we / crates / net / src / client.rs

//! High-level HTTP client with connection pooling and HTTP/2 support.
//!
//! Brings together TCP, TLS 1.3, DNS, URL parsing, HTTP/1.1, and HTTP/2
//! into a single `HttpClient` that can fetch HTTP and HTTPS URLs.
//! When connecting over TLS, ALPN negotiation automatically selects HTTP/2
//! if the server supports it, falling back to HTTP/1.1 otherwise.

use std::collections::HashMap;
use std::fmt;
use std::io;
use std::time::{Duration, Instant};

use we_url::Url;

use crate::cookie::{CookieJar, RequestContext};
use crate::http::{self, Headers, HttpResponse, Method};
use crate::http2::connection::Http2Connection;
use crate::http2::frame::Http2Error;
use crate::tcp::{self, TcpConnection};
use crate::tls::handshake::{self, HandshakeError, TlsStream};

// ---------------------------------------------------------------------------
// Constants
// ---------------------------------------------------------------------------

const DEFAULT_MAX_REDIRECTS: u32 = 20;
const DEFAULT_CONNECT_TIMEOUT: Duration = Duration::from_secs(30);
const DEFAULT_READ_TIMEOUT: Duration = Duration::from_secs(30);
const DEFAULT_MAX_IDLE_TIME: Duration = Duration::from_secs(60);
const DEFAULT_MAX_PER_HOST: usize = 6;
const READ_BUF_SIZE: usize = 8192;

// ---------------------------------------------------------------------------
// Error type
// ---------------------------------------------------------------------------

/// Errors that can occur during an HTTP client operation.
#[derive(Debug)]
pub enum ClientError {
    /// URL is invalid or missing required components.
    InvalidUrl(String),
    /// Unsupported URL scheme.
    UnsupportedScheme(String),
    /// TCP connection error.
    Tcp(tcp::NetError),
    /// TLS handshake error.
    Tls(HandshakeError),
    /// HTTP parsing error.
    Http(http::HttpError),
    /// Too many redirects.
    TooManyRedirects,
    /// Redirect loop detected.
    RedirectLoop,
    /// HTTP/2 protocol error.
    Http2(Http2Error),
    /// Connection was closed unexpectedly.
    ConnectionClosed,
    /// I/O error.
    Io(io::Error),
}

impl fmt::Display for ClientError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::InvalidUrl(s) => write!(f, "invalid URL: {s}"),
            Self::UnsupportedScheme(s) => write!(f, "unsupported scheme: {s}"),
            Self::Tcp(e) => write!(f, "TCP error: {e}"),
            Self::Tls(e) => write!(f, "TLS error: {e}"),
            Self::Http(e) => write!(f, "HTTP error: {e}"),
            Self::TooManyRedirects => write!(f, "too many redirects"),
            Self::RedirectLoop => write!(f, "redirect loop detected"),
            Self::Http2(e) => write!(f, "HTTP/2 error: {e}"),
            Self::ConnectionClosed => write!(f, "connection closed"),
            Self::Io(e) => write!(f, "I/O error: {e}"),
        }
    }
}

impl From<tcp::NetError> for ClientError {
    fn from(e: tcp::NetError) -> Self {
        Self::Tcp(e)
    }
}

impl From<HandshakeError> for ClientError {
    fn from(e: HandshakeError) -> Self {
        Self::Tls(e)
    }
}

impl From<http::HttpError> for ClientError {
    fn from(e: http::HttpError) -> Self {
        Self::Http(e)
    }
}

impl From<io::Error> for ClientError {
    fn from(e: io::Error) -> Self {
        Self::Io(e)
    }
}

impl From<Http2Error> for ClientError {
    fn from(e: Http2Error) -> Self {
        Self::Http2(e)
    }
}

pub type Result<T> = std::result::Result<T, ClientError>;

// ---------------------------------------------------------------------------
// Connection abstraction
// ---------------------------------------------------------------------------

/// A connection that can be either plain TCP or TLS-encrypted.
enum Connection {
    Plain(TcpConnection),
    Tls(TlsStream<TcpConnection>),
}

impl Connection {
    fn read(&mut self, buf: &mut [u8]) -> Result<usize> {
        match self {
            Self::Plain(tcp) => tcp.read(buf).map_err(ClientError::Tcp),
            Self::Tls(tls) => tls.read(buf).map_err(ClientError::Tls),
        }
    }

    fn write_all(&mut self, data: &[u8]) -> Result<()> {
        match self {
            Self::Plain(tcp) => tcp.write_all(data).map_err(ClientError::Tcp),
            Self::Tls(tls) => tls.write_all(data).map_err(ClientError::Tls),
        }
    }

    fn flush(&mut self) -> Result<()> {
        match self {
            Self::Plain(tcp) => tcp.flush().map_err(ClientError::Tcp),
            Self::Tls(_) => Ok(()), // TLS writes are flushed per record
        }
    }

    fn set_read_timeout(&self, duration: Option<Duration>) -> Result<()> {
        match self {
            Self::Plain(tcp) => tcp.set_read_timeout(duration).map_err(ClientError::Tcp),
            Self::Tls(tls) => tls
                .stream()
                .set_read_timeout(duration)
                .map_err(ClientError::Tcp),
        }
    }
}

// ---------------------------------------------------------------------------
// Connection pool
// ---------------------------------------------------------------------------

/// Key for pooling connections by origin.
#[derive(Hash, Eq, PartialEq, Clone, Debug)]
struct ConnectionKey {
    host: String,
    port: u16,
    is_tls: bool,
}

/// A pooled connection with its idle timestamp.
struct PooledConnection {
    conn: Connection,
    idle_since: Instant,
}

/// Pool of idle HTTP connections for reuse.
struct ConnectionPool {
    connections: HashMap<ConnectionKey, Vec<PooledConnection>>,
    max_idle_time: Duration,
    max_per_host: usize,
}

impl ConnectionPool {
    fn new(max_idle_time: Duration, max_per_host: usize) -> Self {
        Self {
            connections: HashMap::new(),
            max_idle_time,
            max_per_host,
        }
    }

    /// Take an idle connection for the given key, if one is available.
    fn take(&mut self, key: &ConnectionKey) -> Option<Connection> {
        let entries = self.connections.get_mut(key)?;
        let now = Instant::now();

        // Remove expired connections
        entries.retain(|pc| now.duration_since(pc.idle_since) < self.max_idle_time);

        // Take the most recently idled connection
        entries.pop().map(|pc| pc.conn)
    }

    /// Return a connection to the pool.
    fn put(&mut self, key: ConnectionKey, conn: Connection) {
        let entries = self.connections.entry(key).or_default();

        // Evict oldest if at capacity
        if entries.len() >= self.max_per_host {
            entries.remove(0);
        }

        entries.push(PooledConnection {
            conn,
            idle_since: Instant::now(),
        });
    }
}

// ---------------------------------------------------------------------------
// HttpClient
// ---------------------------------------------------------------------------

/// Key for HTTP/2 connection pooling (one multiplexed connection per origin).
#[derive(Hash, Eq, PartialEq, Clone, Debug)]
struct H2ConnectionKey {
    host: String,
    port: u16,
}

/// High-level HTTP client with connection pooling, HTTP/2 support, redirect following, and cookie jar.
pub struct HttpClient {
    pool: ConnectionPool,
    h2_connections: HashMap<H2ConnectionKey, Http2Connection<TlsStream<TcpConnection>>>,
    max_redirects: u32,
    connect_timeout: Duration,
    read_timeout: Duration,
    cookie_jar: CookieJar,
}

impl HttpClient {
    /// Create a new HTTP client with default settings.
    pub fn new() -> Self {
        Self {
            pool: ConnectionPool::new(DEFAULT_MAX_IDLE_TIME, DEFAULT_MAX_PER_HOST),
            h2_connections: HashMap::new(),
            max_redirects: DEFAULT_MAX_REDIRECTS,
            connect_timeout: DEFAULT_CONNECT_TIMEOUT,
            read_timeout: DEFAULT_READ_TIMEOUT,
            cookie_jar: CookieJar::new(),
        }
    }

    /// Estimated heap bytes used by the HTTP client's connection pool and buffers.
    pub fn memory_usage(&self) -> usize {
        use std::mem::size_of;
        let pool_conns: usize = self
            .pool
            .connections
            .iter()
            .map(|(k, v)| k.host.capacity() + v.capacity() * size_of::<PooledConnection>())
            .sum();
        let pool_overhead = self.pool.connections.capacity()
            * (size_of::<ConnectionKey>() + size_of::<Vec<PooledConnection>>() + 8);
        let h2_conns = self.h2_connections.capacity() * (size_of::<H2ConnectionKey>() + 256); // estimate for Http2Connection
        let h2_keys: usize = self.h2_connections.keys().map(|k| k.host.capacity()).sum();
        pool_conns + pool_overhead + h2_conns + h2_keys
    }

    /// Number of pooled idle HTTP/1.1 connections.
    pub fn pooled_connection_count(&self) -> usize {
        self.pool.connections.values().map(|v| v.len()).sum()
    }

    /// Number of active HTTP/2 connections.
    pub fn h2_connection_count(&self) -> usize {
        self.h2_connections.len()
    }

    /// Get a reference to the cookie jar.
    pub fn cookie_jar(&self) -> &CookieJar {
        &self.cookie_jar
    }

    /// Get a mutable reference to the cookie jar.
    pub fn cookie_jar_mut(&mut self) -> &mut CookieJar {
        &mut self.cookie_jar
    }

    /// Set the maximum number of redirects to follow.
    pub fn set_max_redirects(&mut self, max: u32) {
        self.max_redirects = max;
    }

    /// Set the connection timeout.
    pub fn set_connect_timeout(&mut self, timeout: Duration) {
        self.connect_timeout = timeout;
    }

    /// Set the read timeout.
    pub fn set_read_timeout(&mut self, timeout: Duration) {
        self.read_timeout = timeout;
    }

    /// Perform an HTTP GET request.
    pub fn get(&mut self, url: &Url) -> Result<HttpResponse> {
        self.request(Method::Get, url, &Headers::new(), None)
    }

    /// Perform an HTTP POST request.
    pub fn post(&mut self, url: &Url, body: &[u8], content_type: &str) -> Result<HttpResponse> {
        let mut headers = Headers::new();
        headers.add("Content-Type", content_type);
        self.request(Method::Post, url, &headers, Some(body))
    }

    /// Perform an HTTP request with full control over method, headers, and body.
    ///
    /// Follows redirects (301, 302, 303, 307, 308) up to `max_redirects`.
    ///
    /// - 301/302/303: method changes to GET, body is dropped
    /// - 307/308: original method and body are preserved
    /// - Cross-origin redirects strip the `Authorization` header
    /// - Redirect loops are detected and produce an error
    pub fn request(
        &mut self,
        method: Method,
        url: &Url,
        headers: &Headers,
        body: Option<&[u8]>,
    ) -> Result<HttpResponse> {
        let mut current_url = url.clone();
        let mut current_method = method;
        let mut current_body = body.map(|b| b.to_vec());
        let mut current_headers = headers.clone();
        let mut redirects = 0u32;
        let original_origin = url.origin();
        let mut visited_urls = vec![current_url.serialize()];

        loop {
            let resp = self.execute_request(
                current_method,
                &current_url,
                &current_headers,
                current_body.as_deref(),
            )?;

            // Check for redirects
            if is_redirect_status(resp.status_code) {
                redirects += 1;
                if redirects > self.max_redirects {
                    return Err(ClientError::TooManyRedirects);
                }

                if let Some(location) = resp.headers.get("Location") {
                    // Resolve relative URLs against current URL
                    let next_url = Url::parse_with_base(location, &current_url)
                        .or_else(|_| Url::parse(location))
                        .map_err(|_| {
                            ClientError::InvalidUrl(format!(
                                "invalid redirect location: {location}"
                            ))
                        })?;

                    // Detect redirect loops
                    let next_serialized = next_url.serialize();
                    if visited_urls.contains(&next_serialized) {
                        return Err(ClientError::RedirectLoop);
                    }
                    visited_urls.push(next_serialized);

                    // Handle method changes per HTTP spec
                    current_method = redirect_method(resp.status_code, current_method);
                    if !redirect_preserves_body(resp.status_code) {
                        current_body = None;
                    }

                    // Strip Authorization header on cross-origin redirects
                    if !next_url.origin().same_origin(&original_origin) {
                        current_headers.remove("Authorization");
                    }

                    current_url = next_url;
                    continue;
                }
            }

            // Attach redirect metadata to the response
            let mut resp = resp;
            if redirects > 0 {
                resp.redirected = true;
                resp.final_url = Some(current_url.serialize());
            }

            return Ok(resp);
        }
    }

    /// Execute a single HTTP request (no redirect following).
    fn execute_request(
        &mut self,
        method: Method,
        url: &Url,
        headers: &Headers,
        body: Option<&[u8]>,
    ) -> Result<HttpResponse> {
        let scheme = url.scheme();
        let is_tls = match scheme {
            "https" => true,
            "http" => false,
            other => return Err(ClientError::UnsupportedScheme(other.to_string())),
        };

        let host = url
            .host_str()
            .ok_or_else(|| ClientError::InvalidUrl("missing host".to_string()))?;

        let port = url
            .port_or_default()
            .ok_or_else(|| ClientError::InvalidUrl("cannot determine port".to_string()))?;

        let path = request_path(url);

        // Build request headers, attaching cookies from the jar.
        let mut merged_headers = Headers::new();
        for (name, value) in headers.iter() {
            merged_headers.add(name, value);
        }
        if !merged_headers.contains("Cookie") {
            if let Some(cookie_val) = self
                .cookie_jar
                .cookie_header_value(url, RequestContext::SameSite)
            {
                merged_headers.add("Cookie", &cookie_val);
            }
        }

        // Try HTTP/2 for TLS connections
        if is_tls {
            let h2_key = H2ConnectionKey {
                host: host.clone(),
                port,
            };

            // Check if we have an existing HTTP/2 connection for this origin
            if self.h2_connections.contains_key(&h2_key) {
                let response = self.execute_h2_request(
                    &h2_key,
                    method,
                    &path,
                    &host,
                    &merged_headers,
                    body,
                    url,
                );

                match response {
                    Ok(resp) => return Ok(resp),
                    Err(ClientError::Http2(_)) => {
                        // HTTP/2 connection failed — remove it and fall through to new connection
                        self.h2_connections.remove(&h2_key);
                    }
                    Err(e) => return Err(e),
                }
            }

            // Try to establish a new connection with ALPN
            let tcp = TcpConnection::connect_timeout(&host, port, self.connect_timeout)?;
            let (tls, alpn) = handshake::connect_with_alpn(tcp, &host, &["h2", "http/1.1"])?;

            if alpn.as_deref() == Some("h2") {
                // HTTP/2 negotiated — create HTTP/2 connection
                let h2_conn = Http2Connection::new(tls)?;
                self.h2_connections.insert(h2_key.clone(), h2_conn);

                return self.execute_h2_request(
                    &h2_key,
                    method,
                    &path,
                    &host,
                    &merged_headers,
                    body,
                    url,
                );
            }

            // HTTP/1.1 over TLS — use normal path
            let conn = Connection::Tls(tls);
            return self.execute_h1_request(conn, method, &path, &host, &merged_headers, body, url);
        }

        // Plain HTTP (no TLS) — always HTTP/1.1
        let key = ConnectionKey {
            host: host.clone(),
            port,
            is_tls: false,
        };

        let conn = match self.pool.take(&key) {
            Some(conn) => conn,
            None => {
                let tcp = TcpConnection::connect_timeout(&host, port, self.connect_timeout)?;
                Connection::Plain(tcp)
            }
        };

        self.execute_h1_request(conn, method, &path, &host, &merged_headers, body, url)
    }

    /// Execute an HTTP/1.1 request over the given connection.
    #[allow(clippy::too_many_arguments)]
    fn execute_h1_request(
        &mut self,
        mut conn: Connection,
        method: Method,
        path: &str,
        host: &str,
        headers: &Headers,
        body: Option<&[u8]>,
        url: &Url,
    ) -> Result<HttpResponse> {
        conn.set_read_timeout(Some(self.read_timeout))?;

        let request_bytes = http::serialize_request(method, path, host, headers, body);
        conn.write_all(&request_bytes)?;
        conn.flush()?;

        let response = read_response(&mut conn)?;

        // Store Set-Cookie headers
        let set_cookies: Vec<String> = response
            .headers
            .get_all("Set-Cookie")
            .into_iter()
            .map(|s| s.to_string())
            .collect();
        for header in &set_cookies {
            self.cookie_jar.store_from_header(header, url);
        }

        // Return connection to pool if keep-alive
        if !response.connection_close() {
            // Determine the connection key for pooling
            let is_tls = matches!(conn, Connection::Tls(_));
            let port = url
                .port_or_default()
                .unwrap_or(if is_tls { 443 } else { 80 });
            let key = ConnectionKey {
                host: host.to_string(),
                port,
                is_tls,
            };
            self.pool.put(key, conn);
        }

        Ok(response)
    }

    /// Execute a request over an existing HTTP/2 connection.
    #[allow(clippy::too_many_arguments)]
    fn execute_h2_request(
        &mut self,
        h2_key: &H2ConnectionKey,
        method: Method,
        path: &str,
        authority: &str,
        headers: &Headers,
        body: Option<&[u8]>,
        url: &Url,
    ) -> Result<HttpResponse> {
        let extra_headers: Vec<(String, String)> = headers
            .iter()
            .filter(|(name, _)| {
                // Skip pseudo-headers and host (authority is used instead)
                let lower = name.to_ascii_lowercase();
                lower != "host" && lower != "connection" && lower != "transfer-encoding"
            })
            .map(|(name, value)| (name.to_ascii_lowercase(), value.to_string()))
            .collect();

        let h2_conn = self.h2_connections.get_mut(h2_key).unwrap();

        let stream_id =
            h2_conn.send_request(method.as_str(), path, authority, &extra_headers, body)?;

        let (resp_headers, resp_body, status_code) = h2_conn.read_response(stream_id)?;

        // Convert HTTP/2 response to HttpResponse
        let mut response_headers = Headers::new();
        for (name, value) in &resp_headers {
            let name_str = String::from_utf8_lossy(name);
            let value_str = String::from_utf8_lossy(value);
            if !name_str.starts_with(':') {
                response_headers.add(&name_str, &value_str);
            }
        }

        // Store Set-Cookie headers
        let set_cookies: Vec<String> = response_headers
            .get_all("Set-Cookie")
            .into_iter()
            .map(|s| s.to_string())
            .collect();
        for header in &set_cookies {
            self.cookie_jar.store_from_header(header, url);
        }

        Ok(HttpResponse {
            version: "HTTP/2".to_string(),
            status_code,
            reason: reason_phrase(status_code).to_string(),
            headers: response_headers,
            body: resp_body,
            redirected: false,
            final_url: None,
        })
    }
}

impl Default for HttpClient {
    fn default() -> Self {
        Self::new()
    }
}

// ---------------------------------------------------------------------------
// Helpers
// ---------------------------------------------------------------------------

/// Build the request path from a URL (path + query).
fn request_path(url: &Url) -> String {
    let path = url.path();
    let path = if path.is_empty() { "/" } else { &path };
    match url.query() {
        Some(q) => format!("{path}?{q}"),
        None => path.to_string(),
    }
}

/// Read a complete HTTP response from a connection.
///
/// Reads the header section first, then determines the body length from
/// headers and reads the appropriate amount of body data.
fn read_response(conn: &mut Connection) -> Result<HttpResponse> {
    let mut buf = Vec::with_capacity(READ_BUF_SIZE);
    let mut temp = [0u8; READ_BUF_SIZE];

    // Phase 1: Read until we have the complete header section (\r\n\r\n)
    let header_end = loop {
        let n = conn.read(&mut temp)?;
        if n == 0 {
            if buf.is_empty() {
                return Err(ClientError::ConnectionClosed);
            }
            break find_header_end(&buf);
        }
        buf.extend_from_slice(&temp[..n]);
        if let Some(pos) = find_header_end(&buf) {
            break Some(pos);
        }
    };

    let header_end = header_end.ok_or(ClientError::Http(http::HttpError::Incomplete))?;
    let body_start = header_end + 4; // skip \r\n\r\n

    // Quick-parse headers to determine body strategy
    let header_str = std::str::from_utf8(&buf[..header_end]).map_err(|_| {
        ClientError::Http(http::HttpError::Parse(
            "invalid UTF-8 in headers".to_string(),
        ))
    })?;

    let status_code = parse_status_code(header_str)?;
    let body_strategy = determine_body_strategy(header_str, status_code);

    // Phase 2: Read body according to strategy
    match body_strategy {
        BodyStrategy::NoBody => {
            // Truncate buffer to just headers + \r\n\r\n
            buf.truncate(body_start);
        }
        BodyStrategy::ContentLength(len) => {
            let total_needed = body_start + len;
            while buf.len() < total_needed {
                let n = conn.read(&mut temp)?;
                if n == 0 {
                    break;
                }
                buf.extend_from_slice(&temp[..n]);
            }
        }
        BodyStrategy::Chunked => {
            // Read until we find the terminating 0-length chunk
            while !has_chunked_terminator(&buf[body_start..]) {
                let n = conn.read(&mut temp)?;
                if n == 0 {
                    break;
                }
                buf.extend_from_slice(&temp[..n]);
            }
        }
        BodyStrategy::ReadUntilClose => {
            // Read until EOF
            loop {
                let n = conn.read(&mut temp)?;
                if n == 0 {
                    break;
                }
                buf.extend_from_slice(&temp[..n]);
            }
        }
    }

    // Parse the complete response
    http::parse_response(&buf).map_err(ClientError::Http)
}

/// Find the end of the HTTP header section (\r\n\r\n).
/// Returns the position of the first \r in the \r\n\r\n sequence.
fn find_header_end(data: &[u8]) -> Option<usize> {
    data.windows(4).position(|w| w == b"\r\n\r\n")
}

/// Extract status code from the first line of headers.
fn parse_status_code(headers: &str) -> Result<u16> {
    let first_line = headers.lines().next().unwrap_or("");
    let mut parts = first_line.splitn(3, ' ');
    let _version = parts.next();
    let code_str = parts.next().unwrap_or("");
    code_str.parse().map_err(|_| {
        ClientError::Http(http::HttpError::MalformedStatusLine(first_line.to_string()))
    })
}

/// Strategy for reading the response body.
enum BodyStrategy {
    NoBody,
    ContentLength(usize),
    Chunked,
    ReadUntilClose,
}

/// Extract the value for a header name (case-insensitive match).
fn header_value<'a>(line: &'a str, name: &str) -> Option<&'a str> {
    let colon = line.find(':')?;
    if line[..colon].eq_ignore_ascii_case(name) {
        Some(line[colon + 1..].trim())
    } else {
        None
    }
}

/// Determine how to read the body from headers.
fn determine_body_strategy(headers: &str, status_code: u16) -> BodyStrategy {
    // 1xx, 204, 304 have no body
    if status_code < 200 || status_code == 204 || status_code == 304 {
        return BodyStrategy::NoBody;
    }

    // Check for Transfer-Encoding: chunked
    for line in headers.split("\r\n").skip(1) {
        if let Some(val) = header_value(line, "transfer-encoding") {
            if val.eq_ignore_ascii_case("chunked") {
                return BodyStrategy::Chunked;
            }
        }
    }

    // Check for Content-Length
    for line in headers.split("\r\n").skip(1) {
        if let Some(val) = header_value(line, "content-length") {
            if let Ok(len) = val.parse::<usize>() {
                return BodyStrategy::ContentLength(len);
            }
        }
    }

    BodyStrategy::ReadUntilClose
}

/// Standard HTTP reason phrase for a status code.
fn reason_phrase(status: u16) -> &'static str {
    match status {
        200 => "OK",
        201 => "Created",
        204 => "No Content",
        301 => "Moved Permanently",
        302 => "Found",
        303 => "See Other",
        304 => "Not Modified",
        307 => "Temporary Redirect",
        308 => "Permanent Redirect",
        400 => "Bad Request",
        401 => "Unauthorized",
        403 => "Forbidden",
        404 => "Not Found",
        405 => "Method Not Allowed",
        500 => "Internal Server Error",
        502 => "Bad Gateway",
        503 => "Service Unavailable",
        _ => "",
    }
}

/// Determine whether a status code is a redirect that should be followed.
fn is_redirect_status(status: u16) -> bool {
    matches!(status, 301 | 302 | 303 | 307 | 308)
}

/// Determine the method for the next request after a redirect.
///
/// Per HTTP spec:
/// - 301/302/303: change to GET (drop body)
/// - 307/308: preserve original method
fn redirect_method(status: u16, original_method: Method) -> Method {
    match status {
        301..=303 => Method::Get,
        _ => original_method,
    }
}

/// Determine whether body should be preserved after a redirect.
///
/// Body is dropped for 301/302/303, preserved for 307/308.
fn redirect_preserves_body(status: u16) -> bool {
    matches!(status, 307 | 308)
}

/// Check if chunked body data contains the terminating `0\r\n\r\n`.
fn has_chunked_terminator(data: &[u8]) -> bool {
    // Look for \r\n0\r\n\r\n (the final chunk after some data) or 0\r\n\r\n at start
    data.windows(5).any(|w| w == b"0\r\n\r\n")
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;

    // -- ClientError Display tests --

    #[test]
    fn error_display_invalid_url() {
        let e = ClientError::InvalidUrl("bad".to_string());
        assert_eq!(e.to_string(), "invalid URL: bad");
    }

    #[test]
    fn error_display_unsupported_scheme() {
        let e = ClientError::UnsupportedScheme("ftp".to_string());
        assert_eq!(e.to_string(), "unsupported scheme: ftp");
    }

    #[test]
    fn error_display_too_many_redirects() {
        let e = ClientError::TooManyRedirects;
        assert_eq!(e.to_string(), "too many redirects");
    }

    #[test]
    fn error_display_connection_closed() {
        let e = ClientError::ConnectionClosed;
        assert_eq!(e.to_string(), "connection closed");
    }

    // -- HttpClient configuration tests --

    #[test]
    fn client_default() {
        let client = HttpClient::default();
        assert_eq!(client.max_redirects, DEFAULT_MAX_REDIRECTS);
        assert_eq!(client.connect_timeout, DEFAULT_CONNECT_TIMEOUT);
        assert_eq!(client.read_timeout, DEFAULT_READ_TIMEOUT);
    }

    #[test]
    fn client_set_max_redirects() {
        let mut client = HttpClient::new();
        client.set_max_redirects(5);
        assert_eq!(client.max_redirects, 5);
    }

    #[test]
    fn client_set_connect_timeout() {
        let mut client = HttpClient::new();
        client.set_connect_timeout(Duration::from_secs(10));
        assert_eq!(client.connect_timeout, Duration::from_secs(10));
    }

    #[test]
    fn client_set_read_timeout() {
        let mut client = HttpClient::new();
        client.set_read_timeout(Duration::from_secs(5));
        assert_eq!(client.read_timeout, Duration::from_secs(5));
    }

    // -- ConnectionPool tests --

    #[test]
    fn pool_take_empty() {
        let mut pool = ConnectionPool::new(Duration::from_secs(60), 6);
        let key = ConnectionKey {
            host: "example.com".to_string(),
            port: 80,
            is_tls: false,
        };
        assert!(pool.take(&key).is_none());
    }

    #[test]
    fn pool_connections_map_starts_empty() {
        let pool = ConnectionPool::new(Duration::from_secs(60), 6);
        assert!(pool.connections.is_empty());
    }

    // -- request_path tests --

    #[test]
    fn request_path_simple() {
        let url = Url::parse("http://example.com/path").unwrap();
        assert_eq!(request_path(&url), "/path");
    }

    #[test]
    fn request_path_with_query() {
        let url = Url::parse("http://example.com/path?key=value").unwrap();
        assert_eq!(request_path(&url), "/path?key=value");
    }

    #[test]
    fn request_path_root() {
        let url = Url::parse("http://example.com").unwrap();
        assert_eq!(request_path(&url), "/");
    }

    #[test]
    fn request_path_deep() {
        let url = Url::parse("http://example.com/a/b/c").unwrap();
        assert_eq!(request_path(&url), "/a/b/c");
    }

    // -- find_header_end tests --

    #[test]
    fn find_header_end_found() {
        let data = b"HTTP/1.1 200 OK\r\nHost: x\r\n\r\nbody";
        assert_eq!(find_header_end(data), Some(24));
    }

    #[test]
    fn find_header_end_not_found() {
        let data = b"HTTP/1.1 200 OK\r\nHost: x\r\n";
        assert_eq!(find_header_end(data), None);
    }

    #[test]
    fn find_header_end_empty() {
        assert_eq!(find_header_end(b""), None);
    }

    #[test]
    fn find_header_end_minimal() {
        let data = b"\r\n\r\n";
        assert_eq!(find_header_end(data), Some(0));
    }

    // -- parse_status_code tests --

    #[test]
    fn parse_status_code_200() {
        assert_eq!(parse_status_code("HTTP/1.1 200 OK").unwrap(), 200);
    }

    #[test]
    fn parse_status_code_404() {
        assert_eq!(parse_status_code("HTTP/1.1 404 Not Found").unwrap(), 404);
    }

    #[test]
    fn parse_status_code_301() {
        assert_eq!(
            parse_status_code("HTTP/1.1 301 Moved Permanently").unwrap(),
            301
        );
    }

    #[test]
    fn parse_status_code_invalid() {
        assert!(parse_status_code("INVALID").is_err());
    }

    // -- determine_body_strategy tests --

    #[test]
    fn strategy_no_body_204() {
        let headers = "HTTP/1.1 204 No Content\r\nConnection: keep-alive";
        assert!(matches!(
            determine_body_strategy(headers, 204),
            BodyStrategy::NoBody
        ));
    }

    #[test]
    fn strategy_no_body_304() {
        let headers = "HTTP/1.1 304 Not Modified\r\nETag: \"abc\"";
        assert!(matches!(
            determine_body_strategy(headers, 304),
            BodyStrategy::NoBody
        ));
    }

    #[test]
    fn strategy_no_body_1xx() {
        let headers = "HTTP/1.1 100 Continue";
        assert!(matches!(
            determine_body_strategy(headers, 100),
            BodyStrategy::NoBody
        ));
    }

    #[test]
    fn strategy_content_length() {
        let headers = "HTTP/1.1 200 OK\r\nContent-Length: 42";
        match determine_body_strategy(headers, 200) {
            BodyStrategy::ContentLength(42) => {}
            _ => panic!("expected ContentLength(42)"),
        }
    }

    #[test]
    fn strategy_chunked() {
        let headers = "HTTP/1.1 200 OK\r\nTransfer-Encoding: chunked";
        assert!(matches!(
            determine_body_strategy(headers, 200),
            BodyStrategy::Chunked
        ));
    }

    #[test]
    fn strategy_read_until_close() {
        let headers = "HTTP/1.1 200 OK\r\nConnection: close";
        assert!(matches!(
            determine_body_strategy(headers, 200),
            BodyStrategy::ReadUntilClose
        ));
    }

    // -- has_chunked_terminator tests --

    #[test]
    fn chunked_terminator_present() {
        assert!(has_chunked_terminator(b"5\r\nHello\r\n0\r\n\r\n"));
    }

    #[test]
    fn chunked_terminator_at_start() {
        assert!(has_chunked_terminator(b"0\r\n\r\n"));
    }

    #[test]
    fn chunked_terminator_missing() {
        assert!(!has_chunked_terminator(b"5\r\nHello\r\n"));
    }

    #[test]
    fn chunked_terminator_empty() {
        assert!(!has_chunked_terminator(b""));
    }

    // -- ConnectionKey equality tests --

    #[test]
    fn connection_key_equal() {
        let a = ConnectionKey {
            host: "example.com".to_string(),
            port: 443,
            is_tls: true,
        };
        let b = ConnectionKey {
            host: "example.com".to_string(),
            port: 443,
            is_tls: true,
        };
        assert_eq!(a, b);
    }

    #[test]
    fn connection_key_different_host() {
        let a = ConnectionKey {
            host: "a.com".to_string(),
            port: 443,
            is_tls: true,
        };
        let b = ConnectionKey {
            host: "b.com".to_string(),
            port: 443,
            is_tls: true,
        };
        assert_ne!(a, b);
    }

    #[test]
    fn connection_key_different_port() {
        let a = ConnectionKey {
            host: "example.com".to_string(),
            port: 80,
            is_tls: false,
        };
        let b = ConnectionKey {
            host: "example.com".to_string(),
            port: 8080,
            is_tls: false,
        };
        assert_ne!(a, b);
    }

    #[test]
    fn connection_key_different_tls() {
        let a = ConnectionKey {
            host: "example.com".to_string(),
            port: 443,
            is_tls: true,
        };
        let b = ConnectionKey {
            host: "example.com".to_string(),
            port: 443,
            is_tls: false,
        };
        assert_ne!(a, b);
    }

    // -- Header parsing strategy with case variations --

    #[test]
    fn strategy_content_length_lowercase() {
        let headers = "HTTP/1.1 200 OK\r\ncontent-length: 10";
        match determine_body_strategy(headers, 200) {
            BodyStrategy::ContentLength(10) => {}
            _ => panic!("expected ContentLength(10)"),
        }
    }

    #[test]
    fn strategy_chunked_lowercase() {
        let headers = "HTTP/1.1 200 OK\r\ntransfer-encoding: chunked";
        assert!(matches!(
            determine_body_strategy(headers, 200),
            BodyStrategy::Chunked
        ));
    }

    #[test]
    fn strategy_chunked_uppercase_value() {
        let headers = "HTTP/1.1 200 OK\r\nTransfer-Encoding: CHUNKED";
        assert!(matches!(
            determine_body_strategy(headers, 200),
            BodyStrategy::Chunked
        ));
    }

    #[test]
    fn strategy_content_length_mixed_case() {
        let headers = "HTTP/1.1 200 OK\r\nCONTENT-LENGTH: 99";
        match determine_body_strategy(headers, 200) {
            BodyStrategy::ContentLength(99) => {}
            _ => panic!("expected ContentLength(99)"),
        }
    }

    #[test]
    fn strategy_chunked_mixed_case_name() {
        let headers = "HTTP/1.1 200 OK\r\nTRANSFER-ENCODING: chunked";
        assert!(matches!(
            determine_body_strategy(headers, 200),
            BodyStrategy::Chunked
        ));
    }

    // -- URL scheme handling --

    #[test]
    fn unsupported_scheme_error() {
        let mut client = HttpClient::new();
        let url = Url::parse("ftp://example.com/file").unwrap();
        let result = client.get(&url);
        assert!(matches!(result, Err(ClientError::UnsupportedScheme(_))));
    }

    // -- Redirect-related tests --

    #[test]
    fn default_max_redirects_is_20() {
        let client = HttpClient::new();
        assert_eq!(client.max_redirects, 20);
    }

    #[test]
    fn error_display_redirect_loop() {
        let e = ClientError::RedirectLoop;
        assert_eq!(e.to_string(), "redirect loop detected");
    }

    #[test]
    fn reason_phrase_303() {
        assert_eq!(reason_phrase(303), "See Other");
    }

    #[test]
    fn reason_phrase_301() {
        assert_eq!(reason_phrase(301), "Moved Permanently");
    }

    #[test]
    fn reason_phrase_302() {
        assert_eq!(reason_phrase(302), "Found");
    }

    #[test]
    fn reason_phrase_307() {
        assert_eq!(reason_phrase(307), "Temporary Redirect");
    }

    #[test]
    fn reason_phrase_308() {
        assert_eq!(reason_phrase(308), "Permanent Redirect");
    }

    // -- is_redirect_status tests --

    #[test]
    fn redirect_status_301() {
        assert!(is_redirect_status(301));
    }

    #[test]
    fn redirect_status_302() {
        assert!(is_redirect_status(302));
    }

    #[test]
    fn redirect_status_303() {
        assert!(is_redirect_status(303));
    }

    #[test]
    fn redirect_status_307() {
        assert!(is_redirect_status(307));
    }

    #[test]
    fn redirect_status_308() {
        assert!(is_redirect_status(308));
    }

    #[test]
    fn redirect_status_200_is_not_redirect() {
        assert!(!is_redirect_status(200));
    }

    #[test]
    fn redirect_status_404_is_not_redirect() {
        assert!(!is_redirect_status(404));
    }

    #[test]
    fn redirect_status_304_is_not_redirect() {
        assert!(!is_redirect_status(304));
    }

    // -- redirect_method tests --

    #[test]
    fn redirect_301_changes_post_to_get() {
        assert_eq!(redirect_method(301, Method::Post), Method::Get);
    }

    #[test]
    fn redirect_302_changes_post_to_get() {
        assert_eq!(redirect_method(302, Method::Post), Method::Get);
    }

    #[test]
    fn redirect_303_changes_post_to_get() {
        assert_eq!(redirect_method(303, Method::Post), Method::Get);
    }

    #[test]
    fn redirect_303_changes_put_to_get() {
        assert_eq!(redirect_method(303, Method::Put), Method::Get);
    }

    #[test]
    fn redirect_303_changes_delete_to_get() {
        assert_eq!(redirect_method(303, Method::Delete), Method::Get);
    }

    #[test]
    fn redirect_307_preserves_post() {
        assert_eq!(redirect_method(307, Method::Post), Method::Post);
    }

    #[test]
    fn redirect_307_preserves_put() {
        assert_eq!(redirect_method(307, Method::Put), Method::Put);
    }

    #[test]
    fn redirect_308_preserves_post() {
        assert_eq!(redirect_method(308, Method::Post), Method::Post);
    }

    #[test]
    fn redirect_308_preserves_delete() {
        assert_eq!(redirect_method(308, Method::Delete), Method::Delete);
    }

    #[test]
    fn redirect_301_get_stays_get() {
        assert_eq!(redirect_method(301, Method::Get), Method::Get);
    }

    // -- redirect_preserves_body tests --

    #[test]
    fn redirect_301_drops_body() {
        assert!(!redirect_preserves_body(301));
    }

    #[test]
    fn redirect_302_drops_body() {
        assert!(!redirect_preserves_body(302));
    }

    #[test]
    fn redirect_303_drops_body() {
        assert!(!redirect_preserves_body(303));
    }

    #[test]
    fn redirect_307_preserves_body() {
        assert!(redirect_preserves_body(307));
    }

    #[test]
    fn redirect_308_preserves_body() {
        assert!(redirect_preserves_body(308));
    }

    // -- Cross-origin header stripping --

    #[test]
    fn cross_origin_strips_authorization() {
        let url_a = Url::parse("https://example.com/page").unwrap();
        let url_b = Url::parse("https://other.com/page").unwrap();
        assert!(!url_b.origin().same_origin(&url_a.origin()));

        let mut headers = Headers::new();
        headers.add("Authorization", "Bearer token123");
        headers.add("Accept", "text/html");

        // Simulate cross-origin redirect stripping
        if !url_b.origin().same_origin(&url_a.origin()) {
            headers.remove("Authorization");
        }

        assert!(headers.get("Authorization").is_none());
        assert_eq!(headers.get("Accept"), Some("text/html"));
    }

    #[test]
    fn same_origin_preserves_authorization() {
        let url_a = Url::parse("https://example.com/page1").unwrap();
        let url_b = Url::parse("https://example.com/page2").unwrap();
        assert!(url_b.origin().same_origin(&url_a.origin()));

        let mut headers = Headers::new();
        headers.add("Authorization", "Bearer token123");

        if !url_b.origin().same_origin(&url_a.origin()) {
            headers.remove("Authorization");
        }

        assert_eq!(headers.get("Authorization"), Some("Bearer token123"));
    }

    // -- Redirect loop detection --

    #[test]
    fn redirect_loop_detected_in_visited_urls() {
        let mut visited = vec!["https://example.com/a".to_string()];
        let next = "https://example.com/a".to_string();
        assert!(visited.contains(&next));

        // Unique URL is not a loop
        let next2 = "https://example.com/b".to_string();
        assert!(!visited.contains(&next2));
        visited.push(next2);
        assert_eq!(visited.len(), 2);
    }
}