import CodexBarCoreimport Foundation#if canImport(FoundationNetworking)import FoundationNetworking#endifimport Testing @Suitestruct AzureEndpointOverrideSecurityTests {    @Test    func azureOpenAIEndpointOverrideMustBeHTTPSOrBareHost() throws {        let httpsURL = try #require(AzureOpenAISettingsReader.endpointURL(from: "https://proxy.example.com/base"))        #expect(httpsURL.absoluteString == "https://proxy.example.com/base")         let bareURL = try #require(AzureOpenAISettingsReader.endpointURL(from: "resource.openai.azure.com"))        #expect(bareURL.absoluteString == "https://resource.openai.azure.com")         let hostPortURL = try #require(AzureOpenAISettingsReader.endpointURL(from: "localhost:8443/openai"))        #expect(hostPortURL.absoluteString == "https://localhost:8443/openai")         let trimmedURL = try #require(AzureOpenAISettingsReader.endpointURL(from: " https://trimmed.example.com/base "))        #expect(trimmedURL.absoluteString == "https://trimmed.example.com/base")         #expect(AzureOpenAISettingsReader.endpointURL(from: "http://attacker.test") == nil)        #expect(AzureOpenAISettingsReader.endpointURL(from: "https://user:pass@proxy.example.com") == nil)        #expect(AzureOpenAISettingsReader.endpointURL(from: "https://proxy.example.com%2f.attacker.test") == nil)         #expect(throws: AzureOpenAISettingsError.invalidEndpointOverride(            AzureOpenAISettingsReader.endpointEnvironmentKey))        {            try AzureOpenAISettingsReader.validateEndpointOverrides(environment: [                AzureOpenAISettingsReader.endpointEnvironmentKey: "http://attacker.test",            ])        }    }     @Test    func azureOpenAIHTTPOverrideIsRejectedBeforeAPIKeyRequest() async throws {        let endpoint = try #require(URL(string: "http://127.0.0.1:31337"))        let transport = CapturingTransport { request in            Issue.record("Azure OpenAI should reject insecure endpoint overrides before sending api-key headers")            #expect(request.value(forHTTPHeaderField: "api-key") == nil)            throw CapturingTransportError.unexpectedRequest        }         do {            _ = try await AzureOpenAIUsageFetcher.fetchUsage(                apiKey: "AZURE_CANARY_KEY",                endpoint: endpoint,                deploymentName: "canary-deployment",                transport: transport,                updatedAt: Date(timeIntervalSince1970: 1_800_000_000))            Issue.record("Expected AzureOpenAIUsageError.invalidEndpointOverride")        } catch {            #expect(error as? AzureOpenAIUsageError == .invalidEndpointOverride(                AzureOpenAISettingsReader.endpointEnvironmentKey))        }    }} private enum CapturingTransportError: Error {    case unexpectedRequest} private struct CapturingTransport: ProviderHTTPTransport {    let handler: @Sendable (URLRequest) async throws -> (Data, URLResponse)     func data(for request: URLRequest) async throws -> (Data, URLResponse) {        try await self.handler(request)    }}