{ lib }:
let
  validate = import ../services/validate-forwards.nix { inherit lib; };
  valid = builtins.fromTOML (builtins.readFile ../ports.toml);
  accepts = data: (builtins.tryEval (builtins.deepSeq (validate data) true)).success;
  extra = entry: valid // { forward = valid.forward ++ [ entry ]; };
  forward = { name = "test"; port = 9999; protocol = "tcp"; };
  invalid = [
    (valid // { dest_default = "10.0.0.2"; })
    (valid // { forward = builtins.filter (f: f.name != "SSH") valid.forward; })
    (valid // { forward = map (f: if f.name == "HTTPS" then f // { dest = "10.0.0.2"; } else f) valid.forward; })
    (extra (forward // { name = "bad\" label"; }))
    (extra (forward // { name = "SSH"; }))
    (extra (forward // { protocol = "sctp"; }))
    (extra (forward // { dest = "10.0.0.5; accept"; }))
    (extra (forward // { dest = "10.0.0.255"; }))
    (extra (forward // { port = 0; }))
    (extra (forward // { port = 65536; }))
    (extra (forward // { ports = "10000-10001"; }))
    (extra { name = "overlap"; ports = "25600-25601"; protocol = "udp"; })
    (extra { name = "backwards"; ports = "9001-9000"; protocol = "udp"; })
  ];
in
assert accepts valid;
assert lib.all (data: !accepts data) invalid;
assert accepts (extra (forward // { port = 443; protocol = "udp"; dest = "10.0.0.2"; }));
"Forward validation: valid inventory and separate protocols accepted; all ${toString (builtins.length invalid)} invalid cases rejected"