fix(ssl): align resolvedIp to the full string comparison set

danielpaulus · claude · danielpaulus · commit 7bc71a7bb9f8 · 2026-07-14T22:59:46.000+02:00
resolvedIp allowed EQUALS/NOT_EQUALS/CONTAINS but not NOT_CONTAINS, diverging from the webapp/backend string value type. Use the shared STRING set for parity. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013AYwkvoaANQTH5dGStbBj2
diff --git a/packages/cli/src/constructs/ssl-assertion-validation.ts b/packages/cli/src/constructs/ssl-assertion-validation.ts
@@ -56,7 +56,7 @@ const connectionProperties: Record<string, PropertyRule> = {
   chainTrusted: { comparisons: BOOLEAN, booleanTarget: true },
   ocspStapled: { comparisons: BOOLEAN, booleanTarget: true },
   ocspStatus: { comparisons: ENUM },
-  resolvedIp: { comparisons: { EQUALS: true, NOT_EQUALS: true, CONTAINS: true } },
+  resolvedIp: { comparisons: STRING },
 }
 
 // Keyed by the source union so adding a source without a rule fails to compile.

Original file line number	Diff line number	Diff line change
`@@ -56,7 +56,7 @@ const connectionProperties: Record<string, PropertyRule> = {`
`56`	`56`	`chainTrusted: { comparisons: BOOLEAN, booleanTarget: true },`
`57`	`57`	`ocspStapled: { comparisons: BOOLEAN, booleanTarget: true },`
`58`	`58`	`ocspStatus: { comparisons: ENUM },`
`59`		`- resolvedIp: { comparisons: { EQUALS: true, NOT_EQUALS: true, CONTAINS: true } },`
	`59`	`+ resolvedIp: { comparisons: STRING },`
`60`	`60`	`}`
`61`	`61`
`62`	`62`	`// Keyed by the source union so adding a source without a rule fails to compile.`