feat(lookup): resolve domain to IPs for membership check

Для FQDN после проверки DOMAINS выполняется live DNS (A/AAAA), каждый IP проверяется по IP_RANGES и snapshots; в ответе resolved_ips / resolved_ip, UI KPI и OpenAPI обновлены.

Co-authored-by: Cursor <[email protected]>

internal/lookup/lookup_test.go

@@ -1,7 +1,9 @@
 package lookup
 
 import (
+	"context"
 	"errors"
+	"net/netip"
 	"testing"
 
 	"evobgp/internal/store"
@@ -39,7 +41,7 @@ func TestLookupIPEntryAndSnapshot(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	res, err := Lookup(m, tenant, "203.0.113.10")
+	res, err := Lookup(context.Background(), m, tenant, "203.0.113.10")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -80,7 +82,7 @@ func TestLookupIPCommunityFallback(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	res, err := Lookup(m, tenant, "10.1.2.3")
+	res, err := Lookup(context.Background(), m, tenant, "10.1.2.3")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -134,7 +136,8 @@ func TestLookupDomainEntryAndSnapshot(t *testing.T) {
 		t.Fatal(err)
 	}
 
-	res, err := Lookup(m, tenant, "example.com")
+	noDNS := func(context.Context, string) ([]netip.Addr, error) { return nil, nil }
+	res, err := LookupWithResolver(context.Background(), m, tenant, "example.com", noDNS)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -165,12 +168,64 @@ func TestLookupDomainEntryAndSnapshot(t *testing.T) {
 	}
 }
 
+func TestLookupDomainResolvedIPAgainstRanges(t *testing.T) {
+	m := store.NewMemory()
+	m.SeedDemo()
+	tenant, _, modIP, _, _ := m.DemoIDs()
+	comms, _ := m.ListCommunities(tenant)
+	cid := comms[0].ID
+	if _, err := m.UpdateModule(tenant, modIP, &store.ModulePatch{DefaultCommunityID: &cid}); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := m.CreateIPRangeEntry(tenant, modIP, &store.IPRangeEntry{
+		Prefix:      "203.0.113.0/24",
+		CommunityID: &cid,
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := m.SetModulePrefixSnapshot(tenant, modIP, "hash-r", []store.PrefixRow{
+		{Prefix: "203.0.113.0/24", CommunityID: &cid, Source: "ip_range"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	fake := func(_ context.Context, host string) ([]netip.Addr, error) {
+		if host != "google.com" {
+			t.Fatalf("unexpected host %q", host)
+		}
+		return []netip.Addr{netip.MustParseAddr("203.0.113.50")}, nil
+	}
+
+	res, err := LookupWithResolver(context.Background(), m, tenant, "google.com", fake)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.QueryKind != KindDomain {
+		t.Fatalf("kind: %+v", res)
+	}
+	if len(res.ResolvedIPs) != 1 || res.ResolvedIPs[0] != "203.0.113.50" {
+		t.Fatalf("resolved_ips: %+v", res.ResolvedIPs)
+	}
+	if !res.Matched {
+		t.Fatalf("expected IP membership via resolve, got %+v", res)
+	}
+	var viaResolve bool
+	for _, hit := range res.Matches {
+		if hit.ResolvedIP == "203.0.113.50" && hit.MatchedValue == "203.0.113.0/24" {
+			viaResolve = true
+		}
+	}
+	if !viaResolve {
+		t.Fatalf("missing resolved-ip match: %+v", res.Matches)
+	}
+}
+
 func TestLookupNoMatch(t *testing.T) {
 	m := store.NewMemory()
 	m.SeedDemo()
 	tenant, _, _, _, _ := m.DemoIDs()
 
-	res, err := Lookup(m, tenant, "192.0.2.1")
+	res, err := Lookup(context.Background(), m, tenant, "192.0.2.1")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -183,16 +238,17 @@ func TestLookupInvalid(t *testing.T) {
 	m := store.NewMemory()
 	m.SeedDemo()
 	tenant, _, _, _, _ := m.DemoIDs()
+	ctx := context.Background()
 
-	_, err := Lookup(m, tenant, "")
+	_, err := Lookup(ctx, m, tenant, "")
 	if !errors.Is(err, store.ErrInvalidInput) {
 		t.Fatalf("empty: %v", err)
 	}
-	_, err = Lookup(m, tenant, "not a host")
+	_, err = Lookup(ctx, m, tenant, "not a host")
 	if !errors.Is(err, store.ErrInvalidInput) {
 		t.Fatalf("spaces: %v", err)
 	}
-	_, err = Lookup(m, tenant, "localhost")
+	_, err = Lookup(ctx, m, tenant, "localhost")
 	if !errors.Is(err, store.ErrInvalidInput) {
 		t.Fatalf("single label: %v", err)
 	}