/**
 * Guard CC API base URLs against classic SSRF (metadata / RFC1918).
 * Allows official CarrierCentral hosts and localhost for local mock/dev.
 * Hosts listed in `CC_API_BASE` env (or matching that hostname) also allowed.
 */

function isPrivateOrSpecialHost(hostname: string): boolean {
  const h = hostname.toLowerCase().replace(/^\[|\]$/g, "");
  if (h === "localhost" || h === "127.0.0.1" || h === "::1") return false;

  if (h === "0.0.0.0" || h === "169.254.169.254" || h === "metadata.google.internal") {
    return true;
  }

  // IPv4 private / link-local / loopback
  const m = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(h);
  if (m) {
    const a = Number(m[1]);
    const b = Number(m[2]);
    if (a === 10) return true;
    if (a === 127) return true;
    if (a === 0) return true;
    if (a === 169 && b === 254) return true;
    if (a === 192 && b === 168) return true;
    if (a === 172 && b >= 16 && b <= 31) return true;
  }

  // IPv6 ULA / loopback / link-local
  if (h.startsWith("fc") || h.startsWith("fd") || h.startsWith("fe80")) return true;

  return false;
}

function hostAllowedByDefault(hostname: string): boolean {
  const h = hostname.toLowerCase();
  if (h === "localhost" || h === "127.0.0.1" || h === "::1") return true;
  if (h === "carriercentral.vip" || h.endsWith(".carriercentral.vip")) return true;
  return false;
}

function hostMatchesEnvBase(hostname: string): boolean {
  const raw = process.env.CC_API_BASE?.trim();
  if (!raw) return false;
  try {
    return new URL(raw).hostname.toLowerCase() === hostname.toLowerCase();
  } catch {
    return false;
  }
}

/** @returns normalized URL string (no trailing slash required) */
export function assertSafeCcApiBase(urlStr: string): string {
  let u: URL;
  try {
    u = new URL(urlStr.trim());
  } catch {
    throw new Error("CC_API_BASE_INVALID");
  }

  if (u.protocol !== "https:" && u.protocol !== "http:") {
    throw new Error("CC_API_BASE_PROTOCOL");
  }

  const host = u.hostname;
  if (!host) throw new Error("CC_API_BASE_INVALID");

  // Production: https only except localhost
  const isLocal =
    host === "localhost" || host === "127.0.0.1" || host === "::1";
  if (process.env.NODE_ENV === "production" && u.protocol !== "https:" && !isLocal) {
    throw new Error("CC_API_BASE_HTTPS_REQUIRED");
  }

  if (isPrivateOrSpecialHost(host) && !isLocal) {
    throw new Error("CC_API_BASE_PRIVATE_HOST");
  }

  if (!hostAllowedByDefault(host) && !hostMatchesEnvBase(host)) {
    throw new Error(
      "CC_API_BASE_HOST_NOT_ALLOWED: 仅允许 *.carriercentral.vip、localhost，或与 CC_API_BASE 同主机",
    );
  }

  return u.toString().replace(/\/$/, "");
}