package edgesfile

import (
	"net"
	"strings"
)

// PrivateAddress validates a box's private address against its region
// network's CIDR blocks (region HA spec 2 §6, census ruling region-ha-2a):
// a well-formed IPv4 address, in a private range, neither loopback nor
// link-local (169.254.0.0/16, the metadata range, included), and inside
// one of cidrs. It returns the address and the block that holds it, both
// canonical, or "", "". The writer publishes only what it passes, and a
// reader dials only what it passes against its own region's network.
func PrivateAddress(addr string, cidrs []string) (string, string) {
	ip := net.ParseIP(strings.TrimSpace(addr))
	if ip == nil || ip.To4() == nil {
		return "", ""
	}
	ip = ip.To4()
	if !ip.IsPrivate() || ip.IsLoopback() || ip.IsLinkLocalUnicast() || ip.IsUnspecified() {
		return "", ""
	}
	for _, c := range cidrs {
		_, block, err := net.ParseCIDR(strings.TrimSpace(c))
		if err != nil || block.IP.To4() == nil {
			continue
		}
		if block.Contains(ip) {
			return ip.String(), block.String()
		}
	}
	return "", ""
}