import asyncio
import json
import logging
import socket

import pytest

from app.checker import EndpointChecker, redact_url
from app.models import State
from app.settings import Settings


@pytest.fixture
def checker() -> EndpointChecker:
    return EndpointChecker(Settings(request_timeout_seconds=1, connect_timeout_seconds=1,
                                    max_redirects=2))


@pytest.mark.asyncio
async def test_public_address_is_pinned_for_request(checker: EndpointChecker, monkeypatch) -> None:
    async def resolve(_host: str, _port: int) -> list[str]:
        return ["93.184.216.34"]
    seen: list[str] = []
    async def request(_url: str, addresses: list[str]) -> tuple[int, None]:
        seen.extend(addresses)
        return 200, None
    monkeypatch.setattr(checker, "_resolve", resolve)
    monkeypatch.setattr(checker, "_request_once", request)
    result = await checker.check("https://example.com/?token=secret")
    assert result.state == State.UP
    assert seen == ["93.184.216.34"]
    assert "secret" not in (result.final_url or "")


@pytest.mark.asyncio
@pytest.mark.parametrize("address", ["127.0.0.1", "10.0.0.1", "169.254.1.1", "::1", "192.0.2.1"])
async def test_dns_rejects_non_global_answers(checker: EndpointChecker, monkeypatch, address: str) -> None:
    loop = asyncio.get_running_loop()
    def answers(*_args, **_kwargs):
        family = socket.AF_INET6 if ":" in address else socket.AF_INET
        return [(family, socket.SOCK_STREAM, socket.IPPROTO_TCP, "", (address, 443))]
    monkeypatch.setattr(loop, "getaddrinfo", answers)
    with pytest.raises(Exception, match="globally routable"):
        await checker._resolve("attacker.invalid", 443)


@pytest.mark.asyncio
async def test_mixed_dns_answer_is_rejected(checker: EndpointChecker, monkeypatch) -> None:
    loop = asyncio.get_running_loop()
    def answers(*_args, **_kwargs):
        return [(socket.AF_INET, socket.SOCK_STREAM, 6, "", (ip, 80))
                for ip in ("93.184.216.34", "127.0.0.1")]
    monkeypatch.setattr(loop, "getaddrinfo", answers)
    with pytest.raises(Exception):
        await checker._resolve("rebinding.invalid", 80)


@pytest.mark.asyncio
async def test_redirect_target_is_resolved_and_blocked(checker: EndpointChecker, monkeypatch) -> None:
    calls = 0
    async def resolve(host: str, _port: int) -> list[str]:
        if host == "localhost":
            from app.checker import SecurityError
            raise SecurityError("destination is not globally routable")
        return ["93.184.216.34"]
    async def request(_url: str, _addresses: list[str]) -> tuple[int, str]:
        nonlocal calls
        calls += 1
        return 302, "http://localhost/admin?key=secret"
    monkeypatch.setattr(checker, "_resolve", resolve)
    monkeypatch.setattr(checker, "_request_once", request)
    result = await checker.check("https://example.com")
    assert result.state == State.ERROR
    assert result.error == "blocked_destination"
    assert calls == 1


@pytest.mark.asyncio
async def test_timeout_mapping(checker: EndpointChecker, monkeypatch) -> None:
    async def resolve(_host: str, _port: int) -> list[str]:
        return ["93.184.216.34"]
    async def request(_url: str, _addresses: list[str]):
        raise asyncio.TimeoutError
    monkeypatch.setattr(checker, "_resolve", resolve)
    monkeypatch.setattr(checker, "_request_once", request)
    result = await checker.check("https://example.com")
    assert result.state == State.ERROR and result.error == "timeout"


def test_redaction_removes_credentials_query_and_fragment() -> None:
    value = redact_url("https://user:secret@example.com/path?token=abc&x=1#frag")
    assert value == "https://example.com/path?REDACTED"
    assert all(secret not in value for secret in ("user", "secret", "abc", "frag"))


@pytest.mark.asyncio
async def test_structured_logs_do_not_leak_query(checker: EndpointChecker, monkeypatch, caplog) -> None:
    async def resolve(_host: str, _port: int) -> list[str]:
        return ["93.184.216.34"]
    async def request(_url: str, _addresses: list[str]) -> tuple[int, None]:
        return 500, None
    monkeypatch.setattr(checker, "_resolve", resolve)
    monkeypatch.setattr(checker, "_request_once", request)
    with caplog.at_level(logging.INFO, logger="endpoint_monitor.checker"):
        result = await checker.check("https://example.com/a?api_key=supersecret")
    assert result.state == State.DOWN
    assert "supersecret" not in caplog.text
    assert all("event" in json.loads(record.message) for record in caplog.records)