#!/usr/bin/env python3
"""Self-check for the SSRF guard added to server.py. No framework, no network:
literal-IP URLs resolve via getaddrinfo without a DNS lookup, so this is hermetic.

  GOD3_OPEN=1 python3 test_hardening.py     # OPEN so import doesn't sys.exit on missing GOD3_PW
"""
import os
os.environ.setdefault('GOD3_OPEN', '1')     # let server.py import without a real GOD3_PW
import server

# --- blocked: non-http schemes (file://, ftp://) — the /etc/passwd + FileHandler vector ---
assert server.public_host('file:///etc/passwd') is False
assert server.public_host('ftp://ftp.example.com/x') is False
assert server.public_host('gopher://x/') is False
assert server.public_host('') is False

# --- blocked: internal / metadata / loopback targets (literal IPs, no DNS) ---
assert server.public_host('http://127.0.0.1/') is False          # loopback
assert server.public_host('http://[::1]/') is False              # loopback v6
assert server.public_host('http://169.254.169.254/latest/meta-data/') is False  # cloud metadata
assert server.public_host('http://10.0.0.5/') is False           # private
assert server.public_host('http://192.168.1.1/') is False        # private
assert server.public_host('http://172.16.0.9/') is False         # private
assert server.public_host('http://0.0.0.0/') is False            # unspecified

# --- allowed: public literal IPs (hermetic — no DNS) ---
assert server.public_host('http://8.8.8.8/model.glb') is True
assert server.public_host('https://1.1.1.1/x.glb') is True

print('ok — SSRF guard blocks file/ftp + loopback/private/metadata, allows public http(s)')