blocker: an exception reads like a block, so make it behave like one

`youtube.com` on the block list catches `music.youtube.com` — a plain entry
covers its subtree. `youtube.com` on the *allow* list caught only itself,
because exceptions were glob-matched whatever they looked like and a plain name
has no metacharacters. The same text in two boxes of the same form meant a
subtree in one and a single hostname in the other, with nothing in the UI
saying so.

A plain exception now covers its subdomains; a masked one is glob-matched
exactly as before, which is still how you spare something narrower than a whole
subtree (`docs.*`, `*.docs.google.com`).

Three enforcers decide this and all three had to move together, or an exception
would work in the browser and not at the resolver: `blocker_service.is_allowed`,
`:core`'s `isAllowed`, and the desktop DNS stub's own allow check, which was
reusing the generic glob matcher. Parity tests on both sides, plus the two
sentences in the web UI and the README that promised the old behaviour.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/services/blocker_service.py

@@ -74,9 +74,34 @@ def parse_expansions(raw: list[str]) -> Expansion:
     return Expansion(labels=labels, wildcard=wildcard, rejected=rejected)
 
 
+#: What makes an entry a mask rather than a name, `fnmatch`'s own metacharacters.
+_WILDCARDS = "*?["
+
+
+def is_mask(entry: str) -> bool:
+    return any(char in entry for char in _WILDCARDS)
+
+
 def is_allowed(host: str, allow_masks: list[str]) -> bool:
-    """Whether an allow-list entry (plain or masked) covers this hostname."""
-    return any(fnmatch(host, mask) for mask in allow_masks)
+    """Whether an allow-list entry (plain or masked) covers this hostname.
+
+    A plain entry covers itself *and its subdomains*, which is the same rule a
+    plain entry follows on the block side — `youtube.com` blocked catches
+    `music.youtube.com`. It did not used to: an exception was glob-matched, so a
+    plain one meant exactly one hostname while a plain block meant a subtree, and
+    the two halves of one list read the same and behaved differently.
+
+    A masked entry is glob-matched as it always was, so `docs.*` and
+    `*.docs.google.com` are unchanged — and still the way to allow something
+    *narrower* than a subtree.
+    """
+    for mask in allow_masks:
+        if is_mask(mask):
+            if fnmatch(host, mask):
+                return True
+        elif host == mask or host.endswith(f".{mask}"):
+            return True
+    return False
 
 
 def expand_entry(raw: str, expansion: Expansion) -> tuple[list[str], str | None]:

backend/tests/test_blocker.py

@@ -70,6 +70,32 @@ def test_masked_subdomains_are_expanded(session, settings):
     assert hosts == ["google.com", "www.google.com", "mail.google.com"]
 
 
+def test_a_plain_exception_covers_its_subdomains_like_a_plain_block_does(session, settings):
+    """The two halves of one list have to read the same way.
+
+    `youtube.com` on the block list catches `music.youtube.com`. For a long time
+    `youtube.com` on the *allow* list caught only itself, because exceptions were
+    glob-matched — so the same text meant a subtree in one box and one hostname
+    in the other, with nothing saying so.
+    """
+    settings.blocker.blocked_domains = ["*.youtube.com", "reddit.com"]
+    settings.blocker.subdomain_expansions = ["www", "m", "music"]
+    settings.blocker.allowed_domains = ["youtube.com"]
+
+    hosts = blocker_service.expand_domains(settings)
+
+    assert hosts == ["reddit.com", "www.reddit.com", "m.reddit.com"]
+    assert blocker_service.is_allowed("music.youtube.com", ["youtube.com"])
+    assert not blocker_service.is_allowed("notyoutube.com", ["youtube.com"])
+
+
+def test_a_masked_exception_is_still_a_glob(session, settings):
+    """Which is how you allow something narrower than a whole subtree."""
+    assert blocker_service.is_allowed("docs.google.com", ["docs.*"])
+    assert blocker_service.is_allowed("a.docs.google.com", ["*.docs.google.com"])
+    assert not blocker_service.is_allowed("sheets.google.com", ["docs.*"])
+
+
 def test_allow_masks_carve_holes_in_block_masks(session, settings):
     settings.blocker.blocked_domains = ["*.google.com", "reddit.com"]
     settings.blocker.subdomain_expansions = ["www", "docs"]