From e0f65d7ff582b32f1c7b5508bba8cda807aaae5f Mon Sep 17 00:00:00 2001
From: Dennis Fink
Date: Sat, 15 Aug 2026 20:54:53 +0200
Subject: feat(sender): add outgoing Webmention pipeline

Scan generated h-entry documents for Webmention targets and track source
revisions and delivery state in the database.

Discover target endpoints, send Webmentions asynchronously, and reconcile
updated, removed, restored, and deleted sources across scans.

Add authenticated views for inspecting sent Webmentions and make the scanner
schedule configurable.
---
 tests/test_url_security.py | 54 +++++++++++++++++++++++++++++++++++++---------
 1 file changed, 44 insertions(+), 10 deletions(-)

(limited to 'tests/test_url_security.py')

diff --git a/tests/test_url_security.py b/tests/test_url_security.py
index b10e6ff..ffa0378 100644
--- a/tests/test_url_security.py
+++ b/tests/test_url_security.py
@@ -1,11 +1,9 @@
 from unittest.mock import Mock, patch
 
+import dns.resolver
 import pytest
 
-from webmentions_ssg.url_security import (
-    NonPublicAddressError,
-    ensure_public_url,
-)
+from webmentions_ssg.url_security import AddressResolutionError, is_public_url
 
 
 @patch("webmentions_ssg.url_security.dns.resolver.resolve_name")
@@ -21,14 +19,50 @@ from webmentions_ssg.url_security import (
         ("http://169.254.169.254/", ["169.254.169.254"]),
         ("http://localhost/", ["127.0.0.1", "::1"]),
         ("http://internal.example/", ["192.168.1.10"]),
+        ("https://example.com/", ["93.184.216.34", "192.168.1.10"]),
+    ],
+)
+def test_is_public_url_returns_false_for_non_public_addresses(
+    resolve_name: Mock, url: str, resolved_addresses: list[str]
+) -> None:
+    resolve_name.return_value.addresses.return_value = resolved_addresses
+
+    assert not is_public_url(url)
+
+
+@patch("webmentions_ssg.url_security.dns.resolver.resolve_name")
+@pytest.mark.parametrize(
+    ("url", "resolved_addresses"),
+    [
+        ("https://example.com/", ["93.184.216.34"]),
+        (
+            "https://example.com/",
+            ["93.184.216.34", "2606:2800:220:1:248:1893:25c8:1946"],
+        ),
     ],
 )
-def test_ensure_public_url_rejects_non_public_addresses(
-    resolve_name: Mock,
-    url: str,
-    resolved_addresses: list[str],
+def test_is_public_url_returns_true_for_public_addresses(
+    resolve_name: Mock, url: str, resolved_addresses: list[str]
 ) -> None:
     resolve_name.return_value.addresses.return_value = resolved_addresses
 
-    with pytest.raises(NonPublicAddressError):
-        ensure_public_url(url)
+    assert is_public_url(url)
+
+
+@patch(
+    "webmentions_ssg.url_security.dns.resolver.resolve_name",
+    side_effect=dns.resolver.NXDOMAIN(),
+)
+def test_is_public_url_raises_for_resolution_failure(resolve_name: Mock) -> None:
+    with pytest.raises(AddressResolutionError, match="Could not resolve hostname"):
+        is_public_url("https://nonexistent.example/")
+
+    resolve_name.assert_called_once_with("nonexistent.example")
+
+
+@patch("webmentions_ssg.url_security.dns.resolver.resolve_name")
+def test_is_public_url_raises_when_url_has_no_hostname(resolve_name: Mock) -> None:
+    with pytest.raises(ValueError, match="No hostname was specified"):
+        is_public_url("/relative/url")
+
+    resolve_name.assert_not_called()
-- 
cgit v1.3.1