# [CRUCIBLE-SEED]
# category: ssrf
# severity: high
# language: python
# expected: SSRF via aiohttp.ClientSession with user-controlled URL in async service

import aiohttp
from fastapi import FastAPI, Body
from pydantic import BaseModel

app = FastAPI()


class NotificationConfig(BaseModel):
    webhook_url: str    # user-controlled
    event_type: str
    secret: str = ""


class ImportRequest(BaseModel):
    data_url: str       # user-controlled source URL
    format: str = "json"


@app.post("/notifications/send")
async def send_notification(config: NotificationConfig):
    async with aiohttp.ClientSession() as session:
        # webhook_url from user — attacker targets http://10.0.0.1/admin
        async with session.post(
            config.webhook_url,
            json={"event": config.event_type},
            headers={"X-Secret": config.secret},
            timeout=aiohttp.ClientTimeout(total=10),
            allow_redirects=True,  # follows redirects — pivot to internal
        ) as resp:
            return {"status": resp.status}


@app.post("/data/import")
async def import_data(req: ImportRequest):
    async with aiohttp.ClientSession() as session:
        async with session.get(req.data_url) as resp:
            data = await resp.text()
    return {"preview": data[:500], "format": req.format}