from apps.api.src.security.password import hash_password, verify_password
from apps.api.src.security.encryption import encrypt_value, decrypt_value, mask_secret
from apps.api.src.security.ssrf import is_safe_url


def test_password_hash():
    pw = "super-secret-password"
    hashed = hash_password(pw)
    assert verify_password(pw, hashed)
    assert not verify_password("wrong", hashed)


def test_encryption():
    value = "api-token-secret"
    encrypted = encrypt_value(value)
    decrypted = decrypt_value(encrypted)
    assert decrypted == value


def test_mask_secret():
    assert mask_secret("1234567890", 4) == "******7890"


def test_ssrf_protection():
    assert not is_safe_url("http://localhost:8000")
    assert not is_safe_url("http://127.0.0.1/admin")
    assert not is_safe_url("http://10.0.0.1/admin")
    assert not is_safe_url("http://172.16.0.1/admin")
    assert not is_safe_url("http://192.168.1.1/admin")
    assert not is_safe_url("http://[::1]/admin")
    assert not is_safe_url("http://169.254.169.254")
    assert not is_safe_url("ftp://example.com")
    assert is_safe_url("https://example.com/api")