refactor: split squid-config.test.ts (1,964 lines) into 4 domain-focused test files

CLAUDE.md

@@ -259,7 +259,7 @@ The firewall implements comprehensive logging at two levels:
 
 - `src/squid-config.ts` - Generates Squid config with custom `firewall_detailed` logformat
 - `containers/agent/setup-iptables.sh` - Configures iptables LOG rules for rejected traffic
-- `src/squid-config.test.ts` - Tests for logging configuration
+- `src/squid-config-features.test.ts` - Tests for logging configuration
 
 ### Squid Log Format
 
@@ -293,7 +293,7 @@ Both use `--log-uid` flag to capture process UID.
 
 Run tests:
 ```bash
-npm test -- squid-config.test.ts
+npm test -- squid-config-features.test.ts
 ```
 
 Manual testing:

src/domain-patterns.test.ts

@@ -5,6 +5,7 @@ import {
   parseDomainList,
   isDomainMatchedByPattern,
   parseDomainWithProtocol,
+  DOMAIN_CHAR_PATTERN,
 } from './domain-patterns';
 
 describe('parseDomainWithProtocol', () => {
@@ -94,8 +95,7 @@ describe('isWildcardPattern', () => {
   });
 });
 
-// Pattern constant for the safer domain character class (matches the implementation)
-const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';
+// Pattern constant imported from domain-patterns.ts (shared source of truth)
 
 describe('wildcardToRegex', () => {
   describe('basic conversions', () => {

src/domain-patterns.ts

@@ -88,7 +88,7 @@ export function isWildcardPattern(domain: string): boolean {
  * Uses character class instead of .* to prevent catastrophic backtracking (ReDoS).
  * Per RFC 1035, valid domain characters are: letters, digits, hyphens, and dots.
  */
-const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';
+export const DOMAIN_CHAR_PATTERN = '[a-zA-Z0-9.-]*';
 
 /**
  * Convert a wildcard pattern to a Squid-compatible regex pattern