using System.Net;

namespace w4c_workflows.Services.Security;

/// <summary>
/// Resolves a host name to the addresses a request could actually reach.
/// Abstracted so the egress guard can be unit-tested without touching DNS.
/// </summary>
public interface IHostAddressResolver
{
    Task<IReadOnlyList<IPAddress>> ResolveAsync(string host, CancellationToken ct);
}

/// <summary>Production resolver backed by <see cref="Dns"/>.</summary>
public sealed class DnsHostAddressResolver : IHostAddressResolver
{
    public async Task<IReadOnlyList<IPAddress>> ResolveAsync(string host, CancellationToken ct)
        => await Dns.GetHostAddressesAsync(host, ct);
}