ip allow list helper improvements (#456)

- Moves helpers out of kv files and to ipallowlist.go. (Still in same `text` package, so real refactor here, just moving stuff around).

- Improves `ipAllowListEquals` to be order-insensitive. If the server returns the same allow list entries in different orders on different requests, our equality check will still say they are equal.

Pulled this out of [GROW-2120: PG Update](https://linear.app/render-com/issue/GROW-2120/pg-update)

GitOrigin-RevId: 5da8bcd8d8a6c4dc19b84b72fc0ca68f8ebbfe42

Author: davidharting

pkg/text/ipallowlist.go

@@ -0,0 +1,65 @@
+package text
+
+import (
+	"cmp"
+	"fmt"
+	"slices"
+	"strings"
+
+	"github.com/render-oss/cli/pkg/client"
+)
+
+// Shared IP allow-list rendering helpers, used by both Key Value and Postgres
+// text output. The parsing counterpart lives in pkg/types/ipallowlist.go.
+
+// ipAllowListBlock renders the allow-list as either a one-liner ("IP allow-list: (empty)")
+// or a header line followed by indented entries — each "  - <cidr> (<description>)" or
+// "  - <cidr>" when description is empty.
+func ipAllowListBlock(entries []client.CidrBlockAndDescription) string {
+	if len(entries) == 0 {
+		return "IP allow-list: (empty)"
+	}
+	var b strings.Builder
+	b.WriteString("IP allow-list:")
+	for _, e := range entries {
+		if e.Description != "" {
+			fmt.Fprintf(&b, "\n  - %s (%s)", e.CidrBlock, e.Description)
+		} else {
+			fmt.Fprintf(&b, "\n  - %s", e.CidrBlock)
+		}
+	}
+	return b.String()
+}
+
+// ipAllowListLabel renders a compact count label for use in update diffs.
+func ipAllowListLabel(entries []client.CidrBlockAndDescription) string {
+	switch len(entries) {
+	case 0:
+		return "(empty)"
+	case 1:
+		return "1 entry"
+	default:
+		return fmt.Sprintf("%d entries", len(entries))
+	}
+}
+
+// ipAllowListEqual reports whether two allow-lists contain the same entries.
+// An allow-list is conceptually a set, so the comparison is order-insensitive:
+// it sorts copies (never the caller's slices, which are live server data)
+// before comparing, so a reordered list is not reported as a change.
+func ipAllowListEqual(a, b []client.CidrBlockAndDescription) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	as := slices.Clone(a)
+	bs := slices.Clone(b)
+	byKey := func(x, y client.CidrBlockAndDescription) int {
+		return cmp.Or(
+			cmp.Compare(x.CidrBlock, y.CidrBlock),
+			cmp.Compare(x.Description, y.Description),
+		)
+	}
+	slices.SortFunc(as, byKey)
+	slices.SortFunc(bs, byKey)
+	return slices.Equal(as, bs)
+}

pkg/text/ipallowlist_test.go

@@ -0,0 +1,45 @@
+package text
+
+import (
+	"testing"
+
+	"github.com/render-oss/cli/pkg/client"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIPAllowListEqual(t *testing.T) {
+	office := client.CidrBlockAndDescription{CidrBlock: "203.0.113.5/32", Description: "office"}
+	internal := client.CidrBlockAndDescription{CidrBlock: "10.0.0.0/8", Description: "internal"}
+
+	t.Run("same entries, same order", func(t *testing.T) {
+		a := []client.CidrBlockAndDescription{office, internal}
+		b := []client.CidrBlockAndDescription{office, internal}
+		assert.True(t, ipAllowListEqual(a, b))
+	})
+
+	t.Run("same entries, different order", func(t *testing.T) {
+		a := []client.CidrBlockAndDescription{office, internal}
+		b := []client.CidrBlockAndDescription{internal, office}
+		assert.True(t, ipAllowListEqual(a, b))
+	})
+
+	t.Run("different entries", func(t *testing.T) {
+		a := []client.CidrBlockAndDescription{office}
+		b := []client.CidrBlockAndDescription{internal}
+		assert.False(t, ipAllowListEqual(a, b))
+	})
+
+	t.Run("different lengths", func(t *testing.T) {
+		a := []client.CidrBlockAndDescription{office, internal}
+		b := []client.CidrBlockAndDescription{office}
+		assert.False(t, ipAllowListEqual(a, b))
+	})
+
+	t.Run("does not mutate the caller's slices", func(t *testing.T) {
+		a := []client.CidrBlockAndDescription{office, internal}
+		b := []client.CidrBlockAndDescription{internal, office}
+		ipAllowListEqual(a, b)
+		assert.Equal(t, []client.CidrBlockAndDescription{office, internal}, a)
+		assert.Equal(t, []client.CidrBlockAndDescription{internal, office}, b)
+	})
+}

pkg/text/keyvalue.go

@@ -45,25 +45,6 @@ func KeyValueDetail(kv *client.KeyValueDetail) string {
 	return strings.Join(lines, "\n")
 }
 
-// ipAllowListBlock renders the allow-list as either a one-liner ("IP allow-list: (empty)")
-// or a header line followed by indented entries — each "  - <cidr> (<description>)" or
-// "  - <cidr>" when description is empty.
-func ipAllowListBlock(entries []client.CidrBlockAndDescription) string {
-	if len(entries) == 0 {
-		return "IP allow-list: (empty)"
-	}
-	var b strings.Builder
-	b.WriteString("IP allow-list:")
-	for _, e := range entries {
-		if e.Description != "" {
-			fmt.Fprintf(&b, "\n  - %s (%s)", e.CidrBlock, e.Description)
-		} else {
-			fmt.Fprintf(&b, "\n  - %s", e.CidrBlock)
-		}
-	}
-	return b.String()
-}
-
 func KeyValueGetDetail(kv *client.KeyValueDetail, conn *client.KeyValueConnectionInfo) string {
 	detail := KeyValueDetail(kv)
 	if len(kv.IpAllowList) == 0 {
@@ -111,26 +92,3 @@ func memoryPolicyLabel(kv *client.KeyValueDetail) string {
 	}
 	return *kv.Options.MaxmemoryPolicy
 }
-
-func ipAllowListLabel(entries []client.CidrBlockAndDescription) string {
-	switch len(entries) {
-	case 0:
-		return "(empty)"
-	case 1:
-		return "1 entry"
-	default:
-		return fmt.Sprintf("%d entries", len(entries))
-	}
-}
-
-func ipAllowListEqual(a, b []client.CidrBlockAndDescription) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	for i := range a {
-		if a[i].CidrBlock != b[i].CidrBlock || a[i].Description != b[i].Description {
-			return false
-		}
-	}
-	return true
-}