from __future__ import annotations

from typing import Any

from yuxi.channels.auth.ssrf_guard import (
    apply_ssrf_guard_defaults,
)
from yuxi.channels.auth.ssrf_guard import (
    check_response_size as _check_response_size,
)
from yuxi.channels.auth.ssrf_guard import (
    check_response_text as _check_response_text,
)
from yuxi.channels.auth.ssrf_guard import (
    is_private_url as _is_private_url,
)
from yuxi.channels.auth.ssrf_guard import (
    sanitize_transport_kwargs as _sanitize_transport_kwargs,
)
from yuxi.channels.auth.ssrf_guard import (
    validate_url_with_whitelist as _validate_url_with_whitelist,
)

_GOOGLE_CHAT_ALLOWED_HOSTS = [
    "*.googleapis.com",
    "*.google.com",
    "chat.googleapis.com",
    "oauth2.googleapis.com",
]


def sanitize_google_auth_init(kwargs: dict[str, Any]) -> dict[str, Any]:
    cleaned: dict[str, Any] = {}
    for key, value in kwargs.items():
        if key not in apply_ssrf_guard_defaults():
            cleaned[key] = value
    safe = _sanitize_transport_kwargs(cleaned)
    unsafe_defaults = apply_ssrf_guard_defaults()
    for k, v in unsafe_defaults.items():
        safe.setdefault(k, v)
    return safe


def sanitize_request_kwargs(kwargs: dict[str, Any]) -> dict[str, Any]:
    return _sanitize_transport_kwargs(kwargs)


def apply_ssrf_guard() -> dict[str, Any]:
    return apply_ssrf_guard_defaults()


def check_auth_response_size(data: bytes) -> bytes:
    return _check_response_size(data)


def check_auth_response_text(text: str) -> str:
    return _check_response_text(text)


def validate_outbound_url(url: str, allow_private: bool = False) -> str:
    return _validate_url_with_whitelist(
        url,
        allowed_hosts=_GOOGLE_CHAT_ALLOWED_HOSTS,
        enforce_https=True,
        allow_private=allow_private,
    )


def is_private_target(url: str) -> bool:
    return _is_private_url(url)