feat(v2): complete v2 reimplementation

tests/security/test_webhook_ssrf.py

@@ -0,0 +1,32 @@
+from __future__ import annotations
+
+import pytest
+from backup_tool.security.ssrf import (
+    SSRFError,
+    resolve_public_addresses,
+    validate_webhook_url,
+)
+
+
+@pytest.mark.asyncio
+async def test_private_or_mixed_answers_are_rejected() -> None:
+    async def private(_host: str, _port: int) -> tuple[str, ...]:
+        return ("8.8.8.8", "127.0.0.1")
+
+    with pytest.raises(SSRFError, match="non-public"):
+        await resolve_public_addresses("hooks.example.test", 443, private)
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        "https://127.0.0.1/callback",
+        "https://user:pass@hooks.example.test/callback",
+        "https://hooks.example.test/callback#fragment",
+        "ftp://hooks.example.test/callback",
+        "https://hooks.example.test:22/callback",
+    ],
+)
+def test_webhook_url_rejects_bypasses(value: str) -> None:
+    with pytest.raises(SSRFError):
+        validate_webhook_url(value)