import { assertEquals } from "https://deno.land/std@0.224.0/assert/mod.ts";
import { isPrivateIp, isSafeHref, isValidPdsUrl } from "./url-validation.ts";

// --- isPrivateIp ---

Deno.test("isPrivateIp rejects loopback", () => {
  assertEquals(isPrivateIp("127.0.0.1"), true);
  assertEquals(isPrivateIp("127.0.1.1"), true);
});

Deno.test("isPrivateIp rejects RFC 1918 ranges", () => {
  assertEquals(isPrivateIp("10.0.0.1"), true);
  assertEquals(isPrivateIp("10.255.255.255"), true);
  assertEquals(isPrivateIp("172.16.0.1"), true);
  assertEquals(isPrivateIp("172.31.255.255"), true);
  assertEquals(isPrivateIp("192.168.0.1"), true);
  assertEquals(isPrivateIp("192.168.1.100"), true);
});

Deno.test("isPrivateIp allows 172.x outside /12 range", () => {
  assertEquals(isPrivateIp("172.15.0.1"), false);
  assertEquals(isPrivateIp("172.32.0.1"), false);
});

Deno.test("isPrivateIp rejects link-local", () => {
  assertEquals(isPrivateIp("169.254.1.1"), true);
});

Deno.test("isPrivateIp rejects cloud metadata IPs", () => {
  assertEquals(isPrivateIp("169.254.169.254"), true);
  assertEquals(isPrivateIp("100.100.100.200"), true);
});

Deno.test("isPrivateIp rejects 0.x.x.x", () => {
  assertEquals(isPrivateIp("0.0.0.0"), true);
});

Deno.test("isPrivateIp rejects IPv6 private ranges", () => {
  assertEquals(isPrivateIp("::1"), true);
  assertEquals(isPrivateIp("fc00::1"), true);
  assertEquals(isPrivateIp("fd12::1"), true);
  assertEquals(isPrivateIp("fe80::1"), true);
});

Deno.test("isPrivateIp allows public IPs", () => {
  assertEquals(isPrivateIp("1.1.1.1"), false);
  assertEquals(isPrivateIp("8.8.8.8"), false);
  assertEquals(isPrivateIp("93.184.216.34"), false);
  assertEquals(isPrivateIp("203.0.113.1"), false);
});

// --- isValidPdsUrl ---

Deno.test("isValidPdsUrl accepts valid https PDS URLs", () => {
  assertEquals(isValidPdsUrl("https://pds.example.com"), true);
  assertEquals(isValidPdsUrl("https://my.pds.server.org"), true);
  assertEquals(isValidPdsUrl("https://bsky.social"), true);
});

Deno.test("isValidPdsUrl rejects non-https protocols", () => {
  assertEquals(isValidPdsUrl("http://pds.example.com"), false);
  assertEquals(isValidPdsUrl("ftp://pds.example.com"), false);
  assertEquals(isValidPdsUrl("javascript:alert(1)"), false);
  assertEquals(isValidPdsUrl("data:text/html,<h1>hi</h1>"), false);
});

Deno.test("isValidPdsUrl rejects bare IP addresses", () => {
  assertEquals(isValidPdsUrl("https://1.2.3.4"), false);
  assertEquals(isValidPdsUrl("https://192.168.1.1"), false);
});

Deno.test("isValidPdsUrl rejects private IP hostnames", () => {
  assertEquals(isValidPdsUrl("https://127.0.0.1"), false);
  assertEquals(isValidPdsUrl("https://10.0.0.1"), false);
});

Deno.test("isValidPdsUrl rejects localhost and single-label hosts", () => {
  assertEquals(isValidPdsUrl("https://localhost"), false);
  assertEquals(isValidPdsUrl("https://intranet"), false);
});

Deno.test("isValidPdsUrl rejects URLs with userinfo", () => {
  assertEquals(isValidPdsUrl("https://user:pass@pds.example.com"), false);
  assertEquals(isValidPdsUrl("https://admin@pds.example.com"), false);
});

Deno.test("isValidPdsUrl rejects malformed URLs", () => {
  assertEquals(isValidPdsUrl("not-a-url"), false);
  assertEquals(isValidPdsUrl(""), false);
  assertEquals(isValidPdsUrl("://missing-scheme"), false);
});

// --- isSafeHref ---

Deno.test("isSafeHref allows https and http URLs", () => {
  assertEquals(isSafeHref("https://example.com"), true);
  assertEquals(isSafeHref("http://example.com"), true);
});

Deno.test("isSafeHref rejects dangerous URI schemes", () => {
  assertEquals(isSafeHref("javascript:alert(1)"), false);
  assertEquals(isSafeHref("data:text/html,<h1>xss</h1>"), false);
  assertEquals(isSafeHref("vbscript:msgbox"), false);
});

Deno.test("isSafeHref rejects invalid URLs", () => {
  assertEquals(isSafeHref("not-a-url"), false);
  assertEquals(isSafeHref(""), false);
});