Blame for sinetti_api/runtime_security.py

"""Server-owned hosting and loopback policy; forwarding headers confer no trust."""
from __future__ import annotations

import ipaddress
import os

from starlette.requests import Request
from sinetti_services.hosting import hosted_runtime


def local_loopback_request(request: Request) -> bool:
    if hosted_runtime() or os.environ.get("APP_BACKEND", "").strip().lower() != "local":
        return False
    peer = request.client.host if request.client else ""
    host = request.url.hostname or ""
    try:
        peer_loopback = ipaddress.ip_address(peer).is_loopback
        host_loopback = host.lower() == "localhost" or ipaddress.ip_address(host).is_loopback
    except ValueError:
        return False
    return peer_loopback and host_loopback