package aviso

import (
	"context"
	"errors"
	"net"
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
	"time"
)

func TestValidateEndpoint(t *testing.T) {
	ok := "https://fcm.googleapis.com/fcm/send/abc"
	if err := validateEndpoint(ok); err != nil {
		t.Fatalf("good endpoint refused: %v", err)
	}
	bad := map[string]string{
		"http":      "http://fcm.googleapis.com/x",
		"userinfo":  "https://user:pw@fcm.googleapis.com/x",
		"fragment":  "https://fcm.googleapis.com/x#frag",
		"empty":     "",
		"no host":   "https:///x",
		"too long":  "https://fcm.googleapis.com/" + strings.Repeat("a", 2048),
		"loopback":  "https://127.0.0.1/x",
		"ip6 loop":  "https://[::1]/x",
		"private":   "https://10.0.0.5/x",
		"linklocal": "https://169.254.169.254/latest",
		"mapped":    "https://[::ffff:10.0.0.5]/x",
		"testnet":   "https://192.0.2.1/x",
		"bench":     "https://198.18.0.1/x",
	}
	for name, in := range bad {
		if err := validateEndpoint(in); !errors.Is(err, ErrBadEndpoint) {
			t.Errorf("%s (%q): got %v, want ErrBadEndpoint", name, in, err)
		}
	}
}

func TestGuardedIP(t *testing.T) {
	refused := []string{
		"127.0.0.1", "10.1.2.3", "172.16.0.1", "192.168.1.1", "169.254.1.1",
		"::1", "fe80::1", "fc00::1", "::ffff:192.168.1.1", "0.0.0.0", "100.64.0.1",
		// Reserved ranges the net.IP predicates do not cover.
		"0.1.2.3", "192.0.0.1", "192.0.2.1", "198.18.0.1", "198.19.255.255", "198.51.100.1",
		"203.0.113.1", "240.0.0.1", "255.255.255.255", "2001:db8::1", "64:ff9b::a00:1",
		"64:ff9b:1::a00:1", "100::1", "2001:2::1", "3fff::1",
		"::", "224.0.0.1", "ff02::1",
	}
	for _, ip := range refused {
		if err := guardedIP(net.ParseIP(ip)); err == nil {
			t.Errorf("%s allowed", ip)
		}
	}
	for _, ip := range []string{"142.250.72.14", "2607:f8b0::1", "1.1.1.1"} {
		if err := guardedIP(net.ParseIP(ip)); err != nil {
			t.Errorf("%s refused: %v", ip, err)
		}
	}
}

// The guard is at connect time, so a hostname that resolves to a
// loopback address — DNS rebinding's shape — fails even though the URL
// looked fine. httptest's server IS loopback, which makes it the
// perfect hostile target.
func TestClientRefusesLoopbackAtDial(t *testing.T) {
	srv := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {}))
	defer srv.Close()
	c := newClient()
	c.Transport.(*http.Transport).TLSClientConfig = srv.Client().Transport.(*http.Transport).TLSClientConfig.Clone()
	req, _ := http.NewRequestWithContext(context.Background(), http.MethodPost, strings.Replace(srv.URL, "127.0.0.1", "localhost", 1), nil)
	_, err := c.Do(req)
	if err == nil || !strings.Contains(err.Error(), "aviso") {
		t.Fatalf("loopback dial allowed or wrong error: %v", err)
	}
}

// The transport's own dialer must refuse before any packet leaves: the
// guard runs in Dialer.Control, which precedes connect(2), so each of
// these fails instantly with the guard's error rather than a timeout.
// Ports 9 (discard) would otherwise sit there.
func TestClientDialerRefusesPrivateAddressesBeforeConnecting(t *testing.T) {
	tr := newClient().Transport.(*http.Transport)
	for _, addr := range []string{
		"10.0.0.1:443", "172.16.5.5:443", "192.168.1.1:443", "169.254.169.254:80",
		"[::ffff:10.0.0.1]:443", "[64:ff9b::a00:1]:443", "[64:ff9b:1::a00:1]:443",
		"[fc00::1]:443", "[2001:db8::1]:443", "192.0.2.1:443", "127.0.0.1:9",
	} {
		ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
		conn, err := tr.DialContext(ctx, "tcp", addr)
		cancel()
		if conn != nil {
			conn.Close()
		}
		if err == nil || !strings.Contains(err.Error(), "aviso: dial refused") {
			t.Errorf("%s: got %v, want the guard's refusal", addr, err)
		}
	}
}

func TestClientRefusesRedirects(t *testing.T) {
	c := newClient()
	req, _ := http.NewRequest(http.MethodGet, "https://example.invalid/", nil)
	if err := c.CheckRedirect(req, []*http.Request{req}); err == nil {
		t.Fatal("redirect followed")
	}
	if c.Transport.(*http.Transport).Proxy != nil {
		t.Fatal("client would honour an environment proxy")
	}
}