import assert from 'node:assert/strict'
import type { FastifyRequest } from 'fastify'
import { getClientIp, resetClientIpConfigForTests } from '../src/common/http/client-ip'

function mockReq(peer: string, headers: Record<string, string | undefined> = {}): FastifyRequest {
  return {
    socket: { remoteAddress: peer },
    headers,
  } as FastifyRequest
}

resetClientIpConfigForTests()
process.env.TRUST_PROXY = 'true'

const untrustedPeer = '203.0.113.50'
const trustedPeer = '172.20.0.5'

assert.equal(
  getClientIp(mockReq(untrustedPeer, { 'x-forwarded-for': '1.2.3.4' })),
  untrustedPeer,
  'untrusted peer must ignore forged XFF',
)

assert.equal(
  getClientIp(mockReq(trustedPeer, { 'x-forwarded-for': '198.51.100.10' })),
  '198.51.100.10',
  'trusted proxy peer may use first XFF hop',
)

delete process.env.TRUST_PROXY
assert.equal(
  getClientIp(mockReq(trustedPeer, { 'x-forwarded-for': '198.51.100.10' })),
  trustedPeer,
  'TRUST_PROXY off ignores XFF even from docker peer',
)

console.log('client-ip tests passed')