package session

import (
	"net"
	"strings"
)

func NeedToLimitIP(user *CtxUser, path string) bool {
	return false
}

func AllowIP(ipNets []*net.IPNet, ips []net.IP, disableIPWhitelist bool) bool {
	if disableIPWhitelist {
		return true
	}

	if ips == nil {
		return false
	}

	count := 0
	for _, ip := range ips {
		for _, ipNet := range ipNets {
			if ipNet.Contains(ip) {
				count++
				break
			}
		}
	}

	return len(ips) == count
}

// SourceIPs splits the comma separated X-Forwarded-For header or returns the X-Real-Ip header or req.RemoteAddr,
// in that order, ignoring invalid IPs. It returns nil if all of these are empty or invalid.
func SourceIPs(hdrForwardedFor string) []net.IP {
	forwardedForIPs := []net.IP{}
	if hdrForwardedFor != "" {
		// X-Forwarded-For can be a csv of IPs in case of multiple proxies.
		// Use the first valid one.
		parts := strings.Split(hdrForwardedFor, ",")
		for _, part := range parts {
			ip := net.ParseIP(strings.TrimSpace(part))
			if ip != nil {
				forwardedForIPs = append(forwardedForIPs, ip)
			}
		}
	}
	if len(forwardedForIPs) > 0 {
		return forwardedForIPs
	}

	// Try the X-Real-Ip header.
	//if hdrRealIp != "" {
	//	ip := net.ParseIP(hdrRealIp)
	//	if ip != nil {
	//		return []net.IP{ip}
	//	}
	//}

	return nil
}