"""How the parts kiosk decides a caller is admitted by network position.

The USB kiosk closed this on 2026-09-18 and this one did not, so the two read
differently for no reason anybody chose. The hole is the same one: a reverse
proxy normally sits ON the network a site enters in the allowlist, so a request
wearing the proxy's own address matched the range and was admitted while
carrying no evidence at all about who sent it.

Shape of the requests here matches production: the layer in front (IIS with the
X-Forwarded-For rewrite, or nginx plus ProxyFix) has already resolved the caller
into REMOTE_ADDR, and the app never reads the header itself.
"""

import pytest

from shopdb.core.models import Setting


PLANT = '10.134.48.17'
PLANT_CIDR = '10.134.48.0/23'
ELSEWHERE = '10.9.100.5'
# Inside the allowlisted range, which is where a proxy actually lives and the
# reason the un-subtracted check was wrong.
PROXY = '10.134.48.5'
PROXY_CIDR = '10.134.48.5/32'
KIOSK_TOKEN = 'parts-kiosk-admission-token'


def _set(key, value):
    Setting.set(key, value, valuetype='string', category='printedparts')


@pytest.fixture
def kiosk(app, db):
    _set('printedparts_kiosk_enabled', 'true')
    _set('printedparts_kiosk_token', KIOSK_TOKEN)
    _set('printedparts_kiosk_allowed_cidrs', '')
    _set('printedparts_kiosk_trusted_proxies', '')
    return app


def _open_from(app, address):
    """Ask the gate directly: it is the unit under test, not a route's shape.

    The request context comes from the REAL app, so Setting.get reaches the same
    database the fixture wrote to.
    """
    from plugins.printedparts.api.routes import _kiosk_open

    with app.test_request_context('/', environ_base={'REMOTE_ADDR': address}):
        return _kiosk_open()


def test_a_caller_on_an_allowed_network_is_admitted(kiosk):
    _set('printedparts_kiosk_allowed_cidrs', PLANT_CIDR)
    assert _open_from(kiosk, PLANT) is True


def test_a_caller_outside_every_allowed_network_is_refused(kiosk):
    _set('printedparts_kiosk_allowed_cidrs', PLANT_CIDR)
    assert _open_from(kiosk, ELSEWHERE) is False


def test_a_request_wearing_the_proxy_address_fails_closed(kiosk):
    """THE FIX. The proxy forwarded nothing, so its own address arrived - and it
    sits inside the allowlist. No evidence about the sender means refuse."""
    _set('printedparts_kiosk_allowed_cidrs', PLANT_CIDR)
    _set('printedparts_kiosk_trusted_proxies', PROXY_CIDR)
    assert _open_from(kiosk, PROXY) is False
    # ... and the feature still works for a real caller on the same network, or
    # the subtraction has taken the allowlist with it.
    assert _open_from(kiosk, PLANT) is True


def test_loopback_is_never_a_kiosk_client(kiosk):
    """Needs no configuration: no site's kiosk is the server itself. This is
    also the shape a misconfigured front end produces, where every request
    arrives as 127.0.0.1."""
    _set('printedparts_kiosk_allowed_cidrs', '127.0.0.0/8, ' + PLANT_CIDR)
    assert _open_from(kiosk, '127.0.0.1') is False


def test_the_kiosk_flag_still_governs(kiosk):
    """Network position admits nobody while the kiosk is off."""
    _set('printedparts_kiosk_allowed_cidrs', PLANT_CIDR)
    _set('printedparts_kiosk_enabled', 'false')
    assert _open_from(kiosk, PLANT) is False


def test_an_empty_allowlist_admits_nobody(kiosk):
    """Token-only, which is the shipped default."""
    assert _open_from(kiosk, PLANT) is False