# [CRUCIBLE-SEED]
# category: ssrf
# severity: high
# language: python
# expected: SSRF via httpx.get with user-controlled URL and redirect following

import httpx
from fastapi import FastAPI, Query
from fastapi.responses import JSONResponse

app = FastAPI()


@app.get("/import/data")
async def import_data(source: str = Query(...)):
    # source from user — can be internal URL or cloud metadata endpoint
    async with httpx.AsyncClient(follow_redirects=True, timeout=10.0) as client:
        resp = await client.get(source)
        return JSONResponse({"status": resp.status_code, "preview": resp.text[:500]})


@app.post("/oembed")
async def fetch_oembed(url: str = Query(...), provider: str = Query(...)):
    # provider is an oembed endpoint from user — SSRF to internal services
    oembed_url = f"{provider}?url={url}&format=json"
    async with httpx.AsyncClient(timeout=8.0) as client:
        resp = await client.get(oembed_url)
        return resp.json()


@app.get("/link-preview")
async def link_preview(target: str = Query(...)):
    async with httpx.AsyncClient(timeout=5.0, follow_redirects=True) as client:
        resp = await client.get(target)
    title = resp.text.split("<title>")[1].split("</title>")[0] if "<title>" in resp.text else ""
    return {"title": title, "url": target}