first commit

tests/test_fail_closed.py

@@ -0,0 +1,26 @@
+"""Fail-closed leak-detection contract tests."""
+from __future__ import annotations
+
+import unittest
+
+from proxy_chain_manager.leak_detect import is_chain_leak, leak_reason
+
+
+class TestFailClosed(unittest.TestCase):
+    def test_unknown_real_ip_is_leak(self) -> None:
+        """When the direct IP could not be determined we cannot prove the
+        chain is forwarding — the README promises fail-closed behavior."""
+        self.assertTrue(is_chain_leak("5.6.7.8", None, vpn_active=False))
+        self.assertTrue(is_chain_leak("5.6.7.8", None, vpn_active=True))
+
+    def test_unknown_exit_ip_is_leak(self) -> None:
+        self.assertTrue(is_chain_leak(None, "1.2.3.4", vpn_active=False))
+
+    def test_leak_reason_explains_unknown_direct_ip(self) -> None:
+        msg = leak_reason("5.6.7.8", None, vpn_active=False)
+        self.assertIn("direct IP", msg)
+        self.assertIn("fail-closed", msg.lower())
+
+
+if __name__ == "__main__":
+    unittest.main()