package web

import (
	"net"
	"net/http"
	"strings"
)

// requestIsHTTPS 识别直连 TLS，或仅信任本机反向代理传入的 HTTPS 标记。
// Admin 生产进程只监听 127.0.0.1，Nginx 在同机终止 TLS；不能无条件信任
// X-Forwarded-Proto，否则直接访问端口的客户端可以伪造安全来源。
func requestIsHTTPS(request *http.Request) bool {
	if request.TLS != nil {
		return true
	}
	host, _, err := net.SplitHostPort(request.RemoteAddr)
	if err != nil {
		return false
	}
	remoteIP := net.ParseIP(host)
	if remoteIP == nil || !remoteIP.IsLoopback() {
		return false
	}
	forwardedProto := strings.TrimSpace(strings.Split(request.Header.Get("X-Forwarded-Proto"), ",")[0])
	return strings.EqualFold(forwardedProto, "https")
}