Explain that an empty IP allow-list blocks external connections (#503)

Updates all kv and pg commands that show a single item to note that an empty ip allow list means external connections are blocked.

GROW-2604

GitOrigin-RevId: 272fadd82168499e39eefde51095d23b5c421d5e

Author: davidharting

pkg/text/ipallowlist.go

@@ -10,12 +10,13 @@ import (
 // Shared IP allow-list rendering helpers, used by both Key Value and Postgres
 // text output. The parsing counterpart lives in pkg/types/ipallowlist.go.
 
-// ipAllowListBlock renders the allow-list as either a one-liner ("IP allow-list: (empty)")
-// or a header line followed by indented entries — each "  - <cidr> (<description>)" or
-// "  - <cidr>" when description is empty.
+// ipAllowListBlock renders the allow-list as either a one-liner
+// ("IP allow-list: empty (external connections blocked)") or a header line
+// followed by indented entries — each "  - <cidr> (<description>)", or
+// "  - <cidr>" when the description is empty.
 func ipAllowListBlock(entries []client.CidrBlockAndDescription) string {
 	if len(entries) == 0 {
-		return "IP allow-list: (empty)"
+		return "IP allow-list: empty (external connections blocked)"
 	}
 	var b strings.Builder
 	b.WriteString("IP allow-list:")

pkg/text/keyvalue.go

@@ -51,9 +51,6 @@ func KeyValueDetail(kv *keyvalue.KeyValueOut) string {
 		lines = append(lines, fmt.Sprintf("Memory policy: %s", *kv.MaxmemoryPolicy))
 	}
 	detail := strings.Join(append(lines, ipAllowListBlock(kv.IPAllowList)), "\n")
-	if len(kv.IPAllowList) == 0 {
-		detail = strings.Replace(detail, "IP allow-list: (empty)", "IP allow-list: (empty, external connections are blocked)", 1)
-	}
 	if kv.ConnectionInfo == nil {
 		return detail
 	}

pkg/text/keyvalue_test.go

@@ -11,6 +11,16 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
+func basicKeyValue() *keyvalue.KeyValueOut {
+	return &keyvalue.KeyValueOut{
+		ID:     "key-abc123",
+		Name:   "my-kv",
+		Plan:   client.KeyValuePlanStarter,
+		Region: client.Oregon,
+		Status: client.DatabaseStatusAvailable,
+	}
+}
+
 func TestKeyValueDetail_OmitsProjectAndEnvironmentWhenUnset(t *testing.T) {
 	kv := keyvalue.KeyValueOut{
 		ID:            "red-abc123",
@@ -60,3 +70,23 @@ func TestKeyValueDetail_HappyPath(t *testing.T) {
 		"Memory policy: allkeys-lru",
 	)
 }
+
+func TestKeyValueDetail_IPAllowList(t *testing.T) {
+	t.Run("explains that empty allow-list blocks external connections", func(t *testing.T) {
+		kv := basicKeyValue()
+		assert.Contains(t, text.KeyValueDetail(kv), "IP allow-list: empty (external connections blocked)")
+	})
+
+	t.Run("renders populated entries", func(t *testing.T) {
+		kv := basicKeyValue()
+		kv.IPAllowList = []client.CidrBlockAndDescription{
+			{CidrBlock: "10.0.0.0/8", Description: "internal"},
+			{CidrBlock: "203.0.113.5/32"},
+		}
+		out := text.KeyValueDetail(kv)
+		assert.Contains(t, out, "IP allow-list:")
+		assert.Contains(t, out, "10.0.0.0/8 (internal)")
+		assert.Contains(t, out, "203.0.113.5/32")
+		assert.NotContains(t, out, "external connections blocked")
+	})
+}

pkg/text/postgres_test.go

@@ -154,9 +154,9 @@ func TestPostgresDetail_ReadReplicas(t *testing.T) {
 }
 
 func TestPostgresDetail_IPAllowList(t *testing.T) {
-	t.Run("renders empty allow-list as (empty)", func(t *testing.T) {
+	t.Run("explains that empty allow-list blocks external connections", func(t *testing.T) {
 		pg := basicPostgresOut(basicPostgres())
-		assert.Contains(t, text.PostgresDetail(&pg), "IP allow-list: (empty)")
+		assert.Contains(t, text.PostgresDetail(&pg), "IP allow-list: empty (external connections blocked)")
 	})
 
 	t.Run("renders populated entries", func(t *testing.T) {