Fix: Allow global_read_only without requiring zones field

Co-authored-by: rwxd <40308458+rwxd@users.noreply.github.com>

Author: Copilot

powerdns_api_proxy/models.py

@@ -1,7 +1,7 @@
 from functools import lru_cache
 from typing import TypedDict
 
-from pydantic import BaseModel, field_validator
+from pydantic import BaseModel, field_validator, model_validator
 
 from powerdns_api_proxy.logging import logger
 from powerdns_api_proxy.utils import (
@@ -53,7 +53,7 @@ def __init__(self, **data):
 class ProxyConfigEnvironment(BaseModel):
     name: str
     token_sha512: str
-    zones: list[ProxyConfigZone]
+    zones: list[ProxyConfigZone] = []
     global_read_only: bool = False
     global_search: bool = False
     global_tsigkeys: bool = False
@@ -74,6 +74,14 @@ def validate_token(cls, token_sha512):
             raise ValueError("A SHA512 hash must be 128 digits long")
         return token_sha512
 
+    @model_validator(mode='after')
+    def validate_zones_or_global_read_only(self):
+        if not self.zones and not self.global_read_only:
+            raise ValueError(
+                "Either 'zones' must be non-empty or 'global_read_only' must be True"
+            )
+        return self
+
     def __init__(self, **data):
         super().__init__(**data)
         if self.global_read_only:

tests/unit/config_test.py

@@ -595,3 +595,52 @@ def test_tsigkeys_allowed_globally():
     environment = deepcopy(dummy_proxy_environment)
     environment.global_tsigkeys = True
     assert check_pdns_tsigkeys_allowed(environment) is True
+
+
+def test_global_read_only_without_zones():
+    """Test that global_read_only=True allows empty zones list"""
+    env = ProxyConfigEnvironment(
+        name="Test Global Read Only",
+        token_sha512=dummy_proxy_environment_token_sha512,
+        global_read_only=True
+    )
+    assert env.global_read_only is True
+    assert env.zones == []
+
+
+def test_environment_with_neither_zones_nor_global_read_only_fails():
+    """Test that providing neither zones nor global_read_only fails validation"""
+    with pytest.raises(ValueError) as err:
+        ProxyConfigEnvironment(
+            name="test",
+            token_sha512=dummy_proxy_environment_token_sha512
+        )
+    assert "Either 'zones' must be non-empty or 'global_read_only' must be True" in str(err.value)
+
+
+def test_environment_with_empty_zones_and_no_global_read_only_fails():
+    """Test that explicitly providing empty zones without global_read_only fails"""
+    with pytest.raises(ValueError) as err:
+        ProxyConfigEnvironment(
+            name="test",
+            token_sha512=dummy_proxy_environment_token_sha512,
+            zones=[]
+        )
+    assert "Either 'zones' must be non-empty or 'global_read_only' must be True" in str(err.value)
+
+
+def test_proxy_config_with_global_read_only_environment():
+    """Test that ProxyConfig works with global_read_only environment without zones"""
+    config = ProxyConfig(
+        pdns_api_url="https://powerdns-api.example.com",
+        pdns_api_token="blablub",
+        environments=[
+            ProxyConfigEnvironment(
+                name="foo",
+                token_sha512=dummy_proxy_environment_token_sha512,
+                global_read_only=True
+            )
+        ]
+    )
+    assert config.environments[0].global_read_only is True
+    assert config.environments[0].zones == []