httpx

func writeSelfSigned(t *testing.T, host string) (certFile, keyFile string)

{
	t.Helper()

	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	tmpl := x509.Certificate{
		SerialNumber: big.NewInt(1),
		Subject:      pkix.Name{CommonName: host},
		DNSNames:     []string{host},
		NotBefore:    time.Now().Add(-time.Hour),
		NotAfter:     time.Now().Add(time.Hour),
		KeyUsage:     x509.KeyUsageDigitalSignature,
		ExtKeyUsage:  []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
	}
	der, err := x509.CreateCertificate(rand.Reader, &tmpl, &tmpl, &key.PublicKey, key)
	if err != nil {
		t.Fatal(err)
	}

	dir := t.TempDir()
	certFile = filepath.Join(dir, "cert.pem")
	keyFile = filepath.Join(dir, "key.pem")

	certOut, _ := os.Create(certFile)
	defer certOut.Close()
	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: der}); err != nil {
		t.Fatal(err)
	}

	keyDER, err := x509.MarshalECPrivateKey(key)
	if err != nil {
		t.Fatal(err)
	}
	keyOut, _ := os.Create(keyFile)
	defer keyOut.Close()
	if err := pem.Encode(keyOut, &pem.Block{Type: "EC PRIVATE KEY", Bytes: keyDER}); err != nil {
		t.Fatal(err)
	}
	return certFile, keyFile
}

func TestVHostMuxDispatchesByHostIgnoringCaseAndPort(t *testing.T)

{
	mux := NewVHostMux()
	called := false
	mux.AddVirtualHost(VirtualHost{
		Host: "Example.COM",
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			called = true
			w.WriteHeader(http.StatusTeapot)
		}),
	})

	for _, host := range []string{"example.com", "EXAMPLE.com:8443"} {
		rec := httptest.NewRecorder()
		req := httptest.NewRequest(http.MethodGet, "/", nil)
		req.Host = host
		mux.ServeHTTP(rec, req)
		if rec.Code != http.StatusTeapot {
			t.Errorf("host %q: got %d, want %d", host, rec.Code, http.StatusTeapot)
		}
	}
	if !called {
		t.Error("virtual host handler was not called")
	}
}

func TestVHostMuxUnknownHost(t *testing.T)

{
	mux := NewVHostMux()
	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Host = "unknown.example"
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusNotFound {
		t.Fatalf("got %d, want 404", rec.Code)
	}

	mux = NewVHostMux(WithFallback(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusBadGateway)
	})))
	rec = httptest.NewRecorder()
	mux.ServeHTTP(rec, req)
	if rec.Code != http.StatusBadGateway {
		t.Fatalf("fallback: got %d, want 502", rec.Code)
	}
}

func TestVHostMuxHookOrderAndShortCircuit(t *testing.T)

{
	var events []string
	mux := NewVHostMux()
	mux.AddVirtualHost(VirtualHost{
		Host: "a.example",
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			events = append(events, "vhost:handler")
		}),
		Hooks: []Hooks{
			recordingHooks{name: "first", handle: true, events: &events},
			recordingHooks{name: "second", events: &events},
		},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Host = "a.example"
	mux.ServeHTTP(rec, req)

	want := []string{
		"first:before", "second:before",
		"first:handle",                // short-circuits: no second:handle, no site:handler
		"second:after", "first:after", // reverse order
	}
	if !reflect.DeepEqual(events, want) {
		t.Fatalf("got %v, want %v", events, want)
	}
}

func TestVHostMuxHooksPassThroughToHandler(t *testing.T)

{
	var events []string
	mux := NewVHostMux()
	mux.AddVirtualHost(VirtualHost{
		Host: "a.example",
		Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			events = append(events, "vhost:handler")
		}),
		Hooks: []Hooks{recordingHooks{name: "p", events: &events}},
	})

	rec := httptest.NewRecorder()
	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Host = "a.example"
	mux.ServeHTTP(rec, req)

	want := []string{"p:before", "p:handle", "vhost:handler", "p:after"}
	if !reflect.DeepEqual(events, want) {
		t.Fatalf("got %v, want %v", events, want)
	}
}

func TestVHostMuxRemoveSite(t *testing.T)

{
	mux := NewVHostMux()
	mux.AddVirtualHost(VirtualHost{Host: "a.example", Handler: http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})})
	if got := mux.Hosts(); !reflect.DeepEqual(got, []string{"a.example"}) {
		t.Fatalf("hosts: %v", got)
	}
	if !mux.RemoveVirtualHost("A.example:443") {
		t.Fatal("RemoveVirtualHost should report removal with normalized host")
	}
	if mux.RemoveVirtualHost("a.example") {
		t.Fatal("RemoveVirtualHost should report false for unknown host")
	}
}

func TestCertResolverSNI(t *testing.T)

{
	certFile, keyFile := writeSelfSigned(t, "a.example")

	r := NewCertResolver()
	if err := r.Add("A.example", certFile, keyFile); err != nil {
		t.Fatal(err)
	}

	cert, err := r.GetCertificate(&tls.ClientHelloInfo{ServerName: "a.example"})
	if err != nil || cert == nil {
		t.Fatalf("SNI lookup failed: %v", err)
	}
	if _, err := r.GetCertificate(&tls.ClientHelloInfo{ServerName: "other.example"}); err == nil {
		t.Fatal("expected error for unknown SNI name")
	}
	if !r.Remove("a.example") {
		t.Fatal("expected Remove to succeed")
	}
	if _, err := r.GetCertificate(&tls.ClientHelloInfo{ServerName: "a.example"}); err == nil {
		t.Fatal("expected error after removal")
	}
}

func New(c *http.Client, mw ...Middleware) *Client

{
	if c == nil {
		c = &http.Client{Timeout: 15 * time.Second}
	}

	rt := c.Transport
	if rt == nil {
		rt = http.DefaultTransport
	}

	return &Client{client: c, rt: rt, mw: mw}
}

func Header(key, value string) Middleware

{
	return func(next http.RoundTripper) http.RoundTripper {
		return roundTripperFunc(func(r *http.Request) (*http.Response, error) {
			if !sameOrigin(r.URL, originalRequestURL(r)) {
				return next.RoundTrip(r)
			}
			cloned := cloneRequest(r)
			cloned.Header.Set(key, value)
			return next.RoundTrip(cloned)
		})
	}
}

func Logging(logger *slog.Logger) Middleware

{
	return func(next http.RoundTripper) http.RoundTripper {
		return roundTripperFunc(func(r *http.Request) (*http.Response, error) {
			start := time.Now()
			resp, err := next.RoundTrip(r)
			dur := time.Since(start)
			requestURL := safeLogURL(r.URL)
			if err != nil {
				logger.Error("http request failed", "method", r.Method, "url", requestURL, "duration", dur, "error", err)
			} else {
				logger.Info("http request", "method", r.Method, "url", requestURL, "status", resp.StatusCode, "duration", dur)
			}
			return resp, err
		})
	}
}

func safeLogURL(value *url.URL) string

{
	if value == nil {
		return ""
	}
	safe := *value
	safe.User = nil
	safe.RawQuery = ""
	safe.ForceQuery = false
	safe.Fragment = ""
	return safe.String()
}

func RequestID(header string) Middleware

{
	return func(next http.RoundTripper) http.RoundTripper {
		return roundTripperFunc(func(r *http.Request) (*http.Response, error) {
			if r.Header.Get(header) == "" {
				cloned := cloneRequest(r)
				cloned.Header.Set(header, newRequestID())
				return next.RoundTrip(cloned)
			}
			return next.RoundTrip(r)
		})
	}
}