proxy-addr 2.0.7: compile

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify proxy-addr.compile in pkg:npm/proxy-addr@2.0.7
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/proxy-addr@2.0.7
Demonstrate these symbols/APIs:
  - proxy-addr.compile

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:83db85cac5cd31fea0d584d088464a442e229af5265c74a04076b3741bc24075","contract":["assert compile throws TypeError when argument is missing or falsy","assert compile throws TypeError when argument is not a string or array","assert compile throws TypeError when argument contains invalid IP address or out-of-range CIDR mask","assert compile with empty array returns trust function that evaluates all addresses to false","assert compile with single IP or CIDR returns trust function matching exact address and subnet range","assert compile with built-in range names expands loopback linklocal and uniquelocal subnets","assert compile with netmask notation parses subnet mask into valid CIDR trust evaluator","assert compiled trust function correctly handles IPv4-mapped IPv6 address comparisons and invalid IP queries","assert compile with array of mixed CIDR subnets and built-in names evaluates multi-subnet trust correctly"],"goal":"verify proxy-addr.compile in pkg:npm/proxy-addr@2.0.7","kind":"HOW","packages":["pkg:npm/proxy-addr@2.0.7"],"schemaVersion":1,"symbols":["proxy-addr.compile"]},"contractCommand":["node","test/contract.js"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","executionContext":"node","language":"javascript","libc":"glibc","libcVersion":"2.39","moduleSystem":"cjs","os":"linux","osVersionBucket":"24","packageManager":"npm","packageManagerVersion":"10.9.8","runtime":"node","runtimeVersion":"22.23.2","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/proxy-addr@2.0.7"],"schemaVersion":1,"subject":"pkg:npm/proxy-addr@2.0.7","symbols":["proxy-addr.compile"],"verifierAdapter":"node-typescript@1"}

{
  "name": "csx-sample-proxy-addr",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "csx-sample-proxy-addr",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "proxy-addr": "2.0.7"
      }
    },
    "node_modules/forwarded": {
      "version": "0.2.0",
      "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
      "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.6"
      }
    },
    "node_modules/ipaddr.js": {
      "version": "1.9.1",
      "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
      "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
      "license": "MIT",
      "engines": {
        "node": ">= 0.10"
      }
    },
    "node_modules/proxy-addr": {
      "version": "2.0.7",
      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
      "license": "MIT",
      "dependencies": {
        "forwarded": "0.2.0",
        "ipaddr.js": "1.9.1"
      },
      "engines": {
        "node": ">= 0.10"
      }
    }
  }
}

{
  "name": "csx-sample-proxy-addr",
  "version": "1.0.0",
  "private": true,
  "description": "Clean-room verification for proxy-addr.compile",
  "main": "test/contract.js",
  "scripts": {
    "test": "node test/contract.js"
  },
  "dependencies": {
    "proxy-addr": "2.0.7"
  },
  "license": "MIT-0"
}

{
  "schemaVersion": 1,
  "goal": "verify proxy-addr.compile in pkg:npm/proxy-addr@2.0.7",
  "kind": "HOW",
  "packages": [
    "pkg:npm/proxy-addr@2.0.7"
  ],
  "symbols": [
    "proxy-addr.compile"
  ]
}

const assert = require('assert');
const proxyaddr = require('proxy-addr');

async function runTests() {
  const compile = proxyaddr.compile;

  // Test 1: compile throws TypeError when argument is missing or falsy
  assert.throws(() => {
    compile();
  }, {
    name: 'TypeError',
    message: 'argument is required'
  }, 'compile() with undefined must throw argument is required');

  assert.throws(() => {
    compile(null);
  }, {
    name: 'TypeError',
    message: 'argument is required'
  }, 'compile(null) must throw argument is required');

  assert.throws(() => {
    compile('');
  }, {
    name: 'TypeError',
    message: 'argument is required'
  }, 'compile("") must throw argument is required');

  // Test 2: compile throws TypeError when argument is not a string or array
  assert.throws(() => {
    compile(123);
  }, {
    name: 'TypeError',
    message: 'unsupported trust argument'
  }, 'compile(number) must throw unsupported trust argument');

  assert.throws(() => {
    compile({});
  }, {
    name: 'TypeError',
    message: 'unsupported trust argument'
  }, 'compile(object) must throw unsupported trust argument');

  assert.throws(() => {
    compile(true);
  }, {
    name: 'TypeError',
    message: 'unsupported trust argument'
  }, 'compile(boolean) must throw unsupported trust argument');

  // Test 3: compile throws TypeError when argument contains invalid IP address or out-of-range CIDR mask
  assert.throws(() => {
    compile('invalid-ip-string');
  }, {
    name: 'TypeError',
    message: 'invalid IP address: invalid-ip-string'
  }, 'compile with invalid IP must throw invalid IP address');

  assert.throws(() => {
    compile('127.0.0.1/33');
  }, {
    name: 'TypeError',
    message: 'invalid range on address: 127.0.0.1/33'
  }, 'compile with IPv4 range > 32 must throw invalid range');

  assert.throws(() => {
    compile('127.0.0.1/0');
  }, {
    name: 'TypeError',
    message: 'invalid range on address: 127.0.0.1/0'
  }, 'compile with range 0 must throw invalid range');

  assert.throws(() => {
    compile('::1/129');
  }, {
    name: 'TypeError',
    message: 'invalid range on address: ::1/129'
  }, 'compile with IPv6 range > 128 must throw invalid range');

  // Test 4: compile with empty array returns trust function that evaluates all addresses to false
  const trustNone = compile([]);
  assert.strictEqual(typeof trustNone, 'function');
  assert.strictEqual(trustNone('127.0.0.1'), false);
  assert.strictEqual(trustNone('10.0.0.1'), false);
  assert.strictEqual(trustNone('::1'), false);

  // Test 5: compile with single IP or CIDR returns trust function matching exact address and subnet range
  const trustSingleIp = compile('192.168.1.50');
  assert.strictEqual(trustSingleIp('192.168.1.50'), true);
  assert.strictEqual(trustSingleIp('192.168.1.51'), false);

  const trustCidr = compile('10.0.0.0/16');
  assert.strictEqual(trustCidr('10.0.0.1'), true);
  assert.strictEqual(trustCidr('10.0.254.254'), true);
  assert.strictEqual(trustCidr('10.1.0.1'), false);

  const trustIpv6 = compile('2001:db8::/32');
  assert.strictEqual(trustIpv6('2001:db8::1'), true);
  assert.strictEqual(trustIpv6('2001:db8:ffff::1'), true);
  assert.strictEqual(trustIpv6('2001:db9::1'), false);

  // Test 6: compile with built-in range names expands loopback linklocal and uniquelocal subnets
  const trustLoopback = compile('loopback');
  assert.strictEqual(trustLoopback('127.0.0.1'), true);
  assert.strictEqual(trustLoopback('127.0.10.5'), true);
  assert.strictEqual(trustLoopback('::1'), true);
  assert.strictEqual(trustLoopback('10.0.0.1'), false);

  const trustLinkLocal = compile('linklocal');
  assert.strictEqual(trustLinkLocal('169.254.1.1'), true);
  assert.strictEqual(trustLinkLocal('fe80::1'), true);
  assert.strictEqual(trustLinkLocal('127.0.0.1'), false);

  const trustUniqueLocal = compile('uniquelocal');
  assert.strictEqual(trustUniqueLocal('10.0.0.1'), true);
  assert.strictEqual(trustUniqueLocal('172.16.5.2'), true);
  assert.strictEqual(trustUniqueLocal('192.168.1.1'), true);
  assert.strictEqual(trustUniqueLocal('fc00::1'), true);
  assert.strictEqual(trustUniqueLocal('fd12::1'), true);
  assert.strictEqual(trustUniqueLocal('8.8.8.8'), false);

  // Test 7: compile with netmask notation parses subnet mask into valid CIDR trust evaluator
  const trustNetmask = compile('192.168.0.0/255.255.0.0');
  assert.strictEqual(trustNetmask('192.168.10.20'), true);
  assert.strictEqual(trustNetmask('192.169.10.20'), false);

  // Test 8: compiled trust function correctly handles IPv4-mapped IPv6 address comparisons and invalid IP queries
  const trustIpv4Mapped = compile('127.0.0.1/8');
  assert.strictEqual(trustIpv4Mapped('::ffff:127.0.0.1'), true);
  assert.strictEqual(trustIpv4Mapped('::ffff:192.168.1.1'), false);

  const trustIpv6MappedSubnet = compile('::ffff:127.0.0.1');
  assert.strictEqual(trustIpv6MappedSubnet('127.0.0.1'), true);
  assert.strictEqual(trustIpv6MappedSubnet('::ffff:127.0.0.1'), true);

  // Non-IP addresses or malformed strings return false safely without throwing
  assert.strictEqual(trustLoopback('not-an-ip'), false);
  assert.strictEqual(trustLoopback(''), false);
  assert.strictEqual(trustLoopback(null), false);
  assert.strictEqual(trustLoopback(undefined), false);

  // Test 9: compile with array of mixed CIDR subnets and built-in names evaluates multi-subnet trust correctly
  const trustMulti = compile(['loopback', '10.0.0.0/8', '2001:db8::/32']);
  assert.strictEqual(trustMulti('127.0.0.1'), true);
  assert.strictEqual(trustMulti('::1'), true);
  assert.strictEqual(trustMulti('10.250.1.1'), true);
  assert.strictEqual(trustMulti('2001:db8::abcd'), true);
  assert.strictEqual(trustMulti('192.168.1.1'), false);
  assert.strictEqual(trustMulti('2001:db9::1'), false);

  console.log('All proxy-addr.compile contract assertions passed successfully.');
}

runTests().catch((err) => {
  console.error('Contract test failed:', err);
  process.exit(1);
});