validate_user_configured_service_url (utils/url_security.py)

Validates user‑supplied service URLs, blocking private or localhost addresses in SaaS mode.

# Source: https://github.com/dograh-hq/dograh | License: BSD-2-Clause | Copyright 2025, Zansat Technologies Private Limited
# Provided via justclaw.it.com; keep this notice with the code.
import ipaddress
import socket
from urllib.parse import urlparse

from api.constants import DEPLOYMENT_MODE

_CGNAT_NETWORK = ipaddress.ip_network("100.64.0.0/10")


def validate_user_configured_service_url(
    url: str,
    *,
    field_name: str,
) -> None:
    """Restrict user-configured service URLs in hosted deployments.

    OSS deployments commonly point model services at localhost or private LAN
    hosts. SaaS deployments must not allow users to make Dograh infrastructure
    connect to private/internal network locations.
    """
    if DEPLOYMENT_MODE == "oss":
        return

    parsed = urlp

... (truncated -- full source via MCP)