package mirror

import (
	"fmt"
	"net/http"
	"net/netip"
	"net/url"

	"gitea.mynodes.xyz/ilker/llmgw/internal/safedial"
)

// errPrivateSource is a fetch refused because it would reach this machine or
// the network behind it rather than the internet.
var errPrivateSource = safedial.ErrBlocked

// fetchClient downloads sources for the management API.
//
// The API fetches whatever URL it is given and the file server then hands the
// result to anyone. Without this, "fetch http://169.254.169.254/..." was a way
// to read a cloud's instance metadata — or anything else on the network the
// mirror sits in — through the mirror. No overall timeout: a model is tens of
// gigabytes, and after the first byte a stall is the context's to end.
func fetchClient(allowPrivate bool) *http.Client {
	if allowPrivate {
		return safedial.Client(safedial.Policy{Private: true, Loopback: true, LinkLocal: true}, 0)
	}
	return safedial.Client(safedial.Policy{}, 0)
}

func blockedAddr(a netip.Addr) bool { return safedial.Blocked(a, safedial.Policy{}) }

func checkScheme(u *url.URL) error { return safedial.CheckScheme(u) }

// validSource checks a source before a download is started for it.
func validSource(source string) error {
	u, err := url.Parse(source)
	if err != nil || u.Host == "" {
		return fmt.Errorf("%q is not a URL", source)
	}
	return checkScheme(u)
}