From 61f4eb037da710c382e5544cbd992b99a860c37c Mon Sep 17 00:00:00 2001 From: Kristoffer Dalby Date: Tue, 27 Oct 2026 15:39:19 +0000 Subject: [PATCH] mapper: test that a hidden peer's policy change still sends filters --- hscontrol/mapper/mapper_test.go | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/hscontrol/mapper/mapper_test.go b/hscontrol/mapper/mapper_test.go index 641ebbe59..d81d0317f 100644 --- a/hscontrol/mapper/mapper_test.go +++ b/hscontrol/mapper/mapper_test.go @@ -503,6 +503,20 @@ func TestBuildFromChangeFiltersUserProfilesByVisibility(t *testing.T) { assert.NotEqual(t, user2.TailscaleUserProfile().ID, up.ID, "n1 must not receive user2's profile; n2 is not ACL-visible to n1") } + + // What else the change carries still reaches n1, without n2 or user2's + // profile. + c = change.PolicyAndPeers(n2.ID) + resp, err = m.buildFromChange(n1.ID, tailcfg.CurrentCapabilityVersion, &c) + require.NoError(t, err) + require.NotNil(t, resp) + assert.NotNil(t, resp.PacketFilters) + assert.Empty(t, resp.PeersChanged) + + for _, up := range resp.UserProfiles { + assert.NotEqual(t, user2.TailscaleUserProfile().ID, up.ID, + "n1 must not receive user2's profile with the policy change") + } } // TestBuildFromChangeVisibilityMatchesFullMap is the consolidation guard for