"""SSRF guard for autodiscovery (SPEC §10.6)."""

from __future__ import annotations

import pytest

from app.accounts import ssrf
from app.accounts.ssrf import SsrfError, _is_public_ip, assert_host_is_public, guarded_get


@pytest.mark.parametrize(
    "ip,public",
    [
        ("8.8.8.8", True),
        ("1.1.1.1", True),
        ("2606:4700:4700::1111", True),
        ("127.0.0.1", False),
        ("10.0.0.1", False),
        ("192.168.1.1", False),
        ("172.16.5.4", False),
        ("169.254.1.1", False),  # link-local
        ("::1", False),
        ("fe80::1", False),  # link-local v6
        ("0.0.0.0", False),
    ],
)
def test_is_public_ip(ip: str, public: bool) -> None:
    assert _is_public_ip(ip) is public


async def test_assert_host_public_accepts_public(monkeypatch) -> None:  # type: ignore[no-untyped-def]
    async def fake_resolve(_host: str) -> list[str]:
        return ["8.8.8.8"]

    monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
    await assert_host_is_public("mail.example.com")  # no raise


async def test_assert_host_rejects_private(monkeypatch) -> None:  # type: ignore[no-untyped-def]
    async def fake_resolve(_host: str) -> list[str]:
        return ["8.8.8.8", "127.0.0.1"]  # one private address is enough to reject

    monkeypatch.setattr(ssrf, "_resolve_all", fake_resolve)
    with pytest.raises(SsrfError):
        await assert_host_is_public("evil.example.com")


async def test_guarded_get_rejects_non_https() -> None:
    with pytest.raises(SsrfError):
        await guarded_get("http://example.com/config.xml")


async def test_guarded_get_rejects_missing_host() -> None:
    with pytest.raises(SsrfError):
        await guarded_get("https:///config.xml")