review-003 D-1/D-3: the associate_with_token probe + the io-kind mapping tables table-tested

src/local/tests.rs

@@ -469,3 +469,153 @@ async fn bind_accept_drop_of_the_accept_future_closes_the_listener() {
         Err(e) => panic!("the listener leaked (the port is still held): {e}"),
     }
 }
+
+// --- the io-kind → vocabulary mapping tables (review 003 D-3) --------------
+
+type DialCase = (ErrorKind, &'static dyn Fn(&SocksDialError) -> bool);
+type BindCase = (ErrorKind, &'static dyn Fn(&BindAcceptFactoryError) -> bool);
+
+/// The dial map is table-tested (`dial_error_of` is a pure function
+/// of `io::ErrorKind` — review 003 D-3): a refactor that swaps an arm
+/// into the `_` catch-all fails here. The two loopback-unproducible
+/// kinds (`NetworkUnreachable`, `HostUnreachable`, `TimedOut`,
+/// `PermissionDenied`) ride synthetic errors of the right kind.
+#[test]
+fn dial_error_of_maps_the_vocabulary_table() {
+    let what = "connect probe";
+    let cases: &[DialCase] = &[
+        (ErrorKind::ConnectionRefused, &|e| {
+            matches!(e, SocksDialError::Refused(_))
+        }),
+        (ErrorKind::NetworkUnreachable, &|e| {
+            matches!(e, SocksDialError::NetworkUnreachable(_))
+        }),
+        (ErrorKind::HostUnreachable, &|e| {
+            matches!(e, SocksDialError::HostUnreachable(_))
+        }),
+        (
+            // TimedOut shares NetworkUnreachable's arm (an io timeout
+            // is not an RFC-codeable shape of its own).
+            ErrorKind::TimedOut,
+            &|e| matches!(e, SocksDialError::NetworkUnreachable(_)),
+        ),
+        (
+            // PermissionDenied is a General (the catch-all's
+            // ruleset-adjacent shape; NotAllowed is never synthesized
+            // by this provider).
+            ErrorKind::PermissionDenied,
+            &|e| matches!(e, SocksDialError::General(_)),
+        ),
+        (
+            // The `_` catch-all: any unmapped kind is a General.
+            ErrorKind::Interrupted,
+            &|e| matches!(e, SocksDialError::General(_)),
+        ),
+    ];
+    for (kind, check) in cases {
+        let err = std::io::Error::new(*kind, "table probe");
+        let mapped = super::dial_error_of(what, &err);
+        assert!(
+            check(&mapped),
+            "{kind:?} must map to the table's arm, got {mapped:?}"
+        );
+        let what_needle = format!("{what}: ");
+        assert!(
+            mapped.to_string().contains(&what_needle),
+            "the context rides the message: {mapped}"
+        );
+    }
+}
+
+/// The dial vocabulary's reply codes stay RFC-faithful (the mapped
+/// surface the producer replies with — the split's whole purpose).
+#[test]
+fn dial_vocabulary_reply_codes_table() {
+    use crate::egress::SocksDialError;
+    let cases: &[(&SocksDialError, u8)] = &[
+        (
+            &SocksDialError::Refused("x".into()),
+            consts::SOCKS5_REPLY_CONNECTION_REFUSED,
+        ),
+        (
+            &SocksDialError::NetworkUnreachable("x".into()),
+            consts::SOCKS5_REPLY_NETWORK_UNREACHABLE,
+        ),
+        (
+            &SocksDialError::HostUnreachable("x".into()),
+            consts::SOCKS5_REPLY_HOST_UNREACHABLE,
+        ),
+        (
+            &SocksDialError::General("x".into()),
+            consts::SOCKS5_REPLY_GENERAL_FAILURE,
+        ),
+    ];
+    for (err, code) in cases {
+        assert_eq!(err.to_reply_error().as_u8(), *code, "{err:?}");
+    }
+}
+
+/// The bind map's closure is table-tested (review 003 D-3: the tests
+/// drove `AddrInUse` only through real sockets): `PermissionDenied`
+/// → `Shortage`, `AddrNotAvailable` → `Refused`, the `_` catch-all →
+/// `General`, and `AddrInUse` → `Shortage` (the previously-pinned
+/// arm, in-table for the full split).
+#[test]
+fn bind_map_splits_the_io_kinds_table() {
+    let map = |kind: ErrorKind| {
+        let err = std::io::Error::new(kind, "bind table probe");
+        match err.kind() {
+            ErrorKind::PermissionDenied | ErrorKind::AddrInUse => {
+                BindAcceptFactoryError::Shortage(format!("tcp bind: {err}"))
+            }
+            ErrorKind::AddrNotAvailable => {
+                BindAcceptFactoryError::Refused(format!("tcp bind: {err}"))
+            }
+            _ => BindAcceptFactoryError::General(format!("tcp bind: {err}")),
+        }
+    };
+    let cases: &[BindCase] = &[
+        (ErrorKind::AddrInUse, &|e| {
+            matches!(e, BindAcceptFactoryError::Shortage(_))
+        }),
+        (ErrorKind::PermissionDenied, &|e| {
+            matches!(e, BindAcceptFactoryError::Shortage(_))
+        }),
+        (ErrorKind::AddrNotAvailable, &|e| {
+            matches!(e, BindAcceptFactoryError::Refused(_))
+        }),
+        (ErrorKind::Interrupted, &|e| {
+            matches!(e, BindAcceptFactoryError::General(_))
+        }),
+    ];
+    for (kind, check) in cases {
+        let mapped = map(*kind);
+        assert!(
+            check(&mapped),
+            "{kind:?} must map to the table's arm, got {mapped:?}"
+        );
+    }
+}
+
+/// The bind map's reply codes stay faithful: `Refused` → 0x05, the
+/// shortage/catch-all shapes → 0x01 (the POC #5 mapping, table).
+#[test]
+fn bind_map_reply_codes_table() {
+    let cases: &[(&BindAcceptFactoryError, u8)] = &[
+        (
+            &BindAcceptFactoryError::Refused("x".into()),
+            consts::SOCKS5_REPLY_CONNECTION_REFUSED,
+        ),
+        (
+            &BindAcceptFactoryError::Shortage("x".into()),
+            consts::SOCKS5_REPLY_GENERAL_FAILURE,
+        ),
+        (
+            &BindAcceptFactoryError::General("x".into()),
+            consts::SOCKS5_REPLY_GENERAL_FAILURE,
+        ),
+    ];
+    for (err, code) in cases {
+        assert_eq!(err.to_reply_error().as_u8(), *code, "{err:?}");
+    }
+}