feat: close the non-trailing parity rows (matrix gaps 24, 29, 30, 33, 41)

[rennf93]

Summary

The five PARTIAL/MISSING rows that do NOT map to the four trailing root causes, closed so the matrix reaches zero PARTIAL/MISSING:

• Gap 24 (A4 ban-list migration): IPBanManager.initializeRedis ports _ipban_migration.py - scan_iter over {prefix}banned_ips:*, the canonicalizeIp twin (bracket stripping, IPv6 compression, IPv4-mapped collapse), expired legacy keys deleted, the canonical key keeping the longer TTL, legacy key always removed, every failure a warning.
• Gap 29 (A3 route_config_revision): BaseSecurityDecorator.routeConfigRevision - the reference revision counter, bumped on every route-config mutation seam (counter held in a module WeakMap so the mixin-composed anonymous class types keep clean declaration emit).
• Gap 30 (A8 check_ip_access): standalone checkIpAccess with the IpAccessResult detail verdict (reason + cloudProvider/network), the unknown-identity allowlist arms, whitelist-skips-countries propagation, the reference error semantics, and the cloud tier as an injected CloudHandler (the reference singleton read becomes DI).
• Gap 33 (D15 handler exports): all eight manager classes plus canonicalizeIp exported from the package root.
• Gap 41 (B12 nestjs CORS): configureCors + buildOriginAllowlist in the nestjs adapter - the host-express preflight seam with the CodeQL-safe explicit allowlist predicate; the cors package rides as an optional peer with devDeps for tests.

Matrix rows flipped

• A4 ban-list migration: MISSING sub-item -> FULL
• A3 route_config_revision: PARTIAL -> FULL
• A8 check_ip_access: PARTIAL -> FULL
• A-layer/D15 handler-manager exports: PARTIAL (gap 33) -> FULL
• B12 nestjs CORS: IDIOM/PARTIAL (gap 41) -> FULL

Tests

• packages/core/tests/test-core/parity-closure-rows.test.ts (26 tests): migration arms against a scripted Redis client, revision counter, every checkIpAccess tier, root-export parity.
• packages/nestjs/tests/cors.test.ts (6 tests): registration, allow-origin reflection, preflight method/header mapping, allowlist denials, the install-hint failure arm.

Gates

• turbo lint/build/test 10/10; core coverage 100/100/100 lines/functions/statements, 97.16% branches; nestjs coverage 100%; pnpm audit 0 unignored

Stacked on #112 (#109 -> #110 -> #111 -> #112 -> this); merge in order.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 03063255-ed23-4f6b-99ae-cc6a8e735b5d

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}