package url_safety

import "github.com/nexuscrm/kernel/pkg/ports"

// Allowlist implements ports.URLAllowlist using the package-level SSRF policy.
type Allowlist struct{}

// EnsureAllowed returns a non-nil error when rawURL is not an acceptable
// outbound destination per the SSRF policy (loopback, private, RFC 6598,
// special-use, etc.).
func (Allowlist) EnsureAllowed(rawURL string) error {
	return EnsureAllowedExternalURL(rawURL)
}

// Redact returns a log-safe representation of rawURL with query string,
// fragment, and userinfo removed.
func (Allowlist) Redact(rawURL string) string {
	return RedactURL(rawURL)
}

// RedactError returns err with any embedded *url.Error.URL replaced by Redact.
// Use this before logging or wrapping errors from outbound HTTP calls whose
// net/url.Error.Error() embeds the raw URL string verbatim.
func (Allowlist) RedactError(err error) error {
	return RedactURLError(err)
}

// NewAllowlist returns a ports.URLAllowlist backed by the package SSRF policy.
func NewAllowlist() ports.URLAllowlist {
	return Allowlist{}
}