package httpclient

import (
	"net"
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestCheckURL_RejectsLoopback(t *testing.T) {
	err := CheckURL("http://127.0.0.1:8080/path")
	if err == nil {
		t.Fatal("expected error for loopback URL")
	}
}

func TestCheckURL_RejectsLinkLocal(t *testing.T) {
	err := CheckURL("http://169.254.169.254/latest/meta-data")
	if err == nil {
		t.Fatal("expected error for link-local URL")
	}
}

func TestCheckURL_AllowsAllowlisted(t *testing.T) {
	err := CheckURL("http://127.0.0.1:8080", "127.0.0.1")
	if err != nil {
		t.Fatalf("expected allowlisted host to pass: %v", err)
	}
	if !matchAllowedHost("rm.example.com", "*.example.com") {
		t.Fatal("expected *.example.com to match rm.example.com")
	}
}

func TestCheckURL_RejectsBadScheme(t *testing.T) {
	cases := []string{"file:///etc/passwd", "gopher://x", "ftp://x"}
	for _, raw := range cases {
		err := CheckURL(raw)
		if err == nil {
			t.Errorf("expected error for %q", raw)
		}
	}
}

func TestCheckURL_RejectsEmptyHost(t *testing.T) {
	err := CheckURL("http:///path")
	if err == nil {
		t.Fatal("expected error for URL with empty host")
	}
}

func TestCheckURL_AcceptsPublic(t *testing.T) {
	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer srv.Close()

	err := CheckURL(srv.URL, "127.0.0.1")
	if err != nil {
		t.Fatalf("expected allowlisted server URL to pass: %v", err)
	}
}

func TestIsPrivateIP(t *testing.T) {
	cases := []struct {
		ip   string
		want bool
	}{
		{"10.1.2.3", true},
		{"8.8.8.8", false},
		{"::1", true},
		{"2001:db8::1", false},
	}
	for _, tc := range cases {
		got := isPrivateIP(net.ParseIP(tc.ip))
		if got != tc.want {
			t.Errorf("isPrivateIP(%q) = %v, want %v", tc.ip, got, tc.want)
		}
	}
}