backend: a bare * in subdomain_expansions means every subdomain

An expansion list of labels guesses which subdomains exist; a '*' entry
makes the guess unnecessary. parse_expansions now reports (labels, wildcard,
rejected) instead of silently keeping junk, expand_entry keeps the base
domain plus the configured labels and leaves '*.base' as a pattern when the
wildcard is on, and the policy grows the 'allowed' masks the desktop
resolver needs to serve exceptions.

backend/tests/test_blocker.py

@@ -95,3 +95,71 @@ def test_app_masks_are_passed_through_untouched(session, settings):
     settings_service.save_settings(session, settings)
     policy = blocker_service.policy(session, settings)
     assert policy["apps"] == ["steam*", "*discord*"]
+
+
+def test_a_wildcard_means_every_subdomain(session, settings):
+    """`*` in the expansion list is the user asking for all of them.
+
+    It used to be refused (it is not a DNS label), which left `*.telegram.org`
+    expanded to just the bare domain with a red banner beside it. Now the labels
+    still expand, the pattern is handed to the clients that can match masks, and
+    only entries that are neither a label nor `*` are refused.
+    """
+    settings.blocker.blocked_domains = ["*.telegram.org"]
+    settings.blocker.subdomain_expansions = ["*", "web", "", "not a label"]
+
+    expansion = blocker_service.parse_expansions(settings.blocker.subdomain_expansions)
+    assert expansion.labels == ["web"]
+    assert expansion.wildcard is True
+    assert expansion.rejected == ["not a label"]
+
+    hosts = blocker_service.expand_domains(settings)
+    assert hosts == ["telegram.org", "web.telegram.org"]
+    assert not any("*" in host for host in hosts)
+
+    # The pattern comes back too: a hosts file cannot say "every subdomain", so
+    # the desktop app's resolver stub and the phone's URL matcher take it.
+    assert blocker_service.unexpandable_masks(settings) == ["*.telegram.org"]
+
+
+def test_without_a_wildcard_the_pattern_stays_in_the_expansion_list(session, settings):
+    """`*.x.com` alone means the configured labels, not a wildcard — nothing else."""
+    settings.blocker.blocked_domains = ["*.google.com"]
+    settings.blocker.subdomain_expansions = ["www", "mail"]
+
+    assert blocker_service.unexpandable_masks(settings) == []
+    assert blocker_service.expand_domains(settings) == [
+        "google.com",
+        "www.google.com",
+        "mail.google.com",
+    ]
+
+
+def test_the_policy_reports_expansions_it_had_to_refuse(session, settings):
+    settings.blocker.enabled = True
+    settings.blocker.mode = "always"
+    settings.blocker.blocked_domains = ["*.telegram.org"]
+    settings.blocker.subdomain_expansions = ["*", ".."]
+
+    result = blocker_service.policy(session, settings)
+    assert result["invalid_expansions"] == [".."]
+    assert result["domains"] == ["telegram.org"]
+    assert result["unexpandable"] == ["*.telegram.org"]
+
+
+def test_the_policy_carries_the_allow_masks_for_the_stub(session, settings):
+    """The desktop app answers DNS for a whole zone, so it needs the exceptions.
+
+    Without them the resolver stub would sinkhole `music.youtube.com` along with
+    everything else under a wildcarded domain — an exception that works over the
+    hosts file but not over DNS is an exception nobody will trust.
+    """
+    settings.blocker.enabled = True
+    settings.blocker.mode = "always"
+    settings.blocker.blocked_domains = ["*.youtube.com"]
+    settings.blocker.allowed_domains = [" music.youtube.com ", "*.docs.google.com"]
+
+    result = blocker_service.policy(session, settings)
+    assert result["allowed"] == ["music.youtube.com", "*.docs.google.com"]
+    assert "music.youtube.com" not in result["domains"]
+    assert "m.youtube.com" in result["all_domains"]