"""
Shared private/internal IP range constants for security validation.

Used by SSRF validation and notification URL validation to avoid
duplicating IP range definitions.
"""

import ipaddress

# RFC1918 private networks + loopback + link-local + CGNAT + IPv6 equivalents
# nosec B104 - These hardcoded IPs are intentional for security validation
PRIVATE_IP_RANGES = [
    ipaddress.ip_network("127.0.0.0/8"),  # IPv4 loopback
    ipaddress.ip_network("::1/128"),  # IPv6 loopback
    ipaddress.ip_network("10.0.0.0/8"),  # RFC1918 Class A private
    ipaddress.ip_network("172.16.0.0/12"),  # RFC1918 Class B private
    ipaddress.ip_network("192.168.0.0/16"),  # RFC1918 Class C private
    ipaddress.ip_network(
        "100.64.0.0/10"
    ),  # CGNAT - used by Podman/rootless containers
    ipaddress.ip_network("169.254.0.0/16"),  # Link-local
    ipaddress.ip_network("fe80::/10"),  # IPv6 link-local
    ipaddress.ip_network("fc00::/7"),  # IPv6 unique local
    ipaddress.ip_network("0.0.0.0/8"),  # "This" network
]
