.fn(),
+  hostedFlag: { value: false },
+}))
+
+vi.mock('@/lib/core/config/env-flags', () => ({
+  get isHosted() {
+    return hostedFlag.value
+  },
+}))
+
+vi.mock('dns/promises', () => ({
+  default: { lookup: mockDnsLookup },
+}))
+
+import { validateConnectServerUrl } from '@/app/api/tools/onepassword/utils'
+
+describe('validateConnectServerUrl', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    hostedFlag.value = false
+  })
+
+  it('rejects a non-URL string', async () => {
+    await expect(validateConnectServerUrl('not a url')).rejects.toThrow('is not a valid URL')
+  })
+
+  describe('hosted deployment', () => {
+    beforeEach(() => {
+      hostedFlag.value = true
+    })
+
+    it.each([
+      ['loopback', 'http://127.0.0.1:8080'],
+      ['RFC1918 10.x', 'http://10.0.0.5'],
+      ['RFC1918 192.168.x', 'http://192.168.1.1:8443'],
+      ['RFC1918 172.16.x', 'http://172.16.0.9'],
+      ['link-local metadata', 'http://169.254.169.254'],
+      ['IPv4-mapped IPv6 private', 'http://[::ffff:10.0.0.1]'],
+      ['IPv6 loopback', 'http://[::1]'],
+    ])('blocks %s', async (_label, url) => {
+      await expect(validateConnectServerUrl(url)).rejects.toThrow(
+        'cannot point to a private or reserved IP address'
+      )
+    })
+
+    it('allows a public IP literal', async () => {
+      await expect(validateConnectServerUrl('https://8.8.8.8')).resolves.toBe('8.8.8.8')
+    })
+
+    it('blocks a hostname that resolves to a private IP', async () => {
+      mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 })
+      await expect(validateConnectServerUrl('https://connect.internal')).rejects.toThrow(
+        'cannot point to a private or reserved IP address'
+      )
+    })
+
+    it('allows a hostname that resolves to a public IP', async () => {
+      mockDnsLookup.mockResolvedValue({ address: '93.184.216.34', family: 4 })
+      await expect(validateConnectServerUrl('https://connect.example.com')).resolves.toBe(
+        '93.184.216.34'
+      )
+    })
+  })
+
+  describe('self-hosted deployment', () => {
+    beforeEach(() => {
+      hostedFlag.value = false
+    })
+
+    it.each([
+      ['loopback', 'http://127.0.0.1:8080', '127.0.0.1'],
+      ['RFC1918 10.x', 'http://10.0.0.5', '10.0.0.5'],
+      ['RFC1918 192.168.x', 'http://192.168.1.1:8443', '192.168.1.1'],
+    ])('allows %s (private Connect server)', async (_label, url, expected) => {
+      await expect(validateConnectServerUrl(url)).resolves.toBe(expected)
+    })
+
+    it('still blocks link-local metadata', async () => {
+      await expect(validateConnectServerUrl('http://169.254.169.254')).rejects.toThrow(
+        'cannot point to a link-local address'
+      )
+    })
+
+    it('still blocks IPv6 link-local', async () => {
+      await expect(validateConnectServerUrl('http://[fe80::1]')).rejects.toThrow(
+        'cannot point to a link-local address'
+      )
+    })
+
+    it('allows a hostname that resolves to a private IP', async () => {
+      mockDnsLookup.mockResolvedValue({ address: '10.1.2.3', family: 4 })
+      await expect(validateConnectServerUrl('https://connect.internal')).resolves.toBe('10.1.2.3')
+    })
+  })
+
+  it('rejects when DNS resolution fails', async () => {
+    mockDnsLookup.mockRejectedValue(new Error('ENOTFOUND'))
+    await expect(validateConnectServerUrl('https://nope.invalid')).rejects.toThrow(
+      'could not be resolved'
+    )
+  })
+})