From dab3c6c7a08ec79cd33c9411b301e267398f628f Mon Sep 17 00:00:00 2001
From: Ian Foster <ian@vorsk.com>
Date: Sat, 14 Feb 2026 16:07:29 -0800
Subject: [PATCH] fix typescript errors

---
 src/server/utils/firewall.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/server/utils/firewall.ts b/src/server/utils/firewall.ts
index 02b4c4ec..26cff0e5 100644
--- a/src/server/utils/firewall.ts
+++ b/src/server/utils/firewall.ts
@@ -64,7 +64,7 @@ function parseFirewallEntry(entry: string): ParsedEntry {
   // Handle IPv6 with port: [2001:db8::1]:443
   if (remaining.startsWith('[')) {
     const match = remaining.match(/^\[(.+)\]:(\d+)$/);
-    if (match) {
+    if (match && match[1] && match[2]) {
       return {
         ip: match[1],
         port: parseInt(match[2], 10),
@@ -73,7 +73,7 @@ function parseFirewallEntry(entry: string): ParsedEntry {
     }
     // Just bracketed IPv6 without port
     const ipMatch = remaining.match(/^\[(.+)\]$/);
-    if (ipMatch) {
+    if (ipMatch && ipMatch[1]) {
       if (proto) {
         throw new Error(
           `Invalid firewall entry "${entry}": Protocol (/${proto}) requires a port. Use format like "[${ipMatch[1]}]:443/${proto}"`
@@ -203,7 +203,8 @@ export const firewall = {
 
     for (const ipEntry of effectiveIps) {
       const parsed = parseFirewallEntry(ipEntry);
-      const destIsIpv6 = isIPv6(parsed.ip.split('/')[0]); // Handle CIDR by checking base IP
+      const baseIp = parsed.ip.split('/')[0] ?? parsed.ip; // Handle CIDR by checking base IP
+      const destIsIpv6 = isIPv6(baseIp);
 
       if (destIsIpv6) {
         if (enableIpv6) {