"""`web_fetch` must not reach the machine's own network position.

Both take a URL straight from the model, and the model's input is untrusted by design —
the tools' own descriptions call fetched content "data to evaluate, not instructions".
`web_fetch` is additionally `requires_approval=False`, so nothing prompts the user.
"""

import socket

import pytest

from coworker.web import guard
from coworker.web.fetch import make_web_fetch_tool


def _resolves_to(monkeypatch, ip: str):
    monkeypatch.setattr(
        guard.socket, "getaddrinfo",
        lambda *a, **k: [(socket.AF_INET, socket.SOCK_STREAM, 6, "", (ip, 80))],
    )


# -- literals -----------------------------------------------------------------

@pytest.mark.parametrize("url,needle", [
    ("http://127.0.0.1:11434/api/tags", "loopback"),
    ("http://localhost:8000/", "loopback"),
    ("http://[::1]:8080/", "loopback"),
    ("http://169.254.169.254/latest/meta-data/", "link-local"),
    ("http://10.0.0.5/admin", "private"),
    ("http://192.168.1.1/", "private"),
    ("http://172.16.4.4/", "private"),
    ("http://0.0.0.0/", "refusing to fetch"),  # 0.0.0.0/8 lands in is_private first
    ("http://100.64.0.1/", "CGNAT"),  # RFC 6598 shared space (Tailscale, CGNAT)
    ("http://100.127.255.254/", "CGNAT"),
])
def test_blocked_literals(url, needle):
    reason = guard.check_url(url)
    assert reason and needle in reason


def test_cgnat_neighbours_still_allowed(monkeypatch):
    """100.64.0.0/10 is blocked, but the adjacent public 100.63/100.128 space is not."""
    _resolves_to(monkeypatch, "100.63.255.255")
    assert guard.check_url("http://below.example/") is None
    _resolves_to(monkeypatch, "100.128.0.0")
    assert guard.check_url("http://above.example/") is None


def test_ipv4_mapped_ipv6_loopback_is_blocked():
    """::ffff:127.0.0.1 must be judged as the v4 address it carries."""
    assert guard.check_url("http://[::ffff:127.0.0.1]/")


def test_public_literal_is_allowed():
    assert guard.check_url("https://93.184.216.34/") is None


@pytest.mark.parametrize("url", ["file:///etc/passwd", "ftp://example.com/x",
                                 "gopher://example.com/", "http://"])
def test_non_http_schemes_and_hostless_urls_are_refused(url):
    assert guard.check_url(url)


# -- names --------------------------------------------------------------------

def test_hostname_resolving_to_loopback_is_blocked(monkeypatch):
    """`localtest.me` and friends are public names with private answers."""
    _resolves_to(monkeypatch, "127.0.0.1")
    assert "loopback" in guard.check_url("http://sneaky.example.com/")


def test_hostname_resolving_to_metadata_ip_is_blocked(monkeypatch):
    _resolves_to(monkeypatch, "169.254.169.254")
    assert guard.check_url("http://metadata.example.com/")


def test_any_private_answer_blocks_a_split_horizon_name(monkeypatch):
    """One public and one private A record must not be a way through."""
    monkeypatch.setattr(
        guard.socket, "getaddrinfo",
        lambda *a, **k: [
            (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("93.184.216.34", 80)),
            (socket.AF_INET, socket.SOCK_STREAM, 6, "", ("127.0.0.1", 80)),
        ],
    )
    assert guard.check_url("http://split.example.com/")


def test_public_hostname_is_allowed(monkeypatch):
    _resolves_to(monkeypatch, "93.184.216.34")
    assert guard.check_url("https://example.com/docs") is None


def test_unresolvable_host_is_refused_not_fetched(monkeypatch):
    def boom(*a, **k):
        raise socket.gaierror("nodename nor servname provided")
    monkeypatch.setattr(guard.socket, "getaddrinfo", boom)
    assert "could not resolve" in guard.check_url("http://nope.invalid/")


# -- redirects ----------------------------------------------------------------

class _Resp:
    def __init__(self, status=200, location=None, url="https://example.com/"):
        self.status_code = status
        self.headers = {"location": location} if location else {}
        self.url = _Url(url)
        self.text = "body"

    def raise_for_status(self):
        pass


class _Url(str):
    def join(self, other):
        return other


class _Client:
    """Records what was actually requested, so a blocked hop is provably not fetched."""

    def __init__(self, script):
        self.script = script
        self.requested = []
        self.calls = []

    def get(self, url, headers=None, extensions=None):
        self.requested.append(url)
        self.calls.append({"url": url, "headers": headers or {}, "extensions": extensions or {}})
        return self.script.pop(0)


def test_redirect_into_loopback_is_blocked_before_the_second_request(monkeypatch):
    _resolves_to(monkeypatch, "93.184.216.34")
    client = _Client([_Resp(302, location="http://127.0.0.1:11434/api/tags")])
    with pytest.raises(PermissionError, match="loopback"):
        guard.get_checked(client, "https://example.com/start")
    assert client.requested == ["https://93.184.216.34/start"], (
        "the redirect target must never be requested"
    )


def test_allowed_redirect_chain_is_followed(monkeypatch):
    _resolves_to(monkeypatch, "93.184.216.34")
    client = _Client([_Resp(302, location="https://example.com/b"), _Resp(200)])
    resp = guard.get_checked(client, "https://example.com/a")
    assert resp.status_code == 200
    assert client.requested == ["https://93.184.216.34/a", "https://93.184.216.34/b"]


def test_redirect_loop_is_bounded(monkeypatch):
    _resolves_to(monkeypatch, "93.184.216.34")
    client = _Client([_Resp(302, location="https://example.com/loop")] * 50)
    with pytest.raises(RuntimeError, match="too many redirects"):
        guard.get_checked(client, "https://example.com/loop")


# -- pinning (DNS rebinding) --------------------------------------------------

def test_connection_is_pinned_to_the_vetted_address(monkeypatch):
    """The client must be told to connect to the address that was checked, with the
    original name in Host and SNI — never left to resolve the name a second time."""
    _resolves_to(monkeypatch, "93.184.216.34")
    client = _Client([_Resp(200)])
    guard.get_checked(client, "https://example.com/docs")
    call = client.calls[0]
    assert call["url"] == "https://93.184.216.34/docs"
    assert call["headers"]["Host"] == "example.com"
    assert call["extensions"]["sni_hostname"] == "example.com"


def test_rebinding_after_the_check_cannot_reach_loopback(monkeypatch):
    """A ~0-TTL record that flips to 127.0.0.1 between check and connect must not
    matter: the connection goes to the address that passed the check."""
    answers = iter(["93.184.216.34", "127.0.0.1"])

    def flipping(*a, **k):
        ip = next(answers, "127.0.0.1")
        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", (ip, 80))]

    monkeypatch.setattr(guard.socket, "getaddrinfo", flipping)
    client = _Client([_Resp(200)])
    guard.get_checked(client, "http://rebind.example.com/")
    assert client.requested == ["http://93.184.216.34/"], (
        "the second resolution must never influence where the client connects"
    )


def test_pinned_host_header_preserves_an_explicit_port(monkeypatch):
    _resolves_to(monkeypatch, "93.184.216.34")
    client = _Client([_Resp(200)])
    guard.get_checked(client, "http://example.com:8080/x")
    call = client.calls[0]
    assert call["url"] == "http://93.184.216.34:8080/x"
    assert call["headers"]["Host"] == "example.com:8080"
    assert "sni_hostname" not in call["extensions"], "plain http has no TLS handshake"


def test_ipv6_answers_are_pinned_with_brackets(monkeypatch):
    _resolves_to(monkeypatch, "2606:2800:220:1:248:1893:25c8:1946")
    client = _Client([_Resp(200)])
    guard.get_checked(client, "https://example.com/")
    assert client.requested == ["https://[2606:2800:220:1:248:1893:25c8:1946]/"]


def test_literal_address_urls_are_fetched_unchanged():
    client = _Client([_Resp(200)])
    guard.get_checked(client, "https://93.184.216.34/x")
    call = client.calls[0]
    assert call["url"] == "https://93.184.216.34/x"
    assert "Host" not in call["headers"], "a literal needs no name-based Host override"


def test_logical_url_is_reported_not_the_pinned_address(monkeypatch):
    """Callers show the final URL to the model; it must be the name, not the address."""
    _resolves_to(monkeypatch, "93.184.216.34")
    resp = _Resp(200)
    resp.extensions = {}
    client = _Client([_Resp(302, location="https://example.com/b"), resp])
    out = guard.get_checked(client, "https://example.com/a")
    assert out.extensions["logical_url"] == "https://example.com/b"


# -- the tool -----------------------------------------------------------------

def test_web_fetch_returns_the_refusal_as_a_tool_error(monkeypatch):
    _resolves_to(monkeypatch, "127.0.0.1")
    out = make_web_fetch_tool()("http://sneaky.example.com/")
    assert "loopback" in out["error"]
    assert "text" not in out


def test_web_fetch_still_rejects_non_http_schemes():
    assert "http" in make_web_fetch_tool()("file:///etc/passwd")["error"]


def test_browser_open_url_is_guarded_and_never_launches(monkeypatch):
    """The Playwright browser_open_url is approval gated, but the address guard still
    refuses a blocked URL before the browser is touched (defense in depth)."""
    from coworker.connectors.browser_automation import make_browser_automation_tools

    open_url = {t.__name__: t for t in make_browser_automation_tools()}["browser_open_url"]
    out = open_url("http://169.254.169.254/latest/meta-data/")
    assert "link-local" in out["error"]
    assert out.get("ok") is None


# -- redirects: the address that actually loads (OPE-124) -------------------------
# check_url vets the URL the model supplied. Playwright then follows redirects, so the hop
# that really loads is an address the guard never saw — and the user's approval was for the
# first URL, not that one.


def _refusal(requested, final):
    from coworker.connectors.browser_automation import redirect_refusal

    return redirect_refusal(requested, final)


@pytest.mark.parametrize(
    "landed",
    [
        "http://169.254.169.254/latest/meta-data/",  # cloud metadata / credentials
        "http://192.168.1.1/admin",  # router admin page
        "http://127.0.0.1:8765/v1/health",  # OpenWorker's own sidecar
        "http://10.0.0.5/internal",  # private network
    ],
)
def test_a_public_link_that_lands_somewhere_internal_is_refused(landed):
    assert _refusal("https://short.link/x", landed)


def test_a_redirect_to_another_public_page_is_fine():
    assert _refusal("https://short.link/x", "https://example.com/article") is None


def test_no_redirect_costs_no_second_check():
    # Same address in and out: already vetted before navigation, so nothing to re-check.
    assert _refusal("https://example.com/", "https://example.com/") is None


def test_a_missing_final_url_is_not_treated_as_a_violation():
    # A navigation that reports no URL is a browser failure, not a redirect to somewhere
    # forbidden — the caller surfaces its own error rather than a misleading one.
    assert _refusal("https://example.com/", "") is None


def test_the_refusal_names_where_it_landed():
    # The user approved one URL and ended up at another; the message has to say which,
    # or the card they approved and the error they see cannot be reconciled.
    reason = _refusal("https://short.link/x", "http://169.254.169.254/")
    assert "169.254.169.254" in reason


class _FakePage:
    """A page that redirects: goto(url) lands on whatever `lands_on` maps it to."""

    def __init__(self, lands_on):
        self.lands_on = lands_on
        self.url = ""
        self.visited = []

    def goto(self, url, **_kw):
        self.visited.append(url)
        self.url = self.lands_on.get(url, url)


def _open_url_with(monkeypatch, page):
    from coworker.connectors import browser_automation as ba

    monkeypatch.setattr(ba._BROWSER, "call", lambda _action, fn: fn(page))
    tools = {t.__name__: t for t in ba.make_browser_automation_tools()}
    return tools["browser_open_url"]


def test_open_url_refuses_and_blanks_the_page_after_a_bad_redirect(monkeypatch):
    page = _FakePage({"https://short.link/x": "http://169.254.169.254/latest/meta-data/"})
    result = _open_url_with(monkeypatch, page)("https://short.link/x")

    assert "error" in result and "169.254.169.254" in result["error"]
    # Containment: the request already went out, so what matters is that nothing readable
    # is left behind for browser_read_page to lift off.
    assert page.visited[-1] == "about:blank"
    assert page.url == "about:blank"


def test_open_url_keeps_a_harmless_redirect(monkeypatch):
    page = _FakePage({"https://short.link/x": "https://example.com/article"})
    result = _open_url_with(monkeypatch, page)("https://short.link/x")

    assert result.get("ok") and result["url"] == "https://example.com/article"
    assert "about:blank" not in page.visited