package exploit

import "github.com/Armur-Ai/Pentest-Swarm-AI/internal/swarm/verify"

// openRedirectSentinel is the attacker-controlled URL injected to test for an
// open redirect. The .invalid TLD (RFC 6761) never resolves, so the probe is
// safe — we only observe whether the target's Location header points here, never
// actually sending a victim anywhere real.
const openRedirectSentinel = "https://evil.pentestswarm.invalid/pstest"

// OpenRedirectSpec builds an open-redirect re-proof recipe: it places the
// sentinel attacker URL at a redirect-sink parameter. The redirect oracle sends
// it (without following) and proves the finding iff the response is a 3xx whose
// Location points at the sentinel host — i.e. the parameter controls the
// redirect target. Reuses the SSRF request builder (same query-marking) and the
// SSRF sink detector (url/redirect/next/return/... params).
//
// targetURL is the endpoint; param is the redirect-sink parameter; authHeader is
// an optional session credential. Returns an error if invalid.
func OpenRedirectSpec(targetURL, param, authHeader string) (*verify.ProbeSpec, error) {
	raw, err := ssrfRawRequest(targetURL, param, authHeader)
	if err != nil {
		return nil, err
	}
	// Differential class so the raw/marker machinery applies; the redirect oracle
	// reads AttackPayload as the sentinel URL. ControlPayload is a benign path
	// (unused by the redirect oracle) that keeps the spec valid.
	return verify.NewDifferentialSpec(raw, "", openRedirectSentinel, "/", "")
}