# Trouve-KA — tests de prévention SSRF
# Author: Simon-Pierre Boucher
# Contact: contact@spboucher.ai

from trouveka.shared import is_safe_ip, is_safe_url


def test_blocks_loopback_and_private():
    for ip in ("127.0.0.1", "10.0.0.5", "192.168.2.10", "172.16.0.1", "0.0.0.0", "::1", "fc00::1"):
        assert not is_safe_ip(ip), ip


def test_blocks_link_local_and_metadata():
    assert not is_safe_ip("169.254.169.254")
    assert not is_safe_ip("169.254.1.1")
    assert not is_safe_ip("fe80::1")


def test_allows_public_ips():
    assert is_safe_ip("142.226.10.10")
    assert is_safe_ip("2607:f8b0::1")


def test_blocks_localhost_and_schemes():
    assert not is_safe_url("http://localhost/admin", resolve=False)
    assert not is_safe_url("http://foo.localhost/x", resolve=False)
    assert not is_safe_url("http://metadata.google.internal/", resolve=False)
    assert not is_safe_url("file:///etc/passwd", resolve=False)
    assert not is_safe_url("gopher://x.ca", resolve=False)


def test_blocks_ip_literal_urls():
    assert not is_safe_url("http://127.0.0.1:8080/", resolve=False)
    assert not is_safe_url("http://169.254.169.254/latest/meta-data/", resolve=False)
    assert not is_safe_url("http://[::1]/", resolve=False)


def test_allows_normal_url_without_resolution():
    assert is_safe_url("https://www.quebec.ca/", resolve=False)