package federation

import (
	"net"
	"testing"
)

func TestValidatePublicDomain(t *testing.T) {
	valid := []string{
		"instanceb.example",
		"git.neuromancer.ovh",
		"a.b.c.example.com",
	}
	for _, d := range valid {
		if err := ValidatePublicDomain(d); err != nil {
			t.Errorf("ValidatePublicDomain(%q) = %v, want nil", d, err)
		}
	}

	invalid := []string{
		"",                  // empty
		"169.254.169.254",   // IP literal (cloud metadata)
		"127.0.0.1",         // IP literal
		"10.0.0.5",          // private IP literal
		"[::1]",             // IPv6 literal
		"localhost",         // single label, no TLD
		"evil.com:6379",     // embedded port
		"evil.com/path",     // embedded path
		"user@evil.com",     // credentials
		"https://evil.com",  // scheme
		"evil.com#frag",     // fragment
		"has space.example", // whitespace
	}
	for _, d := range invalid {
		if err := ValidatePublicDomain(d); err == nil {
			t.Errorf("ValidatePublicDomain(%q) = nil, want error", d)
		}
	}
}

func TestIsDisallowedIP(t *testing.T) {
	blocked := []string{
		"127.0.0.1", "::1", // loopback
		"10.1.2.3", "172.16.5.5", "192.168.1.1", // RFC1918
		"169.254.169.254", // link-local / cloud metadata
		"100.64.0.1",      // CGNAT
		"0.0.0.0",         // unspecified
		"fd00::1",         // ULA
		"fe80::1",         // link-local v6
	}
	for _, s := range blocked {
		if !isDisallowedIP(net.ParseIP(s)) {
			t.Errorf("isDisallowedIP(%s) = false, want true", s)
		}
	}

	allowed := []string{"1.1.1.1", "8.8.8.8", "93.184.216.34", "2606:4700:4700::1111"}
	for _, s := range allowed {
		if isDisallowedIP(net.ParseIP(s)) {
			t.Errorf("isDisallowedIP(%s) = true, want false", s)
		}
	}
}