"""Run: python3 test_client_ip.py. Real client IP is trusted only from configured proxy hops."""
import http.client
import threading

from honeypot import Engine, Server
from trusted_proxy import forwarded_client

assert forwarded_client({'CF-Connecting-IP': '8.8.8.8'}) == ('8.8.8.8', 'CF-Connecting-IP')
assert forwarded_client({'CF-Connecting-IP': '10.0.0.1', 'X-Forwarded-For': '1.1.1.1'}) == ('1.1.1.1', 'X-Forwarded-For')
assert forwarded_client({'X-Forwarded-For': '10.0.0.1, 9.9.9.9, 10.0.0.2'}) == ('9.9.9.9', 'X-Forwarded-For')
assert forwarded_client({'CF-Connecting-IP': 'not-an-ip'}) == (None, None)
assert forwarded_client({}) == (None, None)


def run(trusted):
    rows = []
    engine = Engine(lambda event, **data: rows.append(dict(event=event, **data)), delay=0)
    server = Server(('127.0.0.1', 0), engine, trusted_forwarded=trusted)
    thread = threading.Thread(target=server.serve_forever, daemon=True)
    thread.start()
    try:
        connection = http.client.HTTPConnection('127.0.0.1', server.server_port, timeout=3)
        connection.request('GET', '/', headers={'CF-Connecting-IP': '8.8.8.8',
                                                 'X-Forwarded-For': '10.0.0.1, 1.1.1.1'})
        assert connection.getresponse().status == 200
        connection.close()
    finally:
        server.shutdown()
        server.server_close()
        thread.join(3)
    return next(row for row in rows if row['event'] == 'request')


# Untrusted hop: the spoofable header is ignored and the socket peer is authoritative.
assert run(()).get('peer') == '127.0.0.1'
# Trusted hop (loopback stands in for the edge proxy): the real client IP wins, proxy is retained.
request = run(('127.0.0.0/8',))
assert request['peer'] == '8.8.8.8' and request['client_ip_source'] == 'CF-Connecting-IP'
assert request['proxy_peer'] == '127.0.0.1'
print('PASS: forwarded client IP trusted only from configured proxies; spoofing rejected')