package ports

// URLAllowlist is the SSRF allowlist contract.
//   - EnsureAllowed returns a non-nil error when the URL must not be dialed
//     (loopback, private ranges, RFC 6598 shared address space, etc.).
//   - Redact returns a log-safe representation of rawURL with query string,
//     fragment, and userinfo removed.
//   - RedactError returns a copy of err with any embedded *url.Error.URL field
//     replaced by Redact so secrets in composed URLs do not appear in logs or
//     error chains via Go's stdlib *url.Error.Error().
type URLAllowlist interface {
	EnsureAllowed(rawURL string) error
	Redact(rawURL string) string
	// RedactError returns err with any embedded *url.Error.URL replaced by
	// Redact. Use this before logging or wrapping errors from outbound HTTP
	// calls whose net/url.Error.Error() embeds the raw URL.
	RedactError(err error) error
}