// SPDX-License-Identifier: AGPL-3.0-or-later

import type {IpInfoLookupResult} from '@pkgs/geoip/src/IpInfoService';
import {describe, expect, it} from 'vitest';
import {isHighCgnatBlastRadiusRisk, isSingleIpBanCandidate} from '../IpBanCgnatGuard';

function ipInfoResult(overrides: Partial<IpInfoLookupResult> = {}): IpInfoLookupResult {
	return {
		ip: '198.51.100.1',
		available: true,
		riskNote: 'test',
		geo: {
			countryCode: 'US',
			countryName: 'United States',
			continent: 'North America',
			continentCode: 'NA',
			region: null,
			regionCode: null,
			city: null,
			postalCode: null,
			timezone: null,
			latitude: null,
			longitude: null,
			accuracyRadiusKm: null,
		},
		asn: {
			asn: 'AS64500',
			number: 64500,
			name: 'Test ISP',
			domain: null,
			type: null,
		},
		mobile: {
			name: null,
			mcc: null,
			mnc: null,
		},
		anonymous: {
			isAnonymous: false,
			providerName: null,
			isVpn: false,
			isProxy: false,
			isResidentialProxy: false,
			isTor: false,
			isRelay: false,
			percentDaysSeen: null,
		},
		flags: {
			isAnycast: false,
			isHosting: false,
			isMobile: false,
			isSatellite: false,
		},
		...overrides,
	};
}

describe('IpBanCgnatGuard', () => {
	it('only treats single IP ban entries as CGNAT guard candidates', () => {
		expect(isSingleIpBanCandidate('198.51.100.10')).toBe(true);
		expect(isSingleIpBanCandidate('198.51.100.0/24')).toBe(false);
	});
	it('flags mobile carrier IPs as high blast-radius risk', () => {
		expect(
			isHighCgnatBlastRadiusRisk(
				ipInfoResult({
					mobile: {name: 'Example Mobile', mcc: '001', mnc: '01'},
					flags: {isAnycast: false, isHosting: false, isMobile: true, isSatellite: false},
				}),
			),
		).toBe(true);
	});
	it('does not exempt hosting or anonymous infrastructure', () => {
		expect(
			isHighCgnatBlastRadiusRisk(
				ipInfoResult({
					flags: {isAnycast: false, isHosting: true, isMobile: true, isSatellite: false},
				}),
			),
		).toBe(false);
		expect(
			isHighCgnatBlastRadiusRisk(
				ipInfoResult({
					anonymous: {
						isAnonymous: true,
						providerName: 'Example VPN',
						isVpn: true,
						isProxy: false,
						isResidentialProxy: false,
						isTor: false,
						isRelay: false,
						percentDaysSeen: null,
					},
					flags: {isAnycast: false, isHosting: false, isMobile: true, isSatellite: false},
				}),
			),
		).toBe(false);
	});
});
