Charon/backend/internal/utils/url_connectivity_test.go

package utils

import (
	"fmt"
	"net"
	"net/http"
	"net/http/httptest"
	"testing"
	"time"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// TestTestURLConnectivity_Success verifies that valid public URLs are reachable
func TestTestURLConnectivity_Success(t *testing.T) {
	// Create a test HTTP server
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		assert.Equal(t, http.MethodHead, r.Method, "should use HEAD request")
		assert.Equal(t, "Charon-Health-Check/1.0", r.UserAgent(), "should set correct User-Agent")
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	reachable, latency, err := TestURLConnectivity(server.URL)

	assert.NoError(t, err)
	assert.True(t, reachable)
	assert.Greater(t, latency, 0.0, "latency should be positive")
	assert.Less(t, latency, 5000.0, "latency should be reasonable (< 5s)")
}

// TestTestURLConnectivity_Redirect verifies redirect handling
func TestTestURLConnectivity_Redirect(t *testing.T) {
	redirectCount := 0
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		redirectCount++
		if redirectCount <= 2 {
			http.Redirect(w, r, "/final", http.StatusFound)
			return
		}
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	reachable, _, err := TestURLConnectivity(server.URL)

	assert.NoError(t, err)
	assert.True(t, reachable)
	assert.LessOrEqual(t, redirectCount, 3, "should follow max 2 redirects")
}

// TestTestURLConnectivity_TooManyRedirects verifies redirect limit enforcement
func TestTestURLConnectivity_TooManyRedirects(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		http.Redirect(w, r, "/redirect", http.StatusFound)
	}))
	defer server.Close()

	reachable, _, err := TestURLConnectivity(server.URL)

	assert.Error(t, err)
	assert.False(t, reachable)
	assert.Contains(t, err.Error(), "redirect", "error should mention redirects")
}

// TestTestURLConnectivity_StatusCodes verifies handling of different HTTP status codes
func TestTestURLConnectivity_StatusCodes(t *testing.T) {
	testCases := []struct {
		name       string
		statusCode int
		expected   bool
	}{
		{"200 OK", http.StatusOK, true},
		{"201 Created", http.StatusCreated, true},
		{"204 No Content", http.StatusNoContent, true},
		{"301 Moved Permanently", http.StatusMovedPermanently, true},
		{"302 Found", http.StatusFound, true},
		{"400 Bad Request", http.StatusBadRequest, false},
		{"401 Unauthorized", http.StatusUnauthorized, false},
		{"403 Forbidden", http.StatusForbidden, false},
		{"404 Not Found", http.StatusNotFound, false},
		{"500 Internal Server Error", http.StatusInternalServerError, false},
		{"503 Service Unavailable", http.StatusServiceUnavailable, false},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
				w.WriteHeader(tc.statusCode)
			}))
			defer server.Close()

			reachable, latency, err := TestURLConnectivity(server.URL)

			if tc.expected {
				assert.NoError(t, err)
				assert.True(t, reachable)
				assert.Greater(t, latency, 0.0)
			} else {
				assert.Error(t, err)
				assert.False(t, reachable)
				assert.Contains(t, err.Error(), fmt.Sprintf("status %d", tc.statusCode))
			}
		})
	}
}

// TestTestURLConnectivity_InvalidURL verifies invalid URL handling
func TestTestURLConnectivity_InvalidURL(t *testing.T) {
	testCases := []struct {
		name string
		url  string
	}{
		{"Empty URL", ""},
		{"Invalid scheme", "ftp://example.com"},
		{"Malformed URL", "http://[invalid"},
		{"No scheme", "example.com"},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			reachable, latency, err := TestURLConnectivity(tc.url)

			assert.Error(t, err)
			assert.False(t, reachable)
			assert.Equal(t, 0.0, latency)
			assert.Contains(t, err.Error(), "invalid URL", "error should mention invalid URL")
		})
	}
}

// TestTestURLConnectivity_DNSFailure verifies DNS resolution error handling
func TestTestURLConnectivity_DNSFailure(t *testing.T) {
	reachable, latency, err := TestURLConnectivity("http://nonexistent-domain-12345.invalid")

	assert.Error(t, err)
	assert.False(t, reachable)
	assert.Equal(t, 0.0, latency)
	assert.Contains(t, err.Error(), "DNS resolution failed", "error should mention DNS failure")
}

// TestTestURLConnectivity_Timeout verifies timeout enforcement
func TestTestURLConnectivity_Timeout(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Simulate slow server
		time.Sleep(6 * time.Second)
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	reachable, _, err := TestURLConnectivity(server.URL)

	assert.Error(t, err)
	assert.False(t, reachable)
	assert.Contains(t, err.Error(), "connection failed", "error should mention connection failure")
}

// TestIsPrivateIP_PrivateIPv4Ranges verifies blocking of private IPv4 ranges
func TestIsPrivateIP_PrivateIPv4Ranges(t *testing.T) {
	testCases := []struct {
		name     string
		ip       string
		expected bool
	}{
		// RFC 1918 Private Networks
		{"10.0.0.0/8 start", "10.0.0.1", true},
		{"10.0.0.0/8 mid", "10.128.0.1", true},
		{"10.0.0.0/8 end", "10.255.255.254", true},
		{"172.16.0.0/12 start", "172.16.0.1", true},
		{"172.16.0.0/12 mid", "172.20.0.1", true},
		{"172.16.0.0/12 end", "172.31.255.254", true},
		{"192.168.0.0/16 start", "192.168.0.1", true},
		{"192.168.0.0/16 end", "192.168.255.254", true},

		// Loopback
		{"127.0.0.1 localhost", "127.0.0.1", true},
		{"127.0.0.0/8 start", "127.0.0.0", true},
		{"127.0.0.0/8 end", "127.255.255.255", true},

		// Link-Local (includes AWS/GCP metadata)
		{"169.254.0.0/16 start", "169.254.0.1", true},
		{"169.254.169.254 AWS metadata", "169.254.169.254", true},
		{"169.254.0.0/16 end", "169.254.255.254", true},

		// Reserved ranges
		{"0.0.0.0/8", "0.0.0.1", true},
		{"240.0.0.0/4", "240.0.0.1", true},
		{"255.255.255.255 broadcast", "255.255.255.255", true},

		// Public IPs (should NOT be blocked)
		{"8.8.8.8 Google DNS", "8.8.8.8", false},
		{"1.1.1.1 Cloudflare DNS", "1.1.1.1", false},
		{"93.184.216.34 example.com", "93.184.216.34", false},
		{"151.101.1.140 GitHub", "151.101.1.140", false},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			ip := net.ParseIP(tc.ip)
			require.NotNil(t, ip, "IP should parse successfully")

			result := isPrivateIP(ip)
			assert.Equal(t, tc.expected, result,
				"IP %s should be private=%v", tc.ip, tc.expected)
		})
	}
}

// TestIsPrivateIP_PrivateIPv6Ranges verifies blocking of private IPv6 ranges
func TestIsPrivateIP_PrivateIPv6Ranges(t *testing.T) {
	testCases := []struct {
		name     string
		ip       string
		expected bool
	}{
		// IPv6 Loopback
		{"::1 loopback", "::1", true},

		// IPv6 Link-Local
		{"fe80::/10 start", "fe80::1", true},
		{"fe80::/10 mid", "fe80:1234::5678", true},

		// IPv6 Unique Local (RFC 4193)
		{"fc00::/7 start", "fc00::1", true},
		{"fc00::/7 mid", "fd12:3456:789a::1", true},

		// Public IPv6 (should NOT be blocked)
		{"2001:4860:4860::8888 Google DNS", "2001:4860:4860::8888", false},
		{"2606:4700:4700::1111 Cloudflare DNS", "2606:4700:4700::1111", false},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			ip := net.ParseIP(tc.ip)
			require.NotNil(t, ip, "IP should parse successfully")

			result := isPrivateIP(ip)
			assert.Equal(t, tc.expected, result,
				"IP %s should be private=%v", tc.ip, tc.expected)
		})
	}
}

// TestTestURLConnectivity_PrivateIP_Blocked verifies SSRF protection
func TestTestURLConnectivity_PrivateIP_Blocked(t *testing.T) {
	// Note: This test will fail if run on a system that actually resolves
	// these hostnames to private IPs. In a production test environment,
	// you might want to mock DNS resolution.
	testCases := []struct {
		name string
		url  string
	}{
		{"localhost", "http://localhost"},
		{"127.0.0.1", "http://127.0.0.1"},
		{"Private IP 10.x", "http://10.0.0.1"},
		{"Private IP 192.168.x", "http://192.168.1.1"},
		{"AWS metadata", "http://169.254.169.254"},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			reachable, _, err := TestURLConnectivity(tc.url)

			// Should fail with private IP error
			assert.Error(t, err)
			assert.False(t, reachable)
			assert.Contains(t, err.Error(), "private IP", "error should mention private IP blocking")
		})
	}
}

// TestTestURLConnectivity_SSRF_Protection_Comprehensive performs comprehensive SSRF tests
func TestTestURLConnectivity_SSRF_Protection_Comprehensive(t *testing.T) {
	if testing.Short() {
		t.Skip("Skipping comprehensive SSRF test in short mode")
	}

	// Test various SSRF attack vectors
	attackVectors := []string{
		"http://localhost:8080",
		"http://127.0.0.1:8080",
		"http://0.0.0.0:8080",
		"http://[::1]:8080",
		"http://169.254.169.254/latest/meta-data/",
		"http://metadata.google.internal/computeMetadata/v1/",
	}

	for _, url := range attackVectors {
		t.Run(url, func(t *testing.T) {
			reachable, _, err := TestURLConnectivity(url)

			// All should be blocked
			assert.Error(t, err, "SSRF attack vector should be blocked")
			assert.False(t, reachable)
		})
	}
}

// TestTestURLConnectivity_HTTPSSupport verifies HTTPS support
func TestTestURLConnectivity_HTTPSSupport(t *testing.T) {
	server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	// Note: This will likely fail due to self-signed cert in test server
	// but it demonstrates HTTPS support
	reachable, _, err := TestURLConnectivity(server.URL)

	// May fail due to cert validation, but should not panic
	if err != nil {
		t.Logf("HTTPS test failed (expected with self-signed cert): %v", err)
	} else {
		assert.True(t, reachable)
	}
}

// BenchmarkTestURLConnectivity benchmarks the connectivity test
func BenchmarkTestURLConnectivity(b *testing.B) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	defer server.Close()

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_, _, _ = TestURLConnectivity(server.URL)
	}
}

// BenchmarkIsPrivateIP benchmarks private IP checking
func BenchmarkIsPrivateIP(b *testing.B) {
	ip := net.ParseIP("192.168.1.1")

	b.ResetTimer()
	for i := 0; i < b.N; i++ {
		_ = isPrivateIP(ip)
	}
}