<?php

declare(strict_types=1);

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;

class NotPrivateIp implements ValidationRule
{
    /**
     * Run the validation rule.
     */
    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        if (empty($value)) {
            return;
        }

        // Resolve hostname to IP if it's not already an IP
        $ip = filter_var($value, FILTER_VALIDATE_IP) ? $value : gethostbyname($value);

        // If DNS resolution failed (returns the hostname unchanged), allow it through
        // The actual connection will fail later with a meaningful error
        if ($ip === $value && ! filter_var($value, FILTER_VALIDATE_IP)) {
            return;
        }

        if (static::isPrivateOrReserved($ip)) {
            $fail('The :attribute must not resolve to a private or reserved IP address.');
        }
    }

    /**
     * Check if an IP address is private or reserved.
     */
    public static function isPrivateOrReserved(string $ip): bool
    {
        return filter_var(
            $ip,
            FILTER_VALIDATE_IP,
            FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
        ) === false;
    }
}