"""安全加固：工作流 callbackUrl 与请假 HTTP 回调门禁。"""
from __future__ import annotations

import pytest

from app.services.workflow_callback import (
    register_local_callback,
    validate_callback_url,
)


def test_validate_callback_url_rejects_http():
    with pytest.raises(ValueError, match="禁止 HTTP"):
        validate_callback_url("https://evil.example/callback")
    with pytest.raises(ValueError, match="禁止 HTTP"):
        validate_callback_url("http://169.254.169.254/latest/meta-data/")


def test_validate_callback_url_rejects_unregistered_path():
    with pytest.raises(ValueError, match="未注册"):
        validate_callback_url("/api/unknown/callback")


def test_validate_callback_url_allows_registered_local_path():
    path = "/api/test/security-callback"
    register_local_callback(path, lambda db, business_id, event: None)
    assert validate_callback_url(path) == path
    assert validate_callback_url("") is None
    assert validate_callback_url(None) is None


def test_validate_callback_url_rejects_relative_without_slash():
    with pytest.raises(ValueError, match="本地内部路径"):
        validate_callback_url("admin/leave/callback")