"""Tests for is_safe_url — SSRF guard in download module."""

from __future__ import annotations

import pytest

from axm_bib.download import is_safe_url


class TestIsSafeUrl:
    """is_safe_url blocks private IPs and non-HTTP schemes."""

    @pytest.mark.parametrize(
        "url",
        [
            "https://arxiv.org/pdf/123.pdf",
            "http://publisher.com/paper.pdf",
            "https://aclanthology.org/2024.acl-long.1.pdf",
        ],
    )
    def test_allows_public_urls(self, url: str) -> None:
        assert is_safe_url(url) is True

    @pytest.mark.parametrize(
        "url",
        [
            "http://127.0.0.1/internal",
            "http://localhost/secret",
            "https://10.0.0.1/private",
            "https://192.168.1.1/private",
            "http://169.254.169.254/metadata",  # AWS IMDS
        ],
    )
    def test_blocks_private_ips(self, url: str) -> None:
        assert is_safe_url(url) is False

    @pytest.mark.parametrize(
        "url",
        [
            "ftp://evil.com/file.pdf",
            "file:///etc/passwd",
            "data:text/html,<h1>hi</h1>",
        ],
    )
    def test_blocks_non_http_schemes(self, url: str) -> None:
        assert is_safe_url(url) is False

    def test_empty_url(self) -> None:
        assert is_safe_url("") is False
