audit: eliminate deployment-address hardcoding; single typed endpoint config

Mandatory OpenFUT architecture audit. Two real defects found and fixed, plus
the config surface tightened so neither class can recur.

DEFECT 1 -- hidden localhost fallback. The Rust host defaulted POW hosts to
127.0.0.1 while every other URL followed OPENFUT_ADVERTISE, so a remote
deployment would emit loopback POW URLs and fail far from the cause. It also
diverged from the deployed Python entrypoint, which derives them
(POW_HOST="${POW_HOST:-$ADV:8094}"). POW endpoints now derive from the
advertised address; explicit overrides still win.

DEFECT 2 -- Default gave loopback silently. `Endpoints::default()` and
`AdapterConfig::default()` supplied 127.0.0.1, so anything constructing a
config by omission got loopback with no signal. Both `Default` impls are
REMOVED. Loopback is now `Endpoints::loopback()` / `AdapterConfig::loopback()`:
an explicit, greppable decision. Production uses `advertising(host)`.

CONFIGURABILITY. `blaze_port` and `utas_port` are now config, not literals.
The advertised Blaze port is our choice -- the client goes wherever
<serverinstanceinfo> sends it -- and 8099 is the client's own built-in default
but still deployment config. A bad port value is an error, not a silent
fallback to the previous one.

TEST-NET EVERYWHERE. Committed fixtures and tests used the lab's real LAN
address; a test that passes because its constant matches the current lab
proves nothing about relocatability. Redirector fixtures regenerated on
RFC 5737 TEST-NET-1/2/3 plus loopback. Harness scripts no longer default the
client IP to the lab address -- client-state.sh now requires it.

SEVEN REQUIRED TESTS in tests/deployment_config.rs plus host-side coverage:
remote config never silently becomes localhost; missing advertise fails
clearly; bind may differ from advertise; changing the Blaze port changes the
redirect; changing the host updates all 200+ generated URLs with no
stragglers; no helper bypasses central config; mutations are detectable.

MUTATION TESTED, and it found a hole in the audit tests themselves. Hardcoding
utas_base, reverting the POW derivation and re-hardcoding the Blaze port were
all caught. Making the redirector read `bind` instead of `advertise` was NOT:
`advertising()` sets bind == advertise, so the two sources were
indistinguishable. That is the single most likely bypass -- the oracle really
does read bind for nucleusConnect -- so the test now forces bind != advertise
and asserts the bind address never reaches the wire. Re-mutated: caught.

Wire behaviour unchanged: oracle fixtures still current, 153 tests green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

openfut-adapter-fifa17/fixtures/redirector.json

@@ -1,5 +1,6 @@
 {
- "10.10.0.120": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331360d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e31302e31302e302e3132303c2f686f73746e616d653e0a0909093c69703e3136383432373634303c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a",
  "127.0.0.1": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e3132372e302e302e313c2f686f73746e616d653e0a0909093c69703e323133303730363433333c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a",
- "198.51.100.7": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e3139382e35312e3130302e373c2f686f73746e616d653e0a0909093c69703e333332353235363731313c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a"
+ "192.0.2.1": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331350d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e3139322e302e322e313c2f686f73746e616d653e0a0909093c69703e333232313232353938353c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a",
+ "198.51.100.7": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e3139382e35312e3130302e373c2f686f73746e616d653e0a0909093c69703e333332353235363731313c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a",
+ "203.0.113.42": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f786d6c0d0a436f6e74656e742d4c656e6774683a203331380d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a3c3f786d6c2076657273696f6e3d22312e302220656e636f64696e673d225554462d38223f3e0a3c736572766572696e7374616e6365696e666f3e0a093c61646472657373206d656d6265723d2230223e0a09093c76616c753e0a0909093c686f73746e616d653e3230332e302e3131332e34323c2f686f73746e616d653e0a0909093c69703e333430353830333831383c2f69703e0a0909093c706f72743e34323133303c2f706f72743e0a09093c2f76616c753e0a093c2f616464726573733e0a093c7365637572653e303c2f7365637572653e0a093c747269616c736572766963656e616d653e3c2f747269616c736572766963656e616d653e0a093c64656661756c74646e73616464726573733e303c2f64656661756c74646e73616464726573733e0a3c2f736572766572696e7374616e6365696e666f3e0a"
 }

openfut-adapter-fifa17/src/blaze/client_config.rs

@@ -107,7 +107,7 @@ mod tests {
     use super::*;
 
     fn cfg() -> AdapterConfig {
-        let mut c = AdapterConfig::default();
+        let mut c = AdapterConfig::loopback();
         c.endpoints.advertise = "198.51.100.7".into();
         c.endpoints.bind = "0.0.0.0".into();
         c.endpoints.pow_content_host = "198.51.100.7:8085".into();

openfut-adapter-fifa17/src/blaze/config.rs

@@ -87,28 +87,59 @@ pub struct Endpoints {
     pub pow_content_host: String,
     /// `host:port` for the POW/EASFC API.
     pub pow_host: String,
+    /// Blaze port ADVERTISED to the client by the redirector.
+    ///
+    /// Our choice, not a protocol constant — the client goes wherever
+    /// `<serverinstanceinfo>` sends it. Configurable so a sidecar can be
+    /// advertised on a different port without a rebuild.
+    pub blaze_port: u16,
+    /// UTAS/RS4 port in generated `FUT_RS4_*` URLs.
+    ///
+    /// 8099 is the client's own built-in default (`http://easw.easports.com:8099/`
+    /// in CardsDLL), so it is the sane value — but it is still deployment
+    /// configuration, not a constant we are entitled to bake in.
+    pub utas_port: u16,
     pub telemetry_port: i64,
     pub ticker_port: i64,
     pub qos_port: i64,
 }
 
-impl Default for Endpoints {
-    /// Loopback, matching the oracle's own defaults for a single-host run.
+// NOTE: there is deliberately NO `impl Default for Endpoints`.
+//
+// A default would silently supply loopback, and a remote deployment that forgot
+// to set an address would then advertise `127.0.0.1` to a client on another
+// machine — failing far from the cause. Choosing loopback has to be an explicit
+// act, so it is a named constructor.
+
+impl Endpoints {
+    /// Endpoints for a backend the client reaches at `advertise`.
     ///
-    /// A remote deployment MUST override `advertise`; the Python entrypoint
-    /// refuses to start without it, and this default is only appropriate when
-    /// game and backend share a host.
-    fn default() -> Endpoints {
+    /// POW hosts DERIVE from the advertised host, matching what the deployed
+    /// Python entrypoint does (`POW_HOST="${POW_HOST:-$ADV:8094}"`). They must
+    /// not fall back to loopback independently: that would leave a remote
+    /// deployment emitting loopback POW URLs while every other URL was correct.
+    pub fn advertising(advertise: impl Into<String>) -> Endpoints {
+        let advertise = advertise.into();
         Endpoints {
-            advertise: "127.0.0.1".into(),
-            bind: "127.0.0.1".into(),
-            pow_content_host: "127.0.0.1:8080".into(),
-            pow_host: "127.0.0.1:8094".into(),
+            pow_content_host: format!("{advertise}:8080"),
+            pow_host: format!("{advertise}:8094"),
+            bind: advertise.clone(),
+            advertise,
+            blaze_port: 42130,
+            utas_port: 8099,
             telemetry_port: 9988,
             ticker_port: 8999,
             qos_port: 17502,
         }
     }
+
+    /// Explicit local-only / oracle mode: game and backend on one host.
+    ///
+    /// Named rather than defaulted so that "everything is loopback" is always a
+    /// decision someone made, and greppable.
+    pub fn loopback() -> Endpoints {
+        Endpoints::advertising("127.0.0.1")
+    }
 }
 
 /// Full adapter configuration.
@@ -121,24 +152,36 @@ pub struct AdapterConfig {
     pub server_version: String,
 }
 
-impl Default for AdapterConfig {
-    fn default() -> AdapterConfig {
-        AdapterConfig {
-            identity: Identity::default(),
-            endpoints: Endpoints::default(),
-            server_version: "Blaze 15.1.1.3.0 (OpenFUT)\n".into(),
-        }
-    }
-}
+/// `PreAuthResponse.SVER`. On the wire, so it is config rather than a literal.
+pub const DEFAULT_SERVER_VERSION: &str = "Blaze 15.1.1.3.0 (OpenFUT)\n";
+
+// No `Default` here either, for the same reason as `Endpoints`.
 
 impl AdapterConfig {
+    /// Adapter serving a client that reaches this backend at `advertise`.
+    pub fn advertising(advertise: impl Into<String>) -> AdapterConfig {
+        AdapterConfig {
+            identity: Identity::default(),
+            endpoints: Endpoints::advertising(advertise),
+            server_version: DEFAULT_SERVER_VERSION.into(),
+        }
+    }
+
+    /// Explicit local-only / oracle mode.
+    pub fn loopback() -> AdapterConfig {
+        AdapterConfig::advertising("127.0.0.1")
+    }
+
     /// `http://<advertise>:8099/` — the RS4/UTAS base.
     ///
     /// The trailing slash and the scheme are both mandatory: CardsDLL's
     /// `ServerSettings::resolve` uses the value verbatim once it contains
     /// `"://"`, and the auth path breaks without the slash.
     pub fn utas_base(&self) -> String {
-        format!("http://{}:8099/", self.endpoints.advertise)
+        format!(
+            "http://{}:{}/",
+            self.endpoints.advertise, self.endpoints.utas_port
+        )
     }
 
     /// `http://<bind>:42131` — the Nucleus OAuth stub.
@@ -164,7 +207,7 @@ mod tests {
 
     #[test]
     fn utas_base_keeps_scheme_and_trailing_slash() {
-        let mut cfg = AdapterConfig::default();
+        let mut cfg = AdapterConfig::loopback();
         cfg.endpoints.advertise = "10.0.0.5".into();
         assert_eq!(cfg.utas_base(), "http://10.0.0.5:8099/");
     }
@@ -172,7 +215,7 @@ mod tests {
     #[test]
     fn nucleus_follows_bind_not_advertise() {
         // Documents the oracle's behaviour, including its consequence.
-        let mut cfg = AdapterConfig::default();
+        let mut cfg = AdapterConfig::loopback();
         cfg.endpoints.advertise = "10.0.0.5".into();
         cfg.endpoints.bind = "0.0.0.0".into();
         assert_eq!(cfg.nucleus_base(), "http://0.0.0.0:42131");
@@ -180,7 +223,7 @@ mod tests {
 
     #[test]
     fn pow_content_url_has_no_trailing_slash() {
-        let mut cfg = AdapterConfig::default();
+        let mut cfg = AdapterConfig::loopback();
         cfg.endpoints.pow_content_host = "10.0.0.5:8085".into();
         assert_eq!(cfg.pow_content_url(), "http://10.0.0.5:8085");
     }

openfut-adapter-fifa17/src/blaze/dispatch.rs

@@ -269,7 +269,7 @@ mod tests {
     use openfut_protocol_blaze::heat2::Struct as S;
 
     fn adapter() -> Adapter {
-        Adapter::new(AdapterConfig::default())
+        Adapter::new(AdapterConfig::loopback())
     }
 
     fn req(component: u16, command: u16) -> Header {

openfut-adapter-fifa17/src/blaze/responses.rs

@@ -489,7 +489,7 @@ mod tests {
     use super::*;
 
     fn cfg() -> AdapterConfig {
-        AdapterConfig::default()
+        AdapterConfig::loopback()
     }
 
     #[test]

openfut-adapter-fifa17/src/lib.rs

@@ -53,7 +53,7 @@
 //! use openfut_protocol_blaze::fire2::{Header, MsgType};
 //! use openfut_protocol_blaze::heat2::Struct;
 //!
-//! let adapter = Adapter::new(AdapterConfig::default());
+//! let adapter = Adapter::new(AdapterConfig::loopback());
 //! let mut session = Session::new("session-key", 0x656E5553);
 //!
 //! // Util::ping

openfut-adapter-fifa17/src/redirector/mod.rs

@@ -45,12 +45,13 @@ pub struct BlazeEndpoint {
 }
 
 impl BlazeEndpoint {
-    /// Blaze lives on 42130 in this deployment; the advertised host comes from
-    /// config so a split deployment reaches the right machine.
+    /// Both host and port come from configuration. Neither is a protocol
+    /// constant: the client goes wherever this response sends it, so hardcoding
+    /// either would make the deployment un-relocatable.
     pub fn from_config(cfg: &AdapterConfig) -> BlazeEndpoint {
         BlazeEndpoint {
             host: cfg.endpoints.advertise.clone(),
-            port: 42130,
+            port: cfg.endpoints.blaze_port,
             secure: false,
         }
     }
@@ -127,7 +128,7 @@ mod tests {
     use super::*;
 
     fn cfg(advertise: &str) -> AdapterConfig {
-        let mut c = AdapterConfig::default();
+        let mut c = AdapterConfig::loopback();
         c.endpoints.advertise = advertise.into();
         c
     }
@@ -136,7 +137,7 @@ mod tests {
     fn ip_encoding_is_host_order_decimal() {
         assert_eq!(ip_to_u32("127.0.0.1"), 2_130_706_433);
         assert_eq!(ip_to_u32("198.51.100.7"), 3_325_256_711);
-        assert_eq!(ip_to_u32("10.10.0.120"), 168_427_640);
+        assert_eq!(ip_to_u32("203.0.113.42"), 3_405_803_818);
     }
 
     #[test]
@@ -150,7 +151,7 @@ mod tests {
 
     #[test]
     fn secure_is_zero_confirming_the_plaintext_second_hop() {
-        let body = server_instance_info_xml(&BlazeEndpoint::from_config(&cfg("10.0.0.5")));
+        let body = server_instance_info_xml(&BlazeEndpoint::from_config(&cfg("203.0.113.42")));
         assert!(body.contains("<secure>0</secure>"));
     }
 
@@ -165,7 +166,7 @@ mod tests {
 
     #[test]
     fn content_length_matches_the_body_exactly() {
-        let bytes = redirect_response(&cfg("10.10.0.120"));
+        let bytes = redirect_response(&cfg("203.0.113.42"));
         let text = String::from_utf8(bytes).unwrap();
         let (head, body) = text.split_once("\r\n\r\n").expect("header/body split");
         let declared: usize = head

openfut-adapter-fifa17/tests/deployment_config.rs

@@ -0,0 +1,218 @@
+//! Deployment-address audit: the configured address must reach every
+//! client-visible endpoint, and nothing may quietly substitute its own.
+//!
+//! OpenFUT has to run on arbitrary addresses. The development topology is
+//! deployment configuration, not architecture, so no crate may contain a
+//! production destination, an advertised address, or a hidden localhost
+//! fallback.
+//!
+//! Two TEST-NET addresses are used throughout (RFC 5737), deliberately not the
+//! lab's real LAN addresses: a test that passes only because its constant
+//! happens to match the current lab proves nothing about relocatability.
+
+use openfut_adapter_fifa17::blaze::{client_config, AdapterConfig, Endpoints};
+use openfut_adapter_fifa17::redirector;
+
+/// TEST-NET-2 and TEST-NET-3. Never routable, never ours, and obviously not a
+/// lab address to anyone reading a failure.
+const ADDR_A: &str = "198.51.100.7";
+const ADDR_B: &str = "203.0.113.42";
+
+fn cfg(advertise: &str) -> AdapterConfig {
+    AdapterConfig::advertising(advertise)
+}
+
+/// Every client-visible string a config produces, for wholesale comparison.
+fn client_visible_surface(cfg: &AdapterConfig) -> Vec<String> {
+    let mut out = vec![
+        cfg.utas_base(),
+        cfg.nucleus_base(),
+        cfg.pow_content_url(),
+        String::from_utf8(redirector::redirect_response(cfg)).unwrap(),
+    ];
+    for section in client_config::known_sections() {
+        for (k, v) in client_config::rows_for(section, cfg) {
+            out.push(format!("{section}/{k}={v}"));
+        }
+    }
+    out
+}
+
+/// (5) Changing the advertised host must update every applicable generated URL,
+/// with no recompilation and no leftovers.
+#[test]
+fn changing_the_advertised_host_updates_every_client_visible_url() {
+    let a = client_visible_surface(&cfg(ADDR_A));
+    let b = client_visible_surface(&cfg(ADDR_B));
+
+    assert_eq!(a.len(), b.len(), "the surface itself must not change shape");
+
+    let a_has = a.iter().filter(|s| s.contains(ADDR_A)).count();
+    let b_has = b.iter().filter(|s| s.contains(ADDR_B)).count();
+    assert!(a_has > 200, "expected the address throughout, saw {a_has}");
+    assert_eq!(a_has, b_has, "the same entries must carry the new address");
+
+    // Nothing may retain the old address after reconfiguration.
+    let stragglers: Vec<&String> = b.iter().filter(|s| s.contains(ADDR_A)).collect();
+    assert!(
+        stragglers.is_empty(),
+        "these kept the previous address: {:?}",
+        &stragglers[..stragglers.len().min(5)]
+    );
+}
+
+/// (1) A remote configuration must not silently become localhost anywhere.
+#[test]
+fn remote_configuration_never_silently_becomes_localhost() {
+    let c = cfg(ADDR_A);
+    // Allowlisted: two OAuth redirect targets that are literals in the oracle
+    // and are never dialled (see the compatibility exceptions in the vault).
+    const ALLOWED_LOOPBACK_KEYS: [&str; 2] = ["identityRedirectUri", "redirect_uri"];
+
+    for entry in client_visible_surface(&c) {
+        if entry.contains("127.0.0.1") || entry.contains("localhost") {
+            assert!(
+                ALLOWED_LOOPBACK_KEYS.iter().any(|k| entry.contains(k)),
+                "unexpected loopback in a remote configuration: {entry}"
+            );
+        }
+    }
+
+    // POW hosts in particular must derive from advertise, not fall back alone.
+    assert!(c.endpoints.pow_content_host.starts_with(ADDR_A));
+    assert!(c.endpoints.pow_host.starts_with(ADDR_A));
+    assert!(c.pow_content_url().contains(ADDR_A));
+}
+
+/// (3) Bind and advertise are different concepts and must never be conflated.
+#[test]
+fn bind_can_differ_from_advertise() {
+    let mut c = cfg(ADDR_A);
+    c.endpoints.bind = "0.0.0.0".into();
+
+    assert_eq!(c.endpoints.advertise, ADDR_A);
+    assert_eq!(c.endpoints.bind, "0.0.0.0");
+    // The advertised surface follows advertise, not bind.
+    assert!(c.utas_base().contains(ADDR_A));
+    assert!(!c.utas_base().contains("0.0.0.0"));
+
+    // COMPATIBILITY EXCEPTION, reproduced deliberately: nucleusConnect follows
+    // BIND in the oracle. Instrumentation showed the client never dials it, so
+    // this is cosmetic on the observed path. Asserted so the exception cannot
+    // be "fixed" by accident without this test failing and forcing the decision
+    // to be made explicitly.
+    assert_eq!(c.nucleus_base(), "http://0.0.0.0:42131");
+}
+
+/// (4) The advertised Blaze port must reach the redirect result.
+#[test]
+fn changing_the_blaze_port_changes_the_redirect() {
+    let mut c = cfg(ADDR_A);
+    let before = String::from_utf8(redirector::redirect_response(&c)).unwrap();
+    assert!(before.contains("<port>42130</port>"));
+
+    c.endpoints.blaze_port = 42999;
+    let after = String::from_utf8(redirector::redirect_response(&c)).unwrap();
+    assert!(after.contains("<port>42999</port>"), "{after}");
+    assert!(!after.contains("<port>42130</port>"));
+    // And the advertised host still follows config.
+    assert!(after.contains(&format!("<hostname>{ADDR_A}</hostname>")));
+}
+
+/// The UTAS port is deployment configuration too, not a constant we own.
+#[test]
+fn changing_the_utas_port_changes_every_rs4_url() {
+    let mut c = cfg(ADDR_A);
+    assert!(c.utas_base().contains(":8099/"));
+
+    c.endpoints.utas_port = 9099;
+    assert_eq!(c.utas_base(), format!("http://{ADDR_A}:9099/"));
+
+    let rows = client_config::rows_for("BlazeSDK", &c);
+    let base = rows.iter().find(|(k, _)| k == "FUT_RS4_BASE_URL").unwrap();
+    assert_eq!(base.1, format!("http://{ADDR_A}:9099/"));
+    assert!(!rows.iter().any(|(_, v)| v.contains(":8099")));
+}
+
+/// (6) No service-specific helper may construct an endpoint from a different
+/// source of truth than the central configuration.
+#[test]
+fn no_helper_bypasses_the_central_configuration() {
+    // bind MUST differ from advertise here. With them equal, a helper that
+    // wrongly reads `bind` is indistinguishable from one that reads
+    // `advertise` — and reading `bind` is the single most likely bypass,
+    // because the oracle really does it for nucleusConnect. Mutation-tested:
+    // with bind == advertise this test could not detect that substitution.
+    let mut c = cfg(ADDR_B);
+    c.endpoints.bind = "0.0.0.0".into();
+
+    // Every URL-shaped helper resolves through the same Endpoints.
+    assert!(c.utas_base().contains(ADDR_B));
+    assert!(c.pow_content_url().contains(ADDR_B));
+    let ep = redirector::BlazeEndpoint::from_config(&c);
+    assert_eq!(
+        ep.host, c.endpoints.advertise,
+        "the redirector must advertise the ADVERTISED host, not the bind address"
+    );
+    assert_ne!(
+        ep.host, c.endpoints.bind,
+        "bind must not leak into the wire"
+    );
+    let xml = String::from_utf8(redirector::redirect_response(&c)).unwrap();
+    assert!(xml.contains(ADDR_B));
+    assert!(
+        !xml.contains("0.0.0.0"),
+        "the bind address must never reach the client"
+    );
+    assert_eq!(ep.port, c.endpoints.blaze_port);
+
+    // And the config table's URL tokens resolve through those same helpers,
+    // rather than re-deriving a URL shape of their own.
+    let rows = client_config::rows_for("BlazeSDK", &c);
+    let base = rows.iter().find(|(k, _)| k == "FUT_RS4_BASE_URL").unwrap();
+    assert_eq!(base.1, c.utas_base());
+    let nucleus = rows.iter().find(|(k, _)| k == "nucleusConnect").unwrap();
+    assert_eq!(nucleus.1, c.nucleus_base());
+}
+
+/// (7) Mutating the configuration must make these tests fail — a suite that
+/// passes regardless of the configured address would prove nothing.
+#[test]
+fn configuration_mutations_are_detectable() {
+    let a = cfg(ADDR_A);
+    let b = cfg(ADDR_B);
+
+    // Each of these is what a mutation would have to defeat.
+    assert_ne!(a.utas_base(), b.utas_base());
+    assert_ne!(a.pow_content_url(), b.pow_content_url());
+    assert_ne!(
+        redirector::redirect_response(&a),
+        redirector::redirect_response(&b)
+    );
+    assert_ne!(
+        client_config::rows_for("BlazeSDK", &a),
+        client_config::rows_for("BlazeSDK", &b)
+    );
+
+    let mut port_changed = a.clone();
+    port_changed.endpoints.blaze_port += 1;
+    assert_ne!(
+        redirector::redirect_response(&a),
+        redirector::redirect_response(&port_changed)
+    );
+}
+
+/// Loopback must be a named, deliberate choice — not something a caller can
+/// reach by omission.
+#[test]
+fn loopback_is_explicit_not_a_default() {
+    let l = Endpoints::loopback();
+    assert_eq!(l.advertise, "127.0.0.1");
+    assert!(l.pow_content_host.starts_with("127.0.0.1"));
+
+    // `Endpoints::default()` and `AdapterConfig::default()` deliberately do not
+    // exist; this test documents that, and the crate would not compile if they
+    // were reintroduced and used by accident elsewhere.
+    let explicit = AdapterConfig::loopback();
+    assert_eq!(explicit.endpoints.advertise, "127.0.0.1");
+}

openfut-adapter-fifa17/tests/oracle_parity.rs

@@ -88,7 +88,7 @@ fn config_from(record: &J) -> (AdapterConfig, i64) {
         bind: st(record, "bind"),
         pow_content_host: st(record, "pow_content_host"),
         pow_host: st(record, "pow_host"),
-        ..Endpoints::default()
+        ..Endpoints::loopback()
     };
     let cfg = AdapterConfig {
         identity,
@@ -371,7 +371,7 @@ fn redirect_response_matches_python_oracle_byte_for_byte() {
     assert!(table.len() >= 3, "expected several advertised addresses");
 
     for (advertise, want_hex) in &table {
-        let mut cfg = AdapterConfig::default();
+        let mut cfg = AdapterConfig::loopback();
         cfg.endpoints.advertise = advertise.clone();
 
         let got = redirector::redirect_response(&cfg);
@@ -389,9 +389,9 @@ fn redirect_response_matches_python_oracle_byte_for_byte() {
 fn redirect_response_is_configurable_not_baked() {
     use openfut_adapter_fifa17::redirector;
 
-    let mut a = AdapterConfig::default();
+    let mut a = AdapterConfig::loopback();
     a.endpoints.advertise = "10.0.0.5".into();
-    let mut b = AdapterConfig::default();
+    let mut b = AdapterConfig::loopback();
     b.endpoints.advertise = "10.0.0.6".into();
 
     assert_ne!(