fix: allow guarded fetch IPv6 fallback

an2in · an2in · commit fdea545196ae · 2026-07-18T01:04:08.000+07:00
diff --git a/src/infra/net/ssrf.pinning.test.ts b/src/infra/net/ssrf.pinning.test.ts
@@ -51,7 +51,7 @@ describe("ssrf pinning", () => {
     );
   });
 
-  it("keeps automatic pinned lookups on IPv4 when both address families are available", async () => {
+  it("keeps single-address lookups on IPv4 while exposing both families to Happy Eyeballs", async () => {
     const lookup = createPinnedLookup({
       hostname: "api.anthropic.com",
       addresses: ["160.79.104.10", "2607:6bc0::10"],
@@ -89,7 +89,10 @@ describe("ssrf pinning", () => {
         }
       });
     });
-    expect(all).toEqual([{ address: "160.79.104.10", family: 4 }]);
+    expect(all).toEqual([
+      { address: "160.79.104.10", family: 4 },
+      { address: "2607:6bc0::10", family: 6 },
+    ]);
 
     await expect(lookupWithOptions({ family: 6 })).resolves.toEqual({
       address: "2607:6bc0::10",
diff --git a/src/infra/net/ssrf.ts b/src/infra/net/ssrf.ts
@@ -524,10 +524,14 @@ export function createPinnedLookup(params: {
         : {};
     const requestedFamily =
       typeof options === "number" ? options : typeof opts.family === "number" ? opts.family : 0;
+    // Single-address lookups stay IPv4-only when possible, while Happy Eyeballs
+    // receives every validated family so it can fall back when IPv4 is unreachable.
     const candidates =
       requestedFamily === 4 || requestedFamily === 6
         ? records.filter((entry) => entry.family === requestedFamily)
-        : automaticRecords;
+        : opts.all
+          ? records
+          : automaticRecords;
     const usable = candidates.length > 0 ? candidates : automaticRecords;
     if (opts.all) {
       cb(null, usable as LookupAddress[]);
