fix: Migrate missing fixes from dev-1.2.7 (#619)

* fix: Migrate missing fixes from dev-1.2.7

NOW-713: Update OpenDNS Family Shield IPs
- Changed from 208.67.222.123/208.67.220.123 to 208.67.222.222/208.67.220.220
- Updated service, test data, and test assertions

QUALITY-439: Allow /31 subnet masks for WAN Static IP
- Added max: 31 parameter to SubnetMaskValidator in:
  - internet_settings_form_validator.dart
  - pnp_static_ip_view.dart

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

* fix: Address Qodo review feedback

- Add /31 subnet mask tests for QUALITY-439
  - Test validates /31 mask (255.255.255.254) accepted with max: 31
  - Test validates /31 mask rejected with default max (30)

- Update spec documents with new OpenDNS IPs (NOW-713)
  - spec.md: Update assumptions section
  - contracts/instant_safety_service_contract.md: Update DNS constants and examples

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Author: AustinChangLinksys

lib/page/advanced_settings/internet_settings/utils/internet_settings_form_validator.dart

@@ -43,7 +43,8 @@ class InternetSettingsFormValidator {
     if (value == null || value.isEmpty) {
       return ValidationError.invalidSubnetMask;
     }
-    final subnetMaskValidator = SubnetMaskValidator();
+    // QUALITY-439: Override default max (30) to allow /31 subnet masks for WAN Static IP
+    final subnetMaskValidator = SubnetMaskValidator(max: 31);
     if (subnetMaskValidator.validate(value)) {
       return null;
     } else {

lib/page/instant_safety/services/instant_safety_service.dart

@@ -49,8 +49,9 @@ class InstantSafetyService {
 
   // DNS Configuration Constants
   static const _fortinetDns1 = '208.91.114.155';
-  static const _openDnsDns1 = '208.67.222.123';
-  static const _openDnsDns2 = '208.67.220.123';
+  // NOW-713: Updated OpenDNS Family Shield IPs
+  static const _openDnsDns1 = '208.67.222.222';
+  static const _openDnsDns2 = '208.67.220.220';
 
   /// Fetches current safe browsing configuration from router.
   ///

lib/page/instant_setup/troubleshooter/views/isp_settings/pnp_static_ip_view.dart

@@ -34,7 +34,8 @@ class _PnpStaticIpViewState extends ConsumerState<PnpStaticIpView> {
   var _hasExtraDNS = false;
   bool _isLoading = false;
 
-  final subnetMaskValidator = SubnetMaskValidator();
+  // QUALITY-439: Override default max (30) to allow /31 subnet masks for WAN Static IP
+  final subnetMaskValidator = SubnetMaskValidator(max: 31);
   final ipAddressValidator = IpAddressValidator();
   final requiredIpAddressValidator = IpAddressRequiredValidator();
   String? _ipError;

specs/009-instant-safety-service/contracts/instant_safety_service_contract.md

@@ -125,7 +125,7 @@ Future<void> saveSettings(InstantSafetyType safeBrowsingType) async
 1. Validates cached LAN settings exist (throws `InvalidInputError` if not)
 2. Constructs DHCP settings with appropriate DNS servers based on type:
    - `fortinet`: DNS1=208.91.114.155
-   - `openDNS`: DNS1=208.67.222.123, DNS2=208.67.220.123
+   - `openDNS`: DNS1=208.67.222.222, DNS2=208.67.220.220
    - `off`: Clear all DNS servers
 3. Calls `setLANSettings` JNAP action
 4. Allows `JNAPSideEffectError` to propagate (handled by UI layer)
@@ -191,7 +191,7 @@ InstantSafetyType _determineSafeBrowsingType(RouterLANSettings lanSettings)
 final dnsServer1 = lanSettings.dhcpSettings.dnsServer1;
 if (dnsServer1 == '208.91.114.155') {
   return InstantSafetyType.fortinet;
-} else if (dnsServer1 == '208.67.222.123') {
+} else if (dnsServer1 == '208.67.222.222') {
   return InstantSafetyType.openDNS;
 } else {
   return InstantSafetyType.off;
@@ -225,9 +225,9 @@ Private constants within service:
 // Fortinet Safe Browsing DNS
 static const _fortinetDns1 = '208.91.114.155';
 
-// OpenDNS Family Shield
-static const _openDnsDns1 = '208.67.222.123';
-static const _openDnsDns2 = '208.67.220.123';
+// OpenDNS Family Shield (NOW-713: Updated IPs)
+static const _openDnsDns1 = '208.67.222.222';
+static const _openDnsDns2 = '208.67.220.220';
 ```
 
 ---

specs/009-instant-safety-service/spec.md

@@ -115,6 +115,6 @@ The system determines whether the router hardware/firmware supports Fortinet saf
 ## Assumptions
 
 - The existing `PreservableNotifierMixin` pattern will continue to be used for dirty state management
-- DNS server IP addresses for Fortinet (208.91.114.155) and OpenDNS (208.67.222.123, 208.67.220.123) are fixed and do not require configuration
+- DNS server IP addresses for Fortinet (208.91.114.155) and OpenDNS Family Shield (208.67.222.222, 208.67.220.220) are fixed and do not require configuration
 - The compatibility map for Fortinet support (currently empty) will remain managed within the service layer
 - The InstantSafety feature currently has no unit tests, so new tests will be created from scratch

test/mocks/test_data/instant_safety_test_data.dart

@@ -7,8 +7,9 @@ import 'package:privacy_gui/core/jnap/result/jnap_result.dart';
 class InstantSafetyTestData {
   // DNS Configuration Constants (matching service)
   static const fortinetDns1 = '208.91.114.155';
-  static const openDnsDns1 = '208.67.222.123';
-  static const openDnsDns2 = '208.67.220.123';
+  // NOW-713: Updated OpenDNS Family Shield IPs
+  static const openDnsDns1 = '208.67.222.222';
+  static const openDnsDns2 = '208.67.220.220';
 
   /// Create default LAN settings response with no safe browsing configured
   static JNAPSuccess createLANSettingsSuccess({

test/page/instant_safety/services/instant_safety_service_test.dart

@@ -224,8 +224,9 @@ void main() {
 
       final data = captured.first as Map<String, dynamic>;
       final dhcpSettings = data['dhcpSettings'] as Map<String, dynamic>;
-      expect(dhcpSettings['dnsServer1'], '208.67.222.123');
-      expect(dhcpSettings['dnsServer2'], '208.67.220.123');
+      // NOW-713: Updated OpenDNS Family Shield IPs
+      expect(dhcpSettings['dnsServer1'], '208.67.222.222');
+      expect(dhcpSettings['dnsServer2'], '208.67.220.220');
     });
 
     test('with off clears DNS servers', () async {

test/validator_rules/input_validators_test.dart

@@ -378,6 +378,19 @@ void main() {
       expect(validator.validate(invalidMask2), false);
     });
 
+    // QUALITY-439: Test /31 subnet mask support for WAN Static IP
+    test('validate method - /31 subnet mask with max: 31', () {
+      final validator = SubnetMaskValidator(max: 31);
+      const mask31 = '255.255.255.254'; // /31 subnet mask
+      expect(validator.validate(mask31), true);
+    });
+
+    test('validate method - /31 subnet mask rejected with default max', () {
+      final validator = SubnetMaskValidator(); // default max is 30
+      const mask31 = '255.255.255.254'; // /31 subnet mask
+      expect(validator.validate(mask31), false);
+    });
+
     test('validate method - invalid subnet mask (leading whitespace)', () {
       final validator = SubnetMaskValidator();
       const invalidMask = ' 255.255.255.128';