<?php

declare(strict_types=1);

namespace App\Libraries;

/**
 * SSRF protection for user-supplied URLs. Every external fetch goes
 * through guard() before a single byte is requested:
 *
 *  - scheme allowlist (http/https)
 *  - DNS resolution checked against private / reserved ranges
 *  - port restricted to 80/443
 *  - optional host allowlist for media CDNs
 *  - redirects are never auto-followed by fetchers (re-validate per hop)
 */
final class UrlGuard
{
    public function check(string $url): array
    {
        $parts = parse_url(trim($url));

        if ($parts === false || ! isset($parts['host'], $parts['scheme'])) {
            throw new \InvalidArgumentException('Invalid URL.');
        }

        if (! in_array(strtolower($parts['scheme']), ['http', 'https'], true)) {
            throw new \InvalidArgumentException('Only http and https URLs are allowed.');
        }

        $port = $parts['port'] ?? (strtolower($parts['scheme']) === 'https' ? 443 : 80);
        if (! in_array($port, [80, 443], true)) {
            throw new \InvalidArgumentException('Blocked port.');
        }

        $host = strtolower($parts['host']);

        // Never let raw IPs through unless public.
        if (filter_var($host, FILTER_VALIDATE_IP)) {
            if (! $this->isPublicIp($host)) {
                throw new \InvalidArgumentException('Blocked host.');
            }

            return ['host' => $host, 'ip' => $host, 'port' => $port, 'path' => $parts['path'] ?? '/', 'query' => $parts['query'] ?? ''];
        }

        // Resolve all addresses; every one must be public.
        $records = @dns_get_record($host, DNS_A + DNS_AAAA);
        $ips     = [];
        foreach ($records ?: [] as $record) {
            $ip = $record['type'] === 'A' ? ($record['ip'] ?? null) : ($record['ipv6'] ?? null);
            if ($ip !== null) {
                $ips[] = $ip;
            }
        }
        if ($ips === []) {
            // fall back to gethostbyname for simple A records
            $resolved = gethostbyname($host);
            if ($resolved === $host) {
                throw new \InvalidArgumentException('Could not resolve host.');
            }
            $ips = [$resolved];
        }
        foreach ($ips as $ip) {
            if (! $this->isPublicIp($ip)) {
                throw new \InvalidArgumentException('Blocked host.');
            }
        }

        return ['host' => $host, 'ips' => $ips, 'port' => $port, 'path' => $parts['path'] ?? '/', 'query' => $parts['query'] ?? ''];
    }

    /** Host allowlist used for direct CDN fetches (thumbnails etc). */
    public function isAllowedMediaHost(string $host): bool
    {
        return in_array(strtolower($host), config('Site')->urlFetchAllowlist, true);
    }

    public function isPublicIp(string $ip): bool
    {
        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) && str_starts_with($ip, '::ffff:')) {
            $ip = substr($ip, 7);
        }

        $blockedFlags = FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE;

        if (str_contains($ip, ':')) {
            return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6 | $blockedFlags) !== false;
        }

        return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4 | $blockedFlags) !== false;
    }
}