feat(lookup): enhance lookup functionality to support CIDR queries

Updated the lookup system to allow for CIDR queries in addition to IP and domain searches. This includes modifications to the API, frontend components, and documentation to reflect the new capabilities. The LookupSearchForm and LookupComponent were adjusted to accommodate CIDR input, and relevant tests were added to ensure functionality.

Co-authored-by: Cursor <[email protected]>

internal/httpapi/routes_lookup.go

@@ -27,7 +27,7 @@ func (s *Server) handleLookup(w http.ResponseWriter, r *http.Request) {
 	res, err := lookup.Lookup(r.Context(), s.store, a.TenantID, q)
 	if err != nil {
 		if errors.Is(err, store.ErrInvalidInput) {
-			writeProblem(w, http.StatusBadRequest, "Bad Request", "query must be an IP address or FQDN")
+			writeProblem(w, http.StatusBadRequest, "Bad Request", "query must be an IP address, CIDR, or FQDN")
 			return
 		}
 		writeStoreErr(w, err)

internal/lookup/lookup.go

@@ -19,6 +19,7 @@ type QueryKind string
 const (
 	KindIP     QueryKind = "ip"
 	KindDomain QueryKind = "domain"
+	KindCIDR   QueryKind = "cidr"
 )
 
 // Layer identifies which data source produced a match.
@@ -69,7 +70,7 @@ type Result struct {
 // DomainResolver resolves a hostname to IP addresses (A/AAAA).
 type DomainResolver func(ctx context.Context, host string) ([]netip.Addr, error)
 
-// Lookup checks whether q (IP or FQDN) is present in tenant lists (entries + snapshots).
+// Lookup checks whether q (IP, CIDR, or FQDN) is present in tenant lists (entries + snapshots).
 // For domains, FQDN membership is checked first, then live DNS resolve and IP membership.
 func Lookup(ctx context.Context, st store.Backend, tenantID, q string) (*Result, error) {
 	return LookupWithResolver(ctx, st, tenantID, q, systemDNSResolver)
@@ -109,10 +110,17 @@ func LookupWithResolver(
 		if err := lookupIP(st, tenantID, addr, out, commByID, ""); err != nil {
 			return nil, err
 		}
+	} else if pfx, err := netip.ParsePrefix(raw); err == nil {
+		masked := pfx.Masked()
+		out.QueryKind = KindCIDR
+		out.Normalized = masked.String()
+		if err := lookupCIDR(st, tenantID, masked, out, commByID); err != nil {
+			return nil, err
+		}
 	} else {
 		fqdn, ok := normalizeFQDN(raw)
 		if !ok {
-			return nil, fmt.Errorf("%w: query must be an IP address or FQDN", store.ErrInvalidInput)
+			return nil, fmt.Errorf("%w: query must be an IP address, CIDR, or FQDN", store.ErrInvalidInput)
 		}
 		out.QueryKind = KindDomain
 		out.Normalized = fqdn
@@ -250,6 +258,86 @@ func lookupIP(
 	return nil
 }
 
+// prefixCoversQuery reports whether listPfx equals query or fully contains it.
+func prefixCoversQuery(listPfx, query netip.Prefix) bool {
+	listPfx = listPfx.Masked()
+	query = query.Masked()
+	if listPfx == query {
+		return true
+	}
+	return listPfx.Contains(query.Addr()) && listPfx.Bits() <= query.Bits()
+}
+
+func lookupCIDR(
+	st store.Backend,
+	tenantID string,
+	query netip.Prefix,
+	out *Result,
+	commByID map[string]*store.Community,
+) error {
+	for _, mod := range st.ListModules(tenantID) {
+		if mod == nil {
+			continue
+		}
+		if mod.Type == "IP_RANGES" {
+			entries, err := st.ListIPRangeEntries(tenantID, mod.ID)
+			if err != nil {
+				return err
+			}
+			for _, e := range entries {
+				if e == nil {
+					continue
+				}
+				pfx, err := netip.ParsePrefix(strings.TrimSpace(e.Prefix))
+				if err != nil {
+					continue
+				}
+				if !prefixCoversQuery(pfx, query) {
+					continue
+				}
+				out.Matches = append(out.Matches, decorateMatch(Match{
+					Layer:        LayerEntry,
+					ModuleID:     mod.ID,
+					ModuleName:   mod.Name,
+					ModuleType:   mod.Type,
+					MatchKind:    MatchIPRange,
+					MatchedValue: e.Prefix,
+					EntryID:      e.ID,
+					CommunityID:  resolveCommunityID(e.CommunityID, mod.DefaultCommunityID),
+				}, commByID))
+			}
+		}
+
+		snap, ok, err := st.GetModulePrefixSnapshot(tenantID, mod.ID)
+		if err != nil {
+			return err
+		}
+		if !ok || snap == nil {
+			continue
+		}
+		for _, row := range snap.Prefixes {
+			pfx, err := netip.ParsePrefix(strings.TrimSpace(row.Prefix))
+			if err != nil {
+				continue
+			}
+			if !prefixCoversQuery(pfx, query) {
+				continue
+			}
+			out.Matches = append(out.Matches, decorateMatch(Match{
+				Layer:        LayerSnapshot,
+				ModuleID:     mod.ID,
+				ModuleName:   mod.Name,
+				ModuleType:   mod.Type,
+				MatchKind:    MatchPrefix,
+				MatchedValue: row.Prefix,
+				Source:       row.Source,
+				CommunityID:  row.CommunityID,
+			}, commByID))
+		}
+	}
+	return nil
+}
+
 func lookupDomain(st store.Backend, tenantID, fqdn string, out *Result, commByID map[string]*store.Community) error {
 	matchedModuleIDs := make(map[string]*store.Module)
 

internal/lookup/lookup_test.go

@@ -220,6 +220,60 @@ func TestLookupDomainResolvedIPAgainstRanges(t *testing.T) {
 	}
 }
 
+func TestLookupCIDREntryAndSnapshot(t *testing.T) {
+	m := store.NewMemory()
+	m.SeedDemo()
+	tenant, _, modIP, _, _ := m.DemoIDs()
+	comms, _ := m.ListCommunities(tenant)
+	cid := comms[0].ID
+
+	e, err := m.CreateIPRangeEntry(tenant, modIP, &store.IPRangeEntry{
+		Prefix:      "203.0.113.0/24",
+		CommunityID: &cid,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := m.SetModulePrefixSnapshot(tenant, modIP, "hash-cidr", []store.PrefixRow{
+		{Prefix: "203.0.113.0/24", CommunityID: &cid, Source: "ip_range"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	res, err := Lookup(context.Background(), m, tenant, "203.0.113.0/24")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.QueryKind != KindCIDR || res.Normalized != "203.0.113.0/24" {
+		t.Fatalf("kind/normalized: %+v", res)
+	}
+	if !res.Matched || res.MatchCount < 2 {
+		t.Fatalf("expected entry+snapshot, got %+v", res)
+	}
+
+	var entryHit, snapHit bool
+	for _, hit := range res.Matches {
+		if hit.Layer == LayerEntry && hit.EntryID == e.ID {
+			entryHit = true
+		}
+		if hit.Layer == LayerSnapshot && hit.MatchedValue == "203.0.113.0/24" {
+			snapHit = true
+		}
+	}
+	if !entryHit || !snapHit {
+		t.Fatalf("entry=%v snap=%v matches=%+v", entryHit, snapHit, res.Matches)
+	}
+
+	// Narrower query covered by wider entry.
+	res2, err := Lookup(context.Background(), m, tenant, "203.0.113.128/25")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res2.QueryKind != KindCIDR || !res2.Matched {
+		t.Fatalf("expected cover match: %+v", res2)
+	}
+}
+
 func TestLookupNoMatch(t *testing.T) {
 	m := store.NewMemory()
 	m.SeedDemo()