Keeps a user-supplied URL from making the server fetch what only it can
reach: loopback, the LAN, container networks or the cloud metadata endpoint
at 169.254.169.254. It tells private addresses from public ones, and
fetch.ts checks every hop with it.
Returns url's hostname without the brackets URL.hostname keeps around
an IPv6 literal: the address checks here read it, and fetch.ts hands it
to curl's --resolve.
Checks whether ip is an IPv4 or IPv6 address outside the public internet.
An IPv4 address carried in IPv6 is judged as IPv4. Anything that isn't an IP
address is false, so a hostname must be resolved first.
Checks whether the host of url is private without a DNS lookup: a private
IP address, or localhost and its subdomains. isValidHttpUrl uses it to
reject a link early; only resolvePublicAddress is a real guard.
Resolves the host of url and returns one of its addresses, all of which
must be public: the fetch may pick any of them. fetchWithTimeout calls it
before each hop.
Usage
import * as mod from "api/remote/public-address.ts";