refactor: rework the way trusted proxies ip work

[steveiliop56]

Summary by CodeRabbit

• Bug Fixes

  • Improved IP-based access control behavior when trusted proxies are not configured.
  • Prevented IP bypass rules from incorrectly allowing requests without trusted proxy configuration.
  • Added clearer warnings when IP access controls cannot operate due to missing trusted proxies.

• Tests

  • Added coverage for access-control behavior with and without trusted proxy configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b27df9fa-8ed7-4cd4-9e64-3b7f36012718

📥 Commits

Reviewing files that changed from the base of the PR and between 2a0d7bd and f24ebf8.

📒 Files selected for processing (7)

• internal/bootstrap/router_bootstrap.go
• internal/controller/proxy_controller.go
• internal/model/runtime.go
• internal/service/access_controls_rules.go
• internal/service/access_controls_rules_test.go
• internal/service/policy_engine.go
• internal/test/test.go

---

📝 Walkthrough

Walkthrough

The router now records whether trusted proxies are configured, passes that state through ACL evaluation context, and changes IP allow/bypass rule outcomes when proxy configuration is absent. Tests cover both configured and unconfigured states.

Changes

Trusted proxy ACL behavior

Layer / File(s)	Summary
Initialize trusted-proxy state internal/model/runtime.go, internal/bootstrap/router_bootstrap.go	RuntimeConfig stores TrustedProxiesConfigured; router setup sets it for configured proxies, explicitly clears trusted proxies otherwise, and handles errors.
Propagate trusted-proxy state internal/service/policy_engine.go, internal/controller/proxy_controller.go, internal/test/test.go	ACLContext and proxy requests carry the runtime trusted-proxy state, with test configurations enabling it.
Enforce IP rule behavior internal/service/access_controls_rules.go, internal/service/access_controls_rules_test.go	IP allow rules return allow and IP bypass rules return deny when trusted proxies are unavailable; configured and unconfigured cases are tested.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant RouterBootstrap
  participant proxyHandler
  participant policyEngine
  participant IPAccessRules
  RouterBootstrap->>proxyHandler: Store TrustedProxiesConfigured
  proxyHandler->>policyEngine: Evaluate ACLContext with trusted-proxy state
  policyEngine->>IPAccessRules: Evaluate IP allow or bypass rule
  IPAccessRules-->>policyEngine: Return allow or deny effect

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clearly related to the PR’s main change: reworking trusted-proxy IP handling and related access-control logic.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch refactor/trusted-proxy-ips

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 44.44444% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/bootstrap/router_bootstrap.go	0.00%	6 Missing ⚠️
internal/test/test.go	0.00%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!