AI tool allowlists: SSRF and Tool Allowlists

# net/allow.py
from urllib.parse import urlparse
import ipaddress, socket

ALLOW_HOSTS = {"api.github.com", "docs.internal.example"}

def assert_safe_url(url: str):
    u = urlparse(url)
    if u.scheme != "https":
        raise ValueError("scheme")
    if u.hostname not in ALLOW_HOSTS:
        raise ValueError("host")
    infos = socket.getaddrinfo(u.hostname, 443)
    for info in infos:
        ip = ipaddress.ip_address(info[4][0])
        if ip.is_private or ip.is_loopback or ip.is_link_local:
            raise ValueError("blocked_ip")  # ✅ DNS rebinding defense

# block IMDS and RFC1918
deny 169.254.0.0/16;
deny 10.0.0.0/8;
deny 172.16.0.0/12;
deny 192.168.0.0/16;

export async function httpGet(url: string) {
  assertSafeUrl(url);
  return fetch(url, { redirect: "error" }); // ❌ no blind redirects
}