import pytest

from src.push_endpoint_policy import UnsafePushEndpoint, validate_public_push_endpoint


@pytest.mark.anyio
@pytest.mark.parametrize(
    "address",
    ["127.0.0.1", "::1", "10.0.0.4", "169.254.169.254", "fc00::1"],
)
async def test_push_endpoint_rejects_every_non_public_resolved_address(address):
    async def resolve(_host, _port):
        return [address]

    with pytest.raises(UnsafePushEndpoint, match="public Web Push service"):
        await validate_public_push_endpoint(
            "https://push.example/device", resolver=resolve
        )


@pytest.mark.anyio
@pytest.mark.parametrize(
    "endpoint",
    [
        "http://push.example/device",
        "https://user@push.example/device",
        "https://push.example:8443/device",
        "https://push.example:not-a-port/device",
        "https://push.example/device#fragment",
    ],
)
async def test_push_endpoint_rejects_noncanonical_authorities_without_resolving(endpoint):
    async def must_not_resolve(_host, _port):
        raise AssertionError("invalid URL reached DNS")

    with pytest.raises(UnsafePushEndpoint, match="canonical public Web Push"):
        await validate_public_push_endpoint(endpoint, resolver=must_not_resolve)