"""
X-Forwarded-For فقط از ArvanCloud پذیرفته می‌شود (config.middleware.TrustedProxyMiddleware).

بازتولیدِ ۲۰۲۶-۱۰-۱۳ روی سرور: درخواستِ مستقیم به IPِ سرور با XFFِ تازه در هر بار، همه‌ی سقف‌های IP-محور را
دور می‌زد. X-Real-IP همان چیزی است که nginx از آدرسِ TCP می‌گذارد.
"""

from django.core.cache import cache
from django.test import RequestFactory, TestCase, override_settings
from rest_framework.throttling import BaseThrottle

from config.middleware import TrustedProxyMiddleware

ARVAN_EDGE = '37.32.19.8'


def _ident_after_middleware(**meta):
    request = RequestFactory().get('/api/health', **meta)
    seen = {}

    def view(req):
        seen['ident'] = BaseThrottle().get_ident(req)
        return None

    TrustedProxyMiddleware(view)(request)
    return seen['ident']


class TrustedProxyIdentTests(TestCase):
    def setUp(self):
        cache.clear()

    def test_request_through_arvan_uses_the_client_address(self):
        ident = _ident_after_middleware(
            HTTP_X_REAL_IP=ARVAN_EDGE, HTTP_X_FORWARDED_FOR=f'5.5.5.5, {ARVAN_EDGE}',
        )
        self.assertEqual(ident, '5.5.5.5')

    def test_direct_hit_ignores_a_forged_forwarded_for(self):
        for forged in ('1.2.3.4', '9.9.9.9, 1.2.3.4'):
            ident = _ident_after_middleware(
                HTTP_X_REAL_IP='203.0.113.7', HTTP_X_FORWARDED_FOR=f'{forged}, 203.0.113.7',
            )
            self.assertEqual(ident, '203.0.113.7')

    def test_direct_hit_is_logged_once_per_peer(self):
        with self.assertLogs('config.middleware', level='WARNING') as logs:
            for _ in range(3):
                _ident_after_middleware(
                    HTTP_X_REAL_IP='203.0.113.9', HTTP_X_FORWARDED_FOR='1.1.1.1, 203.0.113.9',
                )
        self.assertEqual(len(logs.records), 1)

    def test_without_nginx_header_nothing_changes(self):
        # runserverِ محلی: nginx نیست، پس X-Real-IP هم نیست.
        ident = _ident_after_middleware(REMOTE_ADDR='127.0.0.1')
        self.assertEqual(ident, '127.0.0.1')


@override_settings(ADMIN_LOGIN_MAX_ATTEMPTS=2)
class AdminLoginThrottleCannotBeDodgedTests(TestCase):
    def setUp(self):
        cache.clear()

    def test_rotating_forwarded_for_on_a_direct_hit_still_hits_the_limit(self):
        codes = [
            self.client.post(
                '/admin/login/', {'username': 'x', 'password': 'y'},
                HTTP_X_REAL_IP='203.0.113.7', HTTP_X_FORWARDED_FOR=f'10.0.{i}.1, 203.0.113.7',
            ).status_code
            for i in range(3)
        ]
        self.assertEqual(codes[-1], 429)