import socket

import pytest

from apps.sources.services.url_security import UnsafeUrlError, validate_public_url


def fake_resolver(address: str):
    def resolver(host, port, type=socket.SOCK_STREAM):
        return [(socket.AF_INET, type, 6, "", (address, port))]

    return resolver


@pytest.mark.security
def test_blocks_private_ipv4_after_dns_resolution():
    with pytest.raises(UnsafeUrlError, match="Niet-publiek"):
        validate_public_url("https://jobs.example.org/test", resolver=fake_resolver("10.0.0.5"))


@pytest.mark.security
def test_blocks_loopback_and_embedded_credentials():
    with pytest.raises(UnsafeUrlError):
        validate_public_url("http://127.0.0.1/admin")
    with pytest.raises(UnsafeUrlError):
        validate_public_url("https://user:pass@example.org/")


@pytest.mark.security
def test_accepts_global_address():
    result = validate_public_url(
        "https://jobs.example.org/test", resolver=fake_resolver("93.184.216.34")
    )
    assert result.hostname == "jobs.example.org"