testdata: convert .json to .hujson with header comments

Rename all 594 test data files from .json to .hujson and add
descriptive header comments to each file documenting what policy
rules are under test and what outcome is expected.

Update test loaders in all 5 _test.go files to parse HuJSON via
hujson.Parse/Standardize/Pack before json.Unmarshal.

Add cross-dependency warning to via_compat_test.go documenting
that GRANT-V29/V30/V31/V36 are shared with TestGrantsCompat.

Add .gitignore exemption for testdata HuJSON files.

hscontrol/policy/v2/testdata/grant_results/GRANT-A1.hujson

@@ -1,3 +1,8 @@
+// GRANT-A1
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/basic}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-A1",
   "timestamp": "2026-02-23T00:15:55Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-A2.hujson

@@ -1,3 +1,8 @@
+// GRANT-A2
+//
+// Grant:  src=['*'] dst=['*'] app={https://tailscale.com/cap/ingress}
+//
+// Expected: Error (HTTP 400) — capability name must have the form {domain}/{path}
 {
   "test_id": "GRANT-A2",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-A3.hujson

@@ -1,3 +1,8 @@
+// GRANT-A3
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/webui}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-A3",
   "timestamp": "2026-02-23T00:17:41Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-A4.hujson

@@ -1,3 +1,8 @@
+// GRANT-A4
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/relay}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-A4",
   "timestamp": "2026-02-23T00:18:54Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-A5.hujson

@@ -1,3 +1,8 @@
+// GRANT-A5
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/relay-target}
+//
+// Expected: Error (HTTP 400) — capability name must not be in the tailscale.com domain
 {
   "test_id": "GRANT-A5",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-A6.hujson

@@ -1,3 +1,8 @@
+// GRANT-A6
+//
+// Grant:  src=['autogroup:member'] dst=['autogroup:self'] app={tailscale.com/cap/drive}
+//
+// Expected: Rules on user-kris, user-mon, user1
 {
   "test_id": "GRANT-A6",
   "timestamp": "2026-02-23T00:20:13Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-B1.hujson

@@ -1,3 +1,8 @@
+// GRANT-B1
+//
+// Grant:  src=['*'] dst=['tag:server'] app={tailscale.com/cap/kubernetes}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-B1",
   "timestamp": "2026-02-23T00:21:26Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-B2.hujson

@@ -1,3 +1,8 @@
+// GRANT-B2
+//
+// Grant:  src=['*'] dst=['tag:server'] app={tailscale.com/cap/kubernetes}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-B2",
   "timestamp": "2026-02-23T00:22:39Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-B3.hujson

@@ -1,3 +1,8 @@
+// GRANT-B3
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/drive}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-B3",
   "timestamp": "2026-02-23T00:23:52Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-B4.hujson

@@ -1,3 +1,8 @@
+// GRANT-B4
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/drive}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-B4",
   "timestamp": "2026-02-23T00:25:05Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-B5.hujson

@@ -1,3 +1,8 @@
+// GRANT-B5
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/drive}
+//
+// Expected: Rules on 7 nodes
 {
   "test_id": "GRANT-B5",
   "timestamp": "2026-02-23T00:26:19Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C1.hujson

@@ -1,3 +1,8 @@
+// GRANT-C1
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C1",
   "timestamp": "2026-02-23T00:28:11Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C2.hujson

@@ -1,3 +1,8 @@
+// GRANT-C2
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C2",
   "timestamp": "2026-02-23T00:28:28Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C3.hujson

@@ -1,3 +1,8 @@
+// GRANT-C3
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C3",
   "timestamp": "2026-02-23T00:28:45Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C4.hujson

@@ -1,3 +1,8 @@
+// GRANT-C4
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/one,example.com/cap/two}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C4",
   "timestamp": "2026-02-23T00:29:02Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C5.hujson

@@ -1,3 +1,8 @@
+// GRANT-C5
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/complex}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C5",
   "timestamp": "2026-02-23T00:29:18Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-C6.hujson

@@ -1,3 +1,8 @@
+// GRANT-C6
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/array}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-C6",
   "timestamp": "2026-02-23T00:29:35Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D1.hujson

@@ -1,3 +1,8 @@
+// GRANT-D1
+//
+// Grant:  src=['autogroup:member'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D1",
   "timestamp": "2026-02-23T00:29:52Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D2.hujson

@@ -1,3 +1,8 @@
+// GRANT-D2
+//
+// Grant:  src=['autogroup:tagged'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D2",
   "timestamp": "2026-02-23T00:30:09Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D3.hujson

@@ -1,3 +1,8 @@
+// GRANT-D3
+//
+// Grant:  src=['group:admins'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D3",
   "timestamp": "2026-02-23T00:30:25Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D4.hujson

@@ -1,3 +1,8 @@
+// GRANT-D4
+//
+// Grant:  src=['kratail2tid@passkey'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D4",
   "timestamp": "2026-02-23T00:30:42Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D5.hujson

@@ -1,3 +1,8 @@
+// GRANT-D5
+//
+// Grant:  src=['tag:prod'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D5",
   "timestamp": "2026-02-23T00:30:59Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D6.hujson

@@ -1,3 +1,8 @@
+// GRANT-D6
+//
+// Grant:  src=['100.90.199.68'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D6",
   "timestamp": "2026-02-23T00:31:16Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-D7.hujson

@@ -1,3 +1,8 @@
+// GRANT-D7
+//
+// Grant:  src=['autogroup:member', 'tag:prod'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-D7",
   "timestamp": "2026-02-23T00:31:33Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E1.hujson

@@ -1,3 +1,8 @@
+// GRANT-E1
+//
+// Grant:  src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-E1",
   "timestamp": "2026-02-23T00:31:50Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E2.hujson

@@ -1,3 +1,8 @@
+// GRANT-E2
+//
+// Grant:  src=['*'] dst=['tag:server', 'tag:prod'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-prod, tagged-server
 {
   "test_id": "GRANT-E2",
   "timestamp": "2026-02-23T00:32:07Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E3.hujson

@@ -1,3 +1,8 @@
+// GRANT-E3
+//
+// Grant:  src=['*'] dst=['autogroup:self'] app={tailscale.com/cap/drive}
+//
+// Expected: Error (HTTP 400) — autogroup:self can only be used with users, groups, or supported autogroups
 {
   "test_id": "GRANT-E3",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-E4.hujson

@@ -1,3 +1,8 @@
+// GRANT-E4
+//
+// Grant:  src=['*'] dst=['autogroup:member'] app={example.com/cap/test}
+//
+// Expected: Rules on user-kris, user-mon, user1
 {
   "test_id": "GRANT-E4",
   "timestamp": "2026-02-23T00:32:23Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E5.hujson

@@ -1,3 +1,8 @@
+// GRANT-E5
+//
+// Grant:  src=['*'] dst=['autogroup:tagged'] app={example.com/cap/test}
+//
+// Expected: Rules on exit-node, subnet-router, tagged-client, tagged-prod, tagged-server
 {
   "test_id": "GRANT-E5",
   "timestamp": "2026-02-23T00:32:40Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E6.hujson

@@ -1,3 +1,8 @@
+// GRANT-E6
+//
+// Grant:  src=['*'] dst=['group:admins'] app={example.com/cap/test}
+//
+// Expected: Rules on user1
 {
   "test_id": "GRANT-E6",
   "timestamp": "2026-02-23T00:32:57Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E7.hujson

@@ -1,3 +1,8 @@
+// GRANT-E7
+//
+// Grant:  src=['*'] dst=['kratail2tid@passkey'] app={example.com/cap/test}
+//
+// Expected: Rules on user1
 {
   "test_id": "GRANT-E7",
   "timestamp": "2026-02-23T00:33:14Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-E8.hujson

@@ -1,3 +1,8 @@
+// GRANT-E8
+//
+// Grant:  src=['*'] dst=['100.108.74.26'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-E8",
   "timestamp": "2026-02-23T00:33:31Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-F1.hujson

@@ -1,3 +1,8 @@
+// GRANT-F1
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:80', 'tcp:443'] app={tailscale.com/cap/kubernetes}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-F1",
   "timestamp": "2026-02-23T00:33:47Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-F2.hujson

@@ -1,3 +1,8 @@
+// GRANT-F2
+//
+// Grant:  src=['autogroup:member'] dst=['tag:server'] ip=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-F2",
   "timestamp": "2026-02-23T00:34:04Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-F3.hujson

@@ -1,3 +1,10 @@
+// GRANT-F3
+//
+// Grants:
+//   src=['*'] dst=['tag:server'] ip=['tcp:80', 'tcp:443']
+//   src=['*'] dst=['tag:server'] app={tailscale.com/cap/kubernetes}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-F3",
   "timestamp": "2026-02-23T00:34:21Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-F4.hujson

@@ -1,3 +1,8 @@
+// GRANT-F4
+//
+// Grant:  src=['*'] dst=['*'] ip=['tcp:443'] app={tailscale.com/cap/drive,example.com/cap/extra}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-F4",
   "timestamp": "2026-02-23T00:34:38Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G1.hujson

@@ -1,3 +1,10 @@
+// GRANT-G1
+//
+// Grants:
+//   src=['*'] dst=['tag:server'] app={example.com/cap/one}
+//   src=['*'] dst=['tag:server'] app={example.com/cap/two}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-G1",
   "timestamp": "2026-02-23T00:34:55Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G2.hujson

@@ -1,3 +1,10 @@
+// GRANT-G2
+//
+// Grants:
+//   src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//   src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-G2",
   "timestamp": "2026-02-23T00:35:12Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G3.hujson

@@ -1,3 +1,10 @@
+// GRANT-G3
+//
+// Grants:
+//   src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//   src=['tag:client'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-G3",
   "timestamp": "2026-02-23T00:35:28Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G4.hujson

@@ -1,3 +1,10 @@
+// GRANT-G4
+//
+// Grants:
+//   src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//   src=['*'] dst=['tag:server'] ip=['tcp:80']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-G4",
   "timestamp": "2026-02-23T00:35:45Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G5.hujson

@@ -1,3 +1,11 @@
+// GRANT-G5
+//
+// Grants:
+//   src=['*'] dst=['*'] ip=['*']
+//   src=['tag:client'] dst=['tag:server'] app={example.com/cap/test}
+//   src=['autogroup:member'] dst=['tag:server'] ip=['tcp:443']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-G5",
   "timestamp": "2026-02-23T00:36:02Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-G6.hujson

@@ -1,3 +1,10 @@
+// GRANT-G6
+//
+// Grants:
+//   src=['*'] dst=['*'] app={example.com/cap/test}
+//   src=['*'] dst=['tag:server'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-G6",
   "timestamp": "2026-02-23T00:36:19Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-H1.hujson

@@ -1,3 +1,8 @@
+// GRANT-H1
+//
+// Grant:  src=['*'] dst=['*']
+//
+// Expected: Error (HTTP 400) — ip and app can not both be empty
 {
   "test_id": "GRANT-H1",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-H10.hujson

@@ -1,3 +1,8 @@
+// GRANT-H10
+//
+// Grant:  src=['autogroup:self'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Error (HTTP 400) — "autogroup:self" not valid on the src side of a rule
 {
   "test_id": "GRANT-H10",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-H2.hujson

@@ -1,3 +1,8 @@
+// GRANT-H2
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-H2",
   "timestamp": "2026-02-23T00:36:36Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-H3.hujson

@@ -1,3 +1,8 @@
+// GRANT-H3
+//
+// Grant:  src=['*'] dst=['*']
+//
+// Expected: Error (HTTP 400) — ip and app can not both be empty
 {
   "test_id": "GRANT-H3",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-H4.hujson

@@ -1,3 +1,8 @@
+// GRANT-H4
+//
+// Grant:  src=[] dst=['*'] app={example.com/cap/test}
+//
+// Expected: No filter rules on any node
 {
   "test_id": "GRANT-H4",
   "timestamp": "2026-02-23T00:36:53Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-H5.hujson

@@ -1,3 +1,8 @@
+// GRANT-H5
+//
+// Grant:  src=['*'] dst=[] app={example.com/cap/test}
+//
+// Expected: No filter rules on any node
 {
   "test_id": "GRANT-H5",
   "timestamp": "2026-02-23T00:37:10Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-H6.hujson

@@ -1,3 +1,8 @@
+// GRANT-H6
+//
+// Grant:  src=['group:empty'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-H6",
   "timestamp": "2026-02-23T00:37:27Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-H7.hujson

@@ -1,3 +1,8 @@
+// GRANT-H7
+//
+// Grant:  src=['tag:nonexistent'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Error (HTTP 400) — src=tag not found: "tag:nonexistent"
 {
   "test_id": "GRANT-H7",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-H8.hujson

@@ -1,3 +1,8 @@
+// GRANT-H8
+//
+// Grant:  src=['*'] dst=['*']
+//
+// Expected: Error (HTTP 400) — ip and app can not both be empty
 {
   "test_id": "GRANT-H8",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-H9.hujson

@@ -1,3 +1,8 @@
+// GRANT-H9
+//
+// Grant:  src=['*'] dst=['autogroup:self'] app={example.com/cap/test}
+//
+// Expected: Error (HTTP 400) — autogroup:self can only be used with users, groups, or supported autogroups
 {
   "test_id": "GRANT-H9",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-I1.hujson

@@ -1,3 +1,8 @@
+// GRANT-I1
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router'] ip=['*']
+//
+// Expected: Rules on subnet-router
 {
   "test_id": "GRANT-I1",
   "timestamp": "2026-02-23T00:37:45Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-I2.hujson

@@ -1,3 +1,8 @@
+// GRANT-I2
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router'] ip=['tcp:80']
+//
+// Expected: Rules on subnet-router
 {
   "test_id": "GRANT-I2",
   "timestamp": "2026-02-23T00:38:02Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-I3.hujson

@@ -1,3 +1,8 @@
+// GRANT-I3
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router', 'tag:exit'] ip=['*']
+//
+// Expected: Rules on subnet-router
 {
   "test_id": "GRANT-I3",
   "timestamp": "2026-02-23T00:38:18Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-I4.hujson

@@ -1,3 +1,8 @@
+// GRANT-I4
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['autogroup:tagged'] ip=['*']
+//
+// Expected: Error (HTTP 400) — via can only be a tag
 {
   "test_id": "GRANT-I4",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-J1.hujson

@@ -1,3 +1,8 @@
+// GRANT-J1
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:22']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J1",
   "timestamp": "2026-02-23T00:38:36Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J2.hujson

@@ -1,3 +1,8 @@
+// GRANT-J2
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['udp:53']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J2",
   "timestamp": "2026-02-23T00:38:53Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J3.hujson

@@ -1,3 +1,8 @@
+// GRANT-J3
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['*']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J3",
   "timestamp": "2026-02-23T00:39:09Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J4.hujson

@@ -1,3 +1,8 @@
+// GRANT-J4
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:80', 'udp:53', 'tcp:443']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J4",
   "timestamp": "2026-02-23T00:39:26Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J5.hujson

@@ -1,3 +1,8 @@
+// GRANT-J5
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:80-443']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J5",
   "timestamp": "2026-02-23T00:39:43Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J6.hujson

@@ -1,3 +1,8 @@
+// GRANT-J6
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['80']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-J6",
   "timestamp": "2026-02-23T00:40:00Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-J7.hujson

@@ -1,3 +1,8 @@
+// GRANT-J7
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['icmp']
+//
+// Expected: Error (HTTP 400) — port range "icmp": invalid first integer
 {
   "test_id": "GRANT-J7",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K1.hujson

@@ -1,3 +1,9 @@
+// GRANT-K1
+//
+// ACLs:
+//   accept: src=['*'] dst=['*:*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K1",
   "timestamp": "2026-02-23T02:53:51Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K10.hujson

@@ -1,3 +1,8 @@
+// GRANT-K10
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/funnel}
+//
+// Expected: Error (HTTP 400) — capability name must not be in the tailscale.com domain
 {
   "test_id": "GRANT-K10",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K11.hujson

@@ -1,3 +1,8 @@
+// GRANT-K11
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/webui,...} (4 caps)
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K11",
   "timestamp": "2026-02-23T02:55:39Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K12.hujson

@@ -1,3 +1,8 @@
+// GRANT-K12
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router'] app={example.com/cap/subnet-access}
+//
+// Expected: No filter rules on any node
 {
   "test_id": "GRANT-K12",
   "timestamp": "2026-02-23T02:55:55Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K13.hujson

@@ -1,3 +1,8 @@
+// GRANT-K13
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router'] ip=['tcp:80'] app={example.com/cap/subnet-access}
+//
+// Expected: Rules on subnet-router
 {
   "test_id": "GRANT-K13",
   "timestamp": "2026-02-23T02:56:12Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K14.hujson

@@ -1,3 +1,8 @@
+// GRANT-K14
+//
+// Grant:  src=['fd7a:115c:a1e0::c537:c845'] dst=['tag:server'] ip=['tcp:22']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K14",
   "timestamp": "2026-02-23T02:56:28Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K15.hujson

@@ -1,3 +1,8 @@
+// GRANT-K15
+//
+// Grant:  src=['*'] dst=['fd7a:115c:a1e0::b901:4a87'] ip=['tcp:22']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K15",
   "timestamp": "2026-02-23T02:56:45Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K16.hujson

@@ -1,3 +1,10 @@
+// GRANT-K16
+//
+// Grants:
+//   src=['tag:client'] dst=['tag:server'] ip=['tcp:22']
+//   src=['*'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K16",
   "timestamp": "2026-02-23T02:57:02Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K17.hujson

@@ -1,3 +1,10 @@
+// GRANT-K17
+//
+// Grants:
+//   src=['*'] dst=['*'] ip=['*']
+//   src=['tag:client'] dst=['tag:server'] ip=['tcp:22']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K17",
   "timestamp": "2026-02-23T02:57:18Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K18.hujson

@@ -1,3 +1,10 @@
+// GRANT-K18
+//
+// Grants:
+//   src=['*'] dst=['*'] app={example.com/cap/one}
+//   src=['*'] dst=['*'] app={example.com/cap/two}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K18",
   "timestamp": "2026-02-23T02:57:35Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K19.hujson

@@ -1,3 +1,10 @@
+// GRANT-K19
+//
+// Grants:
+//   src=['*'] dst=['*'] app={example.com/cap/test}
+//   src=['*'] dst=['*'] app={example.com/cap/test}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K19",
   "timestamp": "2026-02-23T02:57:52Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K2.hujson

@@ -1,3 +1,8 @@
+// GRANT-K2
+//
+// Grant:  src=['*'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K2",
   "timestamp": "2026-02-23T02:54:08Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K20.hujson

@@ -1,3 +1,8 @@
+// GRANT-K20
+//
+// Grant:  src=['user:*@passkey'] dst=['tag:server'] ip=['tcp:22']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K20",
   "timestamp": "2026-02-23T02:58:08Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K21.hujson

@@ -1,3 +1,8 @@
+// GRANT-K21
+//
+// Grant:  src=['*'] dst=['user:*@passkey'] ip=['tcp:22']
+//
+// Expected: Rules on user-mon, user1
 {
   "test_id": "GRANT-K21",
   "timestamp": "2026-02-23T02:58:30Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K22.hujson

@@ -1,3 +1,8 @@
+// GRANT-K22
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['47']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K22",
   "timestamp": "2026-02-23T02:58:46Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K23.hujson

@@ -1,3 +1,8 @@
+// GRANT-K23
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:0']
+//
+// Expected: Error (HTTP 400) — port range "0": first port must be >0, or use '*' for wildcard
 {
   "test_id": "GRANT-K23",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K24.hujson

@@ -1,3 +1,8 @@
+// GRANT-K24
+//
+// Grant:  src=['*'] dst=['*'] app={example.com/a/b/c/d/e/f}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K24",
   "timestamp": "2026-02-23T02:59:03Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K25.hujson

@@ -1,3 +1,8 @@
+// GRANT-K25
+//
+// Grant:  src=['*'] dst=['*'] app={my-company.internal/cap/access}
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K25",
   "timestamp": "2026-02-23T02:59:19Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K26.hujson

@@ -1,3 +1,8 @@
+// GRANT-K26
+//
+// Grant:  src=['autogroup:member'] dst=['autogroup:member', 'autogroup:tagged'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K26",
   "timestamp": "2026-02-23T02:59:36Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K27.hujson

@@ -1,3 +1,8 @@
+// GRANT-K27
+//
+// Grant:  src=['autogroup:member'] dst=['autogroup:self'] app={example.com/cap/self-service}
+//
+// Expected: Rules on user-kris, user-mon, user1
 {
   "test_id": "GRANT-K27",
   "timestamp": "2026-02-23T02:59:53Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K28.hujson

@@ -1,3 +1,8 @@
+// GRANT-K28
+//
+// Grant:  src=['autogroup:member'] dst=['autogroup:self'] ip=['*'] app={tailscale.com/cap/drive}
+//
+// Expected: Rules on user-kris, user-mon, user1
 {
   "test_id": "GRANT-K28",
   "timestamp": "2026-02-23T03:00:09Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K29.hujson

@@ -1,3 +1,6 @@
+// GRANT-K29
+//
+// Expected: No filter rules on any node
 {
   "test_id": "GRANT-K29",
   "timestamp": "2026-02-23T03:00:26Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K3.hujson

@@ -1,3 +1,9 @@
+// GRANT-K3
+//
+// Grant:  src=['*'] dst=['tag:server'] app={example.com/cap/test}
+// Also has ACLs
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-K3",
   "timestamp": "2026-02-23T02:54:24Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K30.hujson

@@ -1,3 +1,8 @@
+// GRANT-K30
+//
+// Grant:  src=['*'] dst=['10.33.0.0/16'] via=['tag:router', 'tag:nonexistent'] ip=['*']
+//
+// Expected: Error (HTTP 400) — tag "tag:nonexistent" not found
 {
   "test_id": "GRANT-K30",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K4.hujson

@@ -1,3 +1,9 @@
+// GRANT-K4
+//
+// Grant:  src=['*'] dst=['tag:server'] ip=['tcp:80', 'tcp:443']
+// Also has ACLs
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K4",
   "timestamp": "2026-02-23T02:54:40Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K5.hujson

@@ -1,3 +1,11 @@
+// GRANT-K5
+//
+// Grants:
+//   src=['autogroup:member'] dst=['tag:server'] app={tailscale.com/cap/kubernetes}
+//   src=['*'] dst=['10.33.0.0/16'] via=['tag:router'] ip=['*']
+// Also has ACLs
+//
+// Expected: Rules on subnet-router, tagged-server
 {
   "test_id": "GRANT-K5",
   "timestamp": "2026-02-23T02:54:57Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K6.hujson

@@ -1,3 +1,8 @@
+// GRANT-K6
+//
+// Grant:  src=['autogroup:danger-all'] dst=['tag:server'] ip=['tcp:22']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-K6",
   "timestamp": "2026-02-23T02:55:13Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-K7.hujson

@@ -1,3 +1,8 @@
+// GRANT-K7
+//
+// Grant:  src=['*'] dst=['autogroup:danger-all'] ip=['tcp:22']
+//
+// Expected: Error (HTTP 400) — cannot use autogroup:danger-all as a dst
 {
   "test_id": "GRANT-K7",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K8.hujson

@@ -1,3 +1,8 @@
+// GRANT-K8
+//
+// Grant:  src=['autogroup:danger-all'] dst=['autogroup:danger-all'] ip=['*']
+//
+// Expected: Error (HTTP 400) — cannot use autogroup:danger-all as a dst
 {
   "test_id": "GRANT-K8",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-K9.hujson

@@ -1,3 +1,8 @@
+// GRANT-K9
+//
+// Grant:  src=['*'] dst=['*'] app={tailscale.com/cap/ingress}
+//
+// Expected: Error (HTTP 400) — capability name must not be in the tailscale.com domain
 {
   "test_id": "GRANT-K9",
   "description": "",

hscontrol/policy/v2/testdata/grant_results/GRANT-P01_1.hujson

@@ -1,3 +1,8 @@
+// GRANT-P01_1
+//
+// Grant:  src=['*'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-P01_1",
   "timestamp": "2026-02-23T00:42:55Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P01_2.hujson

@@ -1,3 +1,8 @@
+// GRANT-P01_2
+//
+// Grant:  src=['100.90.199.68'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-P01_2",
   "timestamp": "2026-02-23T00:43:12Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P01_3.hujson

@@ -1,3 +1,8 @@
+// GRANT-P01_3
+//
+// Grant:  src=['100.64.0.0/16'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-P01_3",
   "timestamp": "2026-02-23T00:43:29Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P01_4.hujson

@@ -1,3 +1,8 @@
+// GRANT-P01_4
+//
+// Grant:  src=['*'] dst=['100.108.74.26'] ip=['*']
+//
+// Expected: Rules on tagged-server
 {
   "test_id": "GRANT-P01_4",
   "timestamp": "2026-02-23T00:43:46Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P01_5.hujson

@@ -1,3 +1,8 @@
+// GRANT-P01_5
+//
+// Grant:  src=['*'] dst=['100.64.0.0/12'] ip=['*']
+//
+// Expected: No filter rules on any node
 {
   "test_id": "GRANT-P01_5",
   "timestamp": "2026-02-23T00:44:03Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P02_1.hujson

@@ -1,3 +1,8 @@
+// GRANT-P02_1
+//
+// Grant:  src=['kratail2tid@passkey'] dst=['*'] ip=['*']
+//
+// Expected: Rules on 8 nodes
 {
   "test_id": "GRANT-P02_1",
   "timestamp": "2026-02-23T00:44:20Z",

hscontrol/policy/v2/testdata/grant_results/GRANT-P02_2.hujson

@@ -1,3 +1,8 @@
+// GRANT-P02_2
+//
+// Grant:  src=['*'] dst=['kratail2tid@passkey'] ip=['*']
+//
+// Expected: Rules on user1
 {
   "test_id": "GRANT-P02_2",
   "timestamp": "2026-02-23T00:44:36Z",