import { test } from 'node:test';
import assert from 'node:assert/strict';
import { isPrivateIp, assertSafeUrl, SsrfError } from '../src/feeds/ssrf.ts';

test('detects private ipv4', () => {
  assert.equal(isPrivateIp('127.0.0.1'), true);
  assert.equal(isPrivateIp('10.0.0.1'), true);
  assert.equal(isPrivateIp('192.168.1.1'), true);
  assert.equal(isPrivateIp('172.16.0.1'), true);
  assert.equal(isPrivateIp('169.254.169.254'), true);
  assert.equal(isPrivateIp('8.8.8.8'), false);
});

test('detects private ipv6', () => {
  assert.equal(isPrivateIp('::1'), true);
  assert.equal(isPrivateIp('fc00::1'), true);
  assert.equal(isPrivateIp('fe80::1'), true);
  assert.equal(isPrivateIp('2001:4860:4860::8888'), false);
});

test('rejects non-http protocols', async () => {
  await assert.rejects(assertSafeUrl('file:///etc/passwd'), SsrfError);
  await assert.rejects(assertSafeUrl('ftp://example.com'), SsrfError);
});

test('rejects loopback ip literal', async () => {
  await assert.rejects(assertSafeUrl('http://127.0.0.1/'), SsrfError);
  await assert.rejects(assertSafeUrl('http://169.254.169.254/latest/meta-data/'), SsrfError);
});