more stuff

internal/acl/acl_test.go

@@ -381,6 +381,12 @@ func TestMatchPTRLabelBoundary(t *testing.T) {
 		{"empty suffix", "host.example.com.", "", false},
 		{"empty name", "", "example.com.", false},
 		{"a hyphen is not a label boundary", "host-example.com.", "example.com.", false},
+		// The console suggests ".lan" as a suffix; the leading dot was being
+		// counted as part of the label, so it never matched anything.
+		{"leading-dot suffix matches a name under it", "host.lan.", ".lan.", true},
+		{"leading-dot suffix matches deeper names", "a.b.lan.", ".lan.", true},
+		{"leading-dot suffix does not match the apex", "lan.", ".lan.", false},
+		{"leading-dot suffix still respects the label", "hostlan.", ".lan.", false},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {