fix(tlsbridge): validate internal_cidrs at config load; doc rename (review #522)

- TLSBridgeConfig.Validate now rejects malformed internal_cidrs entries so an
  operator CIDR typo fails loudly at load instead of being silently dropped by
  Decision (which would stop excluding an intended in-cluster range under
  scope=external). Adds TestTLSBridgeConfig_Validate covering scope/ca_source/
  file-paths/CIDR cases.
- Update the TLSBridgeConfig doc comment: 'MITM termination' -> 'TLS termination
  (formerly MITM)' for grep-consistency with the rename.

Signed-off-by: Hai Huang <huang195@gmail.com>

Author: huang195

authbridge/authlib/config/config.go

@@ -5,6 +5,7 @@ package config
 import (
 	"encoding/json"
 	"fmt"
+	"net"
 	"os"
 	"strings"
 
@@ -42,8 +43,9 @@ type Config struct {
 	TLSBridge *TLSBridgeConfig `yaml:"tls_bridge,omitempty" json:"tls_bridge,omitempty"`
 }
 
-// TLSBridgeConfig configures the outbound TLS bridge (MITM termination of
-// agent egress so the outbound plugin pipeline sees decrypted HTTPS).
+// TLSBridgeConfig configures the outbound TLS bridge (TLS termination of
+// agent egress — formerly "MITM" — so the outbound plugin pipeline sees
+// decrypted HTTPS).
 type TLSBridgeConfig struct {
 	Enabled          bool     `yaml:"enabled" json:"enabled"`
 	Scope            string   `yaml:"scope" json:"scope"` // external | all
@@ -66,6 +68,11 @@ func (b *TLSBridgeConfig) Validate() error {
 	if b.CASource == "file" && (b.CACertPath == "" || b.CAKeyPath == "") {
 		return fmt.Errorf("tls_bridge.ca_source=file requires ca_cert_path and ca_key_path")
 	}
+	for _, c := range b.InternalCIDRs {
+		if _, _, err := net.ParseCIDR(c); err != nil {
+			return fmt.Errorf("tls_bridge.internal_cidrs: %q is not a valid CIDR: %w", c, err)
+		}
+	}
 	return nil
 }
 

authbridge/authlib/config/config_test.go

@@ -750,6 +750,31 @@ func TestConfig_TLSBridgeBlockDecodes(t *testing.T) {
 	}
 }
 
+func TestTLSBridgeConfig_Validate(t *testing.T) {
+	cases := []struct {
+		name    string
+		cfg     TLSBridgeConfig
+		wantErr bool
+	}{
+		{"valid empty", TLSBridgeConfig{}, false},
+		{"valid full", TLSBridgeConfig{Scope: "all", CASource: "ephemeral", InternalCIDRs: []string{"10.0.0.0/8", "172.30.0.0/16"}}, false},
+		{"bad scope", TLSBridgeConfig{Scope: "internal"}, true},
+		{"bad ca_source", TLSBridgeConfig{CASource: "vault"}, true},
+		{"file ca without paths", TLSBridgeConfig{CASource: "file"}, true},
+		{"file ca with paths", TLSBridgeConfig{CASource: "file", CACertPath: "/c", CAKeyPath: "/k"}, false},
+		{"bad cidr typo", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0/8", "10.0.0.0./8"}}, true},
+		{"bad cidr missing mask", TLSBridgeConfig{InternalCIDRs: []string{"10.0.0.0"}}, true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := tc.cfg.Validate()
+			if (err != nil) != tc.wantErr {
+				t.Errorf("Validate() error = %v, wantErr %v", err, tc.wantErr)
+			}
+		})
+	}
+}
+
 // Absent mtls block leaves cfg.MTLS nil — today's behavior, no TLS.
 func TestLoad_MTLS_AbsentBlock(t *testing.T) {
 	dir := t.TempDir()