package server

import (
	"net"
	"testing"
)

func TestParseTrustedProxiesKeywords(t *testing.T) {
	// "local" expands to loopback + private ranges.
	tp, err := parseTrustedProxies([]string{"local"})
	if err != nil {
		t.Fatalf("local: %v", err)
	}
	for _, ip := range []string{"127.0.0.1", "10.1.2.3", "192.168.5.5", "172.16.0.1", "169.254.1.1"} {
		if !tp.contains(net.ParseIP(ip)) {
			t.Errorf("local should trust %s", ip)
		}
	}
	if tp.contains(net.ParseIP("8.8.8.8")) {
		t.Errorf("local should NOT trust a public IP")
	}

	// "all" trusts everything.
	all, err := parseTrustedProxies([]string{"all"})
	if err != nil {
		t.Fatalf("all: %v", err)
	}
	if !all.contains(net.ParseIP("8.8.8.8")) {
		t.Errorf("all should trust any IP")
	}

	// "none" and "" trust nothing.
	for _, kw := range []string{"none", ""} {
		none, err := parseTrustedProxies([]string{kw})
		if err != nil {
			t.Fatalf("%q: %v", kw, err)
		}
		if none.contains(net.ParseIP("127.0.0.1")) {
			t.Errorf("%q should trust nothing", kw)
		}
	}

	// An explicit CIDR still works and is additive with a keyword.
	mix, err := parseTrustedProxies([]string{"local", "203.0.113.0/24"})
	if err != nil {
		t.Fatalf("mix: %v", err)
	}
	if !mix.contains(net.ParseIP("203.0.113.7")) || !mix.contains(net.ParseIP("10.0.0.1")) {
		t.Errorf("mix should trust both the explicit CIDR and local ranges")
	}
}