package com.mailserver.config;

import org.junit.jupiter.api.Test;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;

import java.net.InetSocketAddress;

import static org.assertj.core.api.Assertions.assertThat;

class LoginGuardConfigTest {

    private final LoginGuardConfig.TrustedProxyHeaderTransformer transformer = new LoginGuardConfig.TrustedProxyHeaderTransformer();

    private ServerHttpRequest from(String peer) {
        return MockServerHttpRequest.post("/api/login")
                .remoteAddress(new InetSocketAddress(peer, 40000))
                .header("X-Forwarded-For", "198.51.100.9")
                .header("X-Forwarded-Proto", "https")
                .build();
    }

    @Test
    void forwardedForIsBelievedFromAPrivateProxy() {
        ServerHttpRequest request = transformer.apply(from("172.18.0.5"));
        assertThat(request.getRemoteAddress().getHostString()).isEqualTo("198.51.100.9");
        assertThat(request.getURI().getScheme()).isEqualTo("https");
    }

    @Test
    void forwardedForFromTheInternetIsDropped() {
        ServerHttpRequest request = transformer.apply(from("203.0.113.7"));
        assertThat(request.getRemoteAddress().getAddress().getHostAddress()).isEqualTo("203.0.113.7");
        assertThat(request.getHeaders().containsKey("X-Forwarded-For")).isFalse();
    }

    @Test
    void privateRanges() {
        for (String ip : new String[]{"127.0.0.1", "10.30.0.13", "172.16.0.1", "192.168.1.1", "fd00::1", "::1", "fe80::1"}) {
            assertThat(LoginGuardConfig.privatePeer(new InetSocketAddress(ip, 1))).as(ip).isTrue();
        }
        for (String ip : new String[]{"103.109.235.154", "172.32.0.1", "2001:db8::1", "8.8.8.8"}) {
            assertThat(LoginGuardConfig.privatePeer(new InetSocketAddress(ip, 1))).as(ip).isFalse();
        }
    }
}