"""Network-position allowlists for unauthenticated kiosk routes.

A kiosk route writes without a login. The device token (see the kiosk views)
covers unattended screens an administrator provisions once, but it does not fit
the other caller: somebody opening the kiosk page on their own PC, who never
logs in and whose browser nobody provisioned. Per-browser provisioning would
mean touching every PC on the floor and losing it again on the next reimage.
What those callers have in common is where they are on the network.

Fails closed, in every direction that matters:
  - an empty or absent setting matches nothing (the feature is off),
  - an unparseable caller address matches nothing,
  - a malformed entry in the list is skipped rather than widening the match.

SPOOF RESISTANCE IS A DEPLOYMENT PROPERTY, NOT A PROPERTY OF THIS CODE.
The caller address comes from client_ip(), which reads remote_addr and never
the raw X-Forwarded-For header - reading that header directly would let any
caller send 'X-Forwarded-For: <allowlisted-ip>' and walk straight through.
remote_addr is only the real client because of what sits in front of the app:
behind IIS the URL-Rewrite rule overwrites X-Forwarded-For with the real TCP
peer and ProxyFix resolves it into remote_addr (TRUSTED_PROXY_COUNT). Remove
that rule and IIS forwards whatever the caller sent; waitress trusts it because
it arrives from 127.0.0.1, remote_addr becomes attacker-controlled, and every
allowlist built on this becomes bypassable from anywhere on the network. It
does NOT fail closed in that case. The rewrite rule is the control. The
GE-Enforce client allowlist carries the same dependency.

Callers store plain CIDR strings rather than references to subnet records: a
site that does not run the network plugin still has to be able to configure
this, and a stored allowlist must not break when an inventory row is deleted.
"""

import ipaddress

from shopdb.utils.clientip import client_ip


def ip_in_cidrs(address, rawcidrs):
    """True when `address` falls inside any CIDR in the comma-separated list.

    Pure and side-effect free so it can be tested without a request context.
    """
    raw = (rawcidrs or '').strip()
    if not raw:
        return False
    try:
        caller = ipaddress.ip_address((address or '').strip())
    except ValueError:
        return False
    for part in raw.split(','):
        part = part.strip()
        if not part:
            continue
        try:
            if caller in ipaddress.ip_network(part, strict=False):
                return True
        except ValueError:
            continue
    return False


def request_ip_allowlisted(request_obj, rawcidrs):
    """True when the request's client address is inside the allowlist."""
    return ip_in_cidrs(client_ip(request_obj), rawcidrs)