## Copyright © 2026 Olaf Kolkman
## SPDX-License-Identifier: GPL-3.0-or-later

from unittest.mock import patch
from urllib.error import HTTPError
from urllib.request import Request

import pytest

from backend.app.services.mastodon_security import open_no_redirect, validate_public_instance


@pytest.mark.parametrize('instance', [
    'http://mastodon.example',
    'https://127.0.0.1',
    'https://[::ffff:127.0.0.1]',
    'https://user:password@mastodon.example',
])
def test_mastodon_instance_rejects_unsafe_urls(instance):
    with pytest.raises(ValueError):
        validate_public_instance(instance)


def test_mastodon_instance_rejects_private_dns_result():
    with patch('backend.app.services.mastodon_security.socket.getaddrinfo', return_value=[(2, 1, 6, '', ('10.0.0.5', 443))]):
        with pytest.raises(ValueError, match='public IP'):
            validate_public_instance('https://mastodon.example')


def test_mastodon_outbound_redirects_are_rejected():
    request = Request('https://mastodon.example/api/v1/statuses')
    with patch('backend.app.services.mastodon_security.NO_REDIRECT_OPENER.open', side_effect=HTTPError(request.full_url, 302, 'Redirects are not allowed', {}, None)):
        with pytest.raises(HTTPError, match='Redirects are not allowed'):
            open_no_redirect(request)