"""The reverse-proxy boundary must reject client-supplied forwarding metadata."""

from __future__ import annotations

import asyncio
from typing import Any

from uvicorn.middleware.proxy_headers import ProxyHeadersMiddleware


def _resolved_client(*, peer: str, trusted: tuple[str, ...]) -> tuple[str, int]:
    seen: dict[str, tuple[str, int]] = {}

    async def app(scope: dict[str, Any], receive: Any, send: Any) -> None:
        seen["client"] = scope["client"]

    async def receive() -> dict[str, str]:
        return {"type": "http.disconnect"}

    async def send(message: dict[str, Any]) -> None:
        return None

    middleware = ProxyHeadersMiddleware(app, trusted_hosts=list(trusted))
    scope: dict[str, Any] = {
        "type": "http",
        "scheme": "http",
        "client": (peer, 50000),
        "headers": [(b"x-forwarded-for", b"203.0.113.25")],
    }
    asyncio.run(middleware(scope, receive, send))
    return seen["client"]


def test_untrusted_peer_cannot_spoof_the_rate_limit_client_identity() -> None:
    assert _resolved_client(peer="192.168.10.55", trusted=("172.30.50.2",)) == (
        "192.168.10.55",
        50000,
    )


def test_docker_gateway_cannot_spoof_client_identity() -> None:
    assert _resolved_client(peer="172.30.50.1", trusted=("172.30.50.2",)) == (
        "172.30.50.1",
        50000,
    )


def test_trusted_proxy_can_forward_the_real_client_identity() -> None:
    assert _resolved_client(peer="172.30.50.2", trusted=("172.30.50.2",)) == (
        "203.0.113.25",
        0,
    )