Allow 'Internet' for data providers IP

data_safe_haven/config/config_sections.py

@@ -57,7 +57,7 @@ class ConfigSectionSRE(BaseModel, validate_assignment=True):
     admin_email_address: EmailAddress
     admin_ip_addresses: list[IpAddress] = []
     databases: UniqueList[DatabaseSystem] = []
-    data_provider_ip_addresses: list[IpAddress] = []
+    data_provider_ip_addresses: list[IpAddress] | AzureServiceTag = []
     remote_desktop: ConfigSubsectionRemoteDesktopOpts
     research_user_ip_addresses: list[IpAddress] | AzureServiceTag = []
     storage_quota_gb: ConfigSubsectionStorageQuotaGB
@@ -67,8 +67,6 @@ class ConfigSectionSRE(BaseModel, validate_assignment=True):
 
     @field_validator(
         "admin_ip_addresses",
-        "data_provider_ip_addresses",
-        # "research_user_ip_addresses",
         mode="after",
     )
     @classmethod
@@ -81,6 +79,7 @@ def ensure_non_overlapping(cls, v: list[IpAddress]) -> list[IpAddress]:
         return v
 
     @field_validator(
+        "data_provider_ip_addresses",
         "research_user_ip_addresses",
         mode="after",
     )

data_safe_haven/validators/validators.py

@@ -124,7 +124,7 @@ def ip_address(ip_address: str) -> str:
     try:
         return str(ipaddress.ip_network(ip_address))
     except Exception as exc:
-        msg = "Expected valid IPv4 address, for example '1.1.1.1', or 'Internet'."
+        msg = "Expected valid IPv4 address, for example '1.1.1.1'."
         raise ValueError(msg) from exc
 
 

tests/config/test_config_sections.py

@@ -170,6 +170,24 @@ def test_all_databases_must_be_unique(self) -> None:
                 databases=[DatabaseSystem.POSTGRESQL, DatabaseSystem.POSTGRESQL],
             )
 
+    def test_data_provider_tag_internet(
+        self,
+        config_subsection_remote_desktop: ConfigSubsectionRemoteDesktopOpts,
+        config_subsection_storage_quota_gb: ConfigSubsectionStorageQuotaGB,
+    ):
+        sre_config = ConfigSectionSRE(
+            admin_email_address="[email protected]",
+            remote_desktop=config_subsection_remote_desktop,
+            storage_quota_gb=config_subsection_storage_quota_gb,
+            data_provider_ip_addresses="Internet",
+        )
+        assert isinstance(sre_config.data_provider_ip_addresses, AzureServiceTag)
+        assert sre_config.data_provider_ip_addresses == "Internet"
+
+    def test_data_provider_tag_invalid(self):
+        with pytest.raises(ValueError, match="Input should be 'Internet'"):
+            ConfigSectionSRE(data_provider_ip_addresses="Not a tag")
+
     def test_ip_overlap_admin(self):
         with pytest.raises(ValueError, match="IP addresses must not overlap."):
             ConfigSectionSRE(

tests/validators/test_validators.py

@@ -111,7 +111,7 @@ def test_ip_address(self, ip_address, output):
     def test_ip_address_fail(self, ip_address):
         with pytest.raises(
             ValueError,
-            match="Expected valid IPv4 address, for example '1.1.1.1', or 'Internet'.",
+            match="Expected valid IPv4 address, for example '1.1.1.1'.",
         ):
             validators.ip_address(ip_address)