package egress

import (
	"net"
	"net/http"
	"time"
)

// NewGuardedTransport returns an HTTP transport whose DialContext refuses
// non-public destinations (the SSRF guard shared with External execution). It
// is the default dial path for trusted Builtin provider clients; tests inject
// their own transport instead of weakening the guard.
func NewGuardedTransport() *http.Transport {
	config := Config{}
	return newGuardedTransport(config)
}

// NewGuardedTransportForCIDRs returns the standard guarded provider transport
// with a target-scoped allowance for explicitly configured address ranges.
// Loopback, link-local, multicast, unspecified, and metadata endpoints remain
// denied even when a broad configured range contains them.
func NewGuardedTransportForCIDRs(allowedCIDRs []*net.IPNet) *http.Transport {
	config := Config{TargetNetworks: allowedCIDRs}
	return newGuardedTransport(config)
}

// NewGuardedTransportForPrivateOrigin returns a transport for one immutable
// administrator-configured provider origin. RFC1918 and IPv6 ULA destinations
// are allowed, while loopback, link-local, CGNAT, metadata, multicast, and
// other mandatory-deny classes remain blocked. DNS is resolved on every dial.
func NewGuardedTransportForPrivateOrigin() *http.Transport {
	config := Config{AllowPrivate: true}
	return newGuardedTransport(config)
}

func newGuardedTransport(config Config) *http.Transport {
	guarded := newGuardedDialer(config)
	return &http.Transport{
		Proxy:                 nil,
		DialContext:           guarded.DialContext,
		ForceAttemptHTTP2:     true,
		MaxIdleConns:          16,
		MaxIdleConnsPerHost:   4,
		IdleConnTimeout:       60 * time.Second,
		TLSHandshakeTimeout:   10 * time.Second,
		ExpectContinueTimeout: time.Second,
		DisableCompression:    true,
	}
}