from __future__ import annotations

import pytest
from backup_tool.security.ssrf import (
    SSRFError,
    resolve_public_addresses,
    validate_webhook_url,
)


@pytest.mark.asyncio
async def test_private_or_mixed_answers_are_rejected() -> None:
    async def private(_host: str, _port: int) -> tuple[str, ...]:
        return ("8.8.8.8", "127.0.0.1")

    with pytest.raises(SSRFError, match="non-public"):
        await resolve_public_addresses("hooks.example.test", 443, private)


@pytest.mark.parametrize(
    "value",
    [
        "https://127.0.0.1/callback",
        "https://user:pass@hooks.example.test/callback",
        "https://hooks.example.test/callback#fragment",
        "ftp://hooks.example.test/callback",
        "https://hooks.example.test:22/callback",
    ],
)
def test_webhook_url_rejects_bypasses(value: str) -> None:
    with pytest.raises(SSRFError):
        validate_webhook_url(value)