web

func DefinitionFromHandler(prototype Handler) (HandlerDefinition, error)

{
	value := reflect.ValueOf(prototype)
	if !value.IsValid() || value.Kind() != reflect.Ptr || value.IsNil() || value.Elem().Kind() != reflect.Struct {
		return HandlerDefinition{}, fmt.Errorf("web: handler prototype must be a non-nil pointer to a struct")
	}
	typ := value.Elem().Type()
	var method, path string
	for i := 0; i < typ.NumField(); i++ {
		sf := typ.Field(i)
		if m := sf.Tag.Get("method"); m != "" {
			method = m
		}
		if p := sf.Tag.Get("path"); p != "" {
			path = p
		}
	}

	if method == "" || path == "" {
		return HandlerDefinition{}, fmt.Errorf("web: handler %T must declare method and path tags", prototype)
	}

	return HandlerDefinition{
		Method: method,
		Path:   path,
		New: func() Handler {
			newVal := reflect.New(typ)
			newVal.Elem().Set(value.Elem())
			return newVal.Interface().(Handler)
		},
	}, nil
}

func validatePreparedDefinitions(routes []route, prepared []preparedDefinition) error

{
	tree := newRadixTree()
	for _, registered := range routes {
		if err := tree.insert(registered.method, registered.path, registered.handler); err != nil {
			return err
		}
	}
	for _, item := range prepared {
		if err := tree.insert(item.meta.method, item.meta.path, item.handler); err != nil {
			return err
		}
	}
	return nil
}

func hasJSONBody(handler Handler) bool

{
	typ := reflect.TypeOf(handler)
	if typ.Kind() == reflect.Ptr {
		typ = typ.Elem()
	}
	for i := 0; i < typ.NumField(); i++ {
		if typ.Field(i).Tag.Get("body") == "json" {
			return true
		}
	}
	return false
}

func findOrCreateStatic(parent *radixNode, segment string) *radixNode

{
	for _, child := range parent.children {
		if !child.isParam && !child.isCatchAll && child.segment == segment {
			return child
		}
	}
	node := &radixNode{
		segment:  segment,
		isParam:  false,
		children: make([]*radixNode, 0),
	}
	parent.children = append(parent.children, node)
	return node
}

func findOrCreateParam(parent *radixNode, paramName string, constraints []paramConstraint) (*radixNode, error)

{
	if paramName == "" {
		return nil, fmt.Errorf("web: route parameter name cannot be empty")
	}
	for _, child := range parent.children {
		if child.isCatchAll {
			return nil, fmt.Errorf("web: parameter route %q conflicts with a catch-all route", paramName)
		}
		if child.isParam {
			if child.paramName != paramName || !sameConstraints(child.constraints, constraints) {
				return nil, fmt.Errorf("web: ambiguous parameter route for %q", paramName)
			}
			return child, nil
		}
	}
	node := &radixNode{
		isParam:     true,
		paramName:   paramName,
		constraints: constraints,
		children:    make([]*radixNode, 0),
	}
	parent.children = append(parent.children, node)
	return node, nil
}

func sameConstraints(left, right []paramConstraint) bool

{
	if len(left) != len(right) {
		return false
	}
	for i := range left {
		if left[i].name != right[i].name {
			return false
		}
	}
	return true
}

func lookupNode(node *radixNode, method string, segments []string, index int, params map[string]string) (HandlerFunc, bool)

{
	if index == len(segments) {
		if handler, ok := node.handlers[method]; ok {
			return handler, true
		}
		for _, child := range node.children {
			if !child.isCatchAll {
				continue
			}
			if handler, ok := child.handlers[method]; ok {
				params[child.paramName] = ""
				return handler, true
			}
		}
		return nil, false
	}

	segment := segments[index]
	for _, child := range node.children {
		if child.isParam || child.isCatchAll || child.segment != segment {
			continue
		}
		if handler, ok := lookupNode(child, method, segments, index+1, params); ok {
			return handler, true
		}
	}

	for _, child := range node.children {
		if !child.isParam || !constraintsMatch(child.constraints, segment) {
			continue
		}
		previous, existed := params[child.paramName]
		params[child.paramName] = segment
		if handler, ok := lookupNode(child, method, segments, index+1, params); ok {
			return handler, true
		}
		if existed {
			params[child.paramName] = previous
		} else {
			delete(params, child.paramName)
		}
	}

	for _, child := range node.children {
		if !child.isCatchAll {
			continue
		}
		handler, ok := child.handlers[method]
		if !ok {
			continue
		}
		params[child.paramName] = strings.Join(segments[index:], "/")
		return handler, true
	}
	return nil, false
}

func parseParamConstraints(seg string) (string, []paramConstraint, error)

{
	inner := seg[1 : len(seg)-1]
	colonIdx := strings.Index(inner, ":")
	if colonIdx < 0 {
		return inner, nil, nil
	}

	name := inner[:colonIdx]
	constraintStr := inner[colonIdx+1:]
	var constraints []paramConstraint

	rawConstraints := strings.Split(constraintStr, ",")
	if strings.HasPrefix(constraintStr, "regex(") {
		rawConstraints = []string{constraintStr}
	}
	for _, c := range rawConstraints {
		switch c {
		case "int":
			constraints = append(constraints, paramConstraint{
				name:     "int",
				validate: isIntConstraint,
			})
		case "alpha":
			constraints = append(constraints, paramConstraint{
				name:     "alpha",
				validate: isAlphaConstraint,
			})
		default:
			if strings.HasPrefix(c, "regex(") && strings.HasSuffix(c, ")") {
				pattern := c[6 : len(c)-1]
				validator, err := isRegexConstraint(pattern)
				if err != nil {
					return "", nil, fmt.Errorf("web: invalid regex constraint %q: %w", pattern, err)
				}
				constraints = append(constraints, paramConstraint{
					name:     c,
					validate: validator,
				})
				continue
			}
			return "", nil, fmt.Errorf("web: unknown route constraint %q", c)
		}
	}
	return name, constraints, nil
}

func validateRoutePath(path string) error

{
	if !strings.HasPrefix(path, "/") {
		return fmt.Errorf("web: route path must start with /")
	}
	seen := make(map[string]struct{})
	segments := splitPath(path)
	for index, segment := range segments {
		if !strings.ContainsAny(segment, "{}") {
			continue
		}
		if !isParam(segment) {
			return fmt.Errorf("web: malformed route segment %q", segment)
		}

		name := segment[1 : len(segment)-1]
		if strings.HasPrefix(name, "*") {
			if !isCatchAll(segment) || index != len(segments)-1 {
				return fmt.Errorf("web: catch-all parameter must be last and well formed")
			}
			name = strings.TrimPrefix(name, "*")
			if strings.Contains(name, ":") {
				return fmt.Errorf("web: catch-all parameters cannot have constraints")
			}
		} else if separator := strings.IndexByte(name, ':'); separator >= 0 {
			if _, _, err := parseParamConstraints(segment); err != nil {
				return err
			}
			name = name[:separator]
		}
		if !validRouteParameterName(name) {
			return fmt.Errorf("web: invalid route parameter name %q", name)
		}
		if _, exists := seen[name]; exists {
			return fmt.Errorf("web: duplicate route parameter %q", name)
		}
		seen[name] = struct{}{}
	}
	return nil
}

func validRouteParameterName(name string) bool

{
	if name == "" {
		return false
	}
	for index, character := range name {
		if index == 0 {
			if character != '_' &&
				(character < 'A' || character > 'Z') &&
				(character < 'a' || character > 'z') {
				return false
			}
			continue
		}
		if character != '_' &&
			(character < 'A' || character > 'Z') &&
			(character < 'a' || character > 'z') &&
			(character < '0' || character > '9') {
			return false
		}
	}
	return true
}

func RateLimit(rate, burst int) (Middleware, error)

{
	if _, err := resiliency.NewRateLimiter(rate, burst); err != nil {
		return nil, err
	}
	store := &clientRateLimitStore{
		clients: make(map[string]*list.Element),
		recency: list.New(),
		rate:    rate,
		burst:   burst,
	}
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) error {
			limiter, err := store.forClient(clientIdentity(ctx.Request), time.Now())
			if err != nil {
				return fmt.Errorf("web: rate limiter: %w", err)
			}
			if !limiter.Allow() {
				return Error(http.StatusTooManyRequests, "rate limit exceeded")
			}
			return next(ctx)
		}
	}, nil
}

func TestRateLimitSeparatesClientsWithoutBlocking(t *testing.T)

{
	middleware, err := RateLimit(1, 1)
	if err != nil {
		t.Fatalf("RateLimit() error = %v", err)
	}
	server := New()
	server.Use(middleware)
	server.MapGet("/", func(ctx *Context) error {
		return ctx.JSON(200, map[string]bool{"ok": true})
	})

	request := httptest.NewRequest("GET", "/", nil)
	request.RemoteAddr = "192.0.2.1:1000"
	response := httptest.NewRecorder()
	server.ServeHTTP(response, request)
	if response.Code != 200 {
		t.Fatalf("first client status = %d", response.Code)
	}

	request = httptest.NewRequest("GET", "/", nil)
	request.RemoteAddr = "192.0.2.1:1001"
	response = httptest.NewRecorder()
	server.ServeHTTP(response, request)
	if response.Code != 429 {
		t.Fatalf("limited client status = %d, want 429", response.Code)
	}

	request = httptest.NewRequest("GET", "/", nil)
	request.RemoteAddr = "192.0.2.2:1000"
	response = httptest.NewRecorder()
	server.ServeHTTP(response, request)
	if response.Code != 200 {
		t.Fatalf("second client status = %d, want 200", response.Code)
	}
}

func bindForm(form map[string][]string, v any) error

{
	val := reflect.ValueOf(v)
	if val.Kind() != reflect.Ptr || val.Elem().Kind() != reflect.Struct {
		return fmt.Errorf("web: form binding requires pointer to struct")
	}
	elem := val.Elem()
	for i := 0; i < elem.NumField(); i++ {
		field := elem.Field(i)
		if !field.CanSet() {
			continue
		}
		fieldName, ok := elem.Type().Field(i).Tag.Lookup("form")
		if !ok || fieldName == "" || fieldName == "-" {
			continue
		}
		if vals, ok := form[fieldName]; ok && len(vals) > 0 {
			if err := setFieldValue(field, vals[0]); err != nil {
				return fmt.Errorf("web: form field %s: %w", fieldName, err)
			}
		}
	}
	return nil
}

func setFieldValue(field reflect.Value, value string) error

{
	switch field.Kind() {
	case reflect.String:
		field.SetString(value)
	case reflect.Int, reflect.Int8, reflect.Int16, reflect.Int32, reflect.Int64:
		n, err := strconv.ParseInt(value, 10, 64)
		if err != nil {
			return err
		}
		field.SetInt(n)
	case reflect.Float32, reflect.Float64:
		n, err := strconv.ParseFloat(value, 64)
		if err != nil {
			return err
		}
		field.SetFloat(n)
	case reflect.Bool:
		b, err := strconv.ParseBool(value)
		if err != nil {
			return err
		}
		field.SetBool(b)
	default:
		return fmt.Errorf("unsupported type %s", field.Kind())
	}
	return nil
}

func matchRoute(pattern, path string) (map[string]string, bool)

{
	patternParts := strings.Split(strings.Trim(pattern, "/"), "/")
	pathParts := strings.Split(strings.Trim(path, "/"), "/")

	if len(patternParts) != len(pathParts) {
		return nil, false
	}

	params := make(map[string]string)
	for i := 0; i < len(patternParts); i++ {
		if strings.HasPrefix(patternParts[i], "{") && strings.HasSuffix(patternParts[i], "}") {
			paramName := patternParts[i][1 : len(patternParts[i])-1]
			params[paramName] = pathParts[i]
		} else if patternParts[i] != pathParts[i] {
			return nil, false
		}
	}
	return params, true
}

func Recovery() Middleware

{
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) (err error) {
			defer func() {
				if r := recover(); r != nil {
					err = &panicError{
						recovered: r,
						stack:     string(debug.Stack()),
					}
				}
			}()
			return next(ctx)
		}
	}
}

func CORS(allowOrigins ...string) Middleware

{
	allowAny := len(allowOrigins) == 0
	allowed := make(map[string]struct{}, len(allowOrigins))
	for _, origin := range allowOrigins {
		if origin == "*" {
			allowAny = true
		}
		allowed[origin] = struct{}{}
	}
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) error {
			origin := ctx.Request.Header.Get("Origin")
			if allowAny {
				ctx.Response.Header().Set("Access-Control-Allow-Origin", "*")
			} else if _, ok := allowed[origin]; ok && origin != "" {
				ctx.Response.Header().Set("Access-Control-Allow-Origin", origin)
				ctx.Response.Header().Add("Vary", "Origin")
			}
			ctx.Response.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
			ctx.Response.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
			if ctx.Request.Method == "OPTIONS" {
				ctx.Response.WriteHeader(http.StatusNoContent)
				return nil
			}
			return next(ctx)
		}
	}
}

func RequestID() Middleware

{
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) error {
			id := ctx.Request.Header.Get("X-Request-ID")
			if id == "" {
				id = fmt.Sprintf("%d", time.Now().UnixNano())
			}
			ctx.Set("request_id", id)
			ctx.Response.Header().Set("X-Request-ID", id)
			return next(ctx)
		}
	}
}

func Compress() Middleware

{
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) error {
			if !acceptsGzip(ctx.Request.Header.Get("Accept-Encoding")) {
				return next(ctx)
			}

			original := ctx.Response
			writer := &gzipResponseWriter{
				ResponseWriter: original,
				writer:         gzip.NewWriter(original),
			}
			ctx.Response = writer
			defer func() {
				ctx.Response = original
			}()

			err := next(ctx)
			if writer.compressed {
				if closeErr := writer.writer.Close(); err == nil {
					err = closeErr
				}
			}
			return err
		}
	}
}

func acceptsGzip(value string) bool

{
	for _, item := range strings.Split(value, ",") {
		parts := strings.Split(item, ";")
		if !strings.EqualFold(strings.TrimSpace(parts[0]), "gzip") {
			continue
		}
		quality := 1.0
		for _, parameter := range parts[1:] {
			name, raw, ok := strings.Cut(strings.TrimSpace(parameter), "=")
			if !ok || !strings.EqualFold(name, "q") {
				continue
			}
			parsed, err := strconv.ParseFloat(raw, 64)
			if err != nil {
				return false
			}
			quality = parsed
		}
		return quality > 0
	}
	return false
}

func publicErrorMessage(err error) string

{
	var recovered *panicError
	if errors.As(err, &recovered) {
		return "internal server error"
	}
	var explicit *httpError
	if errors.As(err, &explicit) {
		return explicit.Message
	}
	if statusFromError(err) >= http.StatusInternalServerError {
		return "internal server error"
	}
	return err.Error()
}

func statusFromError(err error) int

{
	if err == nil {
		return http.StatusOK
	}
	for {
		if he, ok := err.(interface{ HTTPCode() int }); ok {
			return he.HTTPCode()
		}
		if e := errors.Unwrap(err); e != nil {
			err = e
			continue
		}
		break
	}
	return http.StatusInternalServerError
}

func TestRunDoctorEnabled(t *testing.T)

{
	t.Setenv("FOUNDATION_DOCTOR", "fail")

	s := New()
	s.MapGet("/ping", func(ctx *Context) error {
		ctx.String(200, "pong")
		return nil
	})

	if err := s.runDoctor(); err != nil {
		t.Fatalf("runDoctor() error = %v", err)
	}
}

func TestAuth_MissingHeader(t *testing.T)

{
	s := New()
	s.Use(Auth(authTestSecret))
	s.MapGet("/api", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"ok": "yes"})
	})

	req := httptest.NewRequest("GET", "/api", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status: got %d, want 401", w.Code)
	}
}

func TestAuth_InvalidToken(t *testing.T)

{
	s := New()
	s.Use(Auth(authTestSecret))
	s.MapGet("/api", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"ok": "yes"})
	})

	req := httptest.NewRequest("GET", "/api", nil)
	req.Header.Set("Authorization", "Bearer badtoken")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != http.StatusUnauthorized {
		t.Errorf("status: got %d, want 401", w.Code)
	}
}

func TestAuth_ValidToken(t *testing.T)

{
	s := New()
	s.Use(Auth(authTestSecret))
	s.MapGet("/api", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"ok": "yes"})
	})

	token, _ := auth.SignToken(auth.Payload{Sub: "user1", Exp: 9999999999}, authTestSecret)
	req := httptest.NewRequest("GET", "/api", nil)
	req.Header.Set("Authorization", "Bearer "+token)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("status: got %d, want 200", w.Code)
	}
}

func TestRegisterHandler_Basic(t *testing.T)

{
	s := New()
	b := di.NewBuilder()
	container, _ := b.Build()

	if err := s.RegisterHandler(&PingEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("GET", "/ping", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("status = %d, want 200, body: %s", w.Code, w.Body.String())
	}

	var resp pingResponse
	json.NewDecoder(w.Body).Decode(&resp)
	if len(resp.Message) != 1 {
		t.Errorf("messages = %d, want 1", len(resp.Message))
	}
}

func TestRegisterHandler_Routes(t *testing.T)

{
	s := New()
	b := di.NewBuilder()
	container, _ := b.Build()

	if err := s.RegisterHandler(&PingEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	routes := s.Routes()
	if len(routes) != 1 {
		t.Fatalf("routes = %d, want 1", len(routes))
	}
	if routes[0].Method != "GET" || routes[0].Path != "/ping" {
		t.Errorf("route = %s %s, want GET /ping", routes[0].Method, routes[0].Path)
	}
}

func TestRegisterHandler_WithQuery(t *testing.T)

{
	s := New()
	b := di.NewBuilder()
	container, _ := b.Build()

	if err := s.RegisterHandler(&PingEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("GET", "/ping?times=3", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("status = %d, want 200", w.Code)
	}

	var resp pingResponse
	json.NewDecoder(w.Body).Decode(&resp)
	if len(resp.Message) != 3 {
		t.Errorf("messages = %d, want 3", len(resp.Message))
	}
}

func TestRegisterHandler_InvalidQueryReturnsBadRequest(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()

	if err := s.RegisterHandler(&PingEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("GET", "/ping?times=invalid", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 400 {
		t.Fatalf("status = %d, want 400", w.Code)
	}
}

func TestRegisterHandler_WithDI(t *testing.T)

{
	s := New()
	b := di.NewBuilder()
	b.Provide("greet", "custom-greeting")
	container, _ := b.Build()

	if err := s.RegisterHandler(&DiEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("GET", "/greet?name=alice", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("status = %d, want 200", w.Code)
	}
}

func TestRegisterHandler_NilReturn(t *testing.T)

{
	s := New()
	b := di.NewBuilder()
	container, _ := b.Build()

	if err := s.RegisterHandler(&NoReturnEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("DELETE", "/item", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 204 {
		t.Errorf("status = %d, want 204", w.Code)
	}
}

func TestRegisterHandler_RejectsDuplicateRoute(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()

	if err := s.RegisterHandler(&PingEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}
	if err := s.RegisterHandler(&PingEndpoint{}, container); err == nil {
		t.Fatal("RegisterHandler() accepted a duplicate route")
	}
}

func TestRegisterDefinition(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()

	err := s.RegisterDefinition(HandlerDefinition{
		Method: "GET",
		Path:   "/static",
		New: func() Handler {
			return &PingEndpoint{}
		},
	}, container)
	if err != nil {
		t.Fatalf("RegisterDefinition() error = %v", err)
	}

	req := httptest.NewRequest("GET", "/static", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Fatalf("status = %d, want 200", w.Code)
	}
}

func TestRegisterHandler_RejectsUnknownBodyField(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()
	if err := s.RegisterHandler(&BodyEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("POST", "/body", strings.NewReader(`{"name":"Ada","admin":true}`))
	req.Header.Set("Content-Type", "application/json")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 400 {
		t.Fatalf("status = %d, want 400", w.Code)
	}
}

func TestRegisterHandler_RejectsOversizedBody(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()
	if err := s.RegisterHandler(&BodyEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("POST", "/body", strings.NewReader(strings.Repeat("x", maxRequestBodySize+1)))
	req.Header.Set("Content-Type", "application/json")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 413 {
		t.Fatalf("status = %d, want 413", w.Code)
	}
}

func TestRegisterHandler_RejectsWrongBodyContentType(t *testing.T)

{
	s := New()
	container := di.NewBuilder().MustBuild()
	if err := s.RegisterHandler(&BodyEndpoint{}, container); err != nil {
		t.Fatalf("RegisterHandler() error = %v", err)
	}

	req := httptest.NewRequest("POST", "/body", strings.NewReader(`{"name":"Ada"}`))
	req.Header.Set("Content-Type", "text/plain")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 415 {
		t.Fatalf("status = %d, want 415", w.Code)
	}
}

func TestServer_MapGet(t *testing.T)

{
	s := New()
	s.MapGet("/hello", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"message": "hello"})
	})

	req := httptest.NewRequest("GET", "/hello", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("status: got %d, want 200", w.Code)
	}

	var resp map[string]string
	json.NewDecoder(w.Body).Decode(&resp)
	if resp["message"] != "hello" {
		t.Errorf("body: got %q, want %q", resp["message"], "hello")
	}
}

func TestServer_Params(t *testing.T)

{
	s := New()
	s.MapGet("/users/{id}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"id": ctx.Params["id"]})
	})

	req := httptest.NewRequest("GET", "/users/42", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	var resp map[string]string
	json.NewDecoder(w.Body).Decode(&resp)
	if resp["id"] != "42" {
		t.Errorf("param: got %q, want %q", resp["id"], "42")
	}
}

func TestServer_Middleware(t *testing.T)

{
	s := New()
	s.Use(RequestID())

	s.MapGet("/test", func(ctx *Context) error {
		id, _ := ctx.Get("request_id")
		return ctx.JSON(200, map[string]any{"request_id": id})
	})

	req := httptest.NewRequest("GET", "/test", nil)
	req.Header.Set("X-Request-ID", "test-123")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	var resp map[string]any
	json.NewDecoder(w.Body).Decode(&resp)
	if resp["request_id"] != "test-123" {
		t.Errorf("middleware: got %v, want test-123", resp["request_id"])
	}
}

func TestServer_RecoveryDoesNotExposePanic(t *testing.T)

{
	s := New()
	s.Use(Recovery())
	s.MapGet("/panic", func(ctx *Context) error {
		panic("private failure detail")
	})

	req := httptest.NewRequest("GET", "/panic", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 500 {
		t.Fatalf("status = %d, want 500", w.Code)
	}
	if strings.Contains(w.Body.String(), "private failure detail") ||
		strings.Contains(w.Body.String(), "goroutine") {
		t.Fatalf("response exposes panic details: %s", w.Body.String())
	}
}

func TestServer_DoesNotExposeInternalError(t *testing.T)

{
	s := New()
	s.MapGet("/failure", func(ctx *Context) error {
		return errors.New("database connection private detail")
	})

	req := httptest.NewRequest("GET", "/failure", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 500 {
		t.Fatalf("status = %d, want 500", w.Code)
	}
	if strings.Contains(w.Body.String(), "database") {
		t.Fatalf("response exposes internal error: %s", w.Body.String())
	}
}

func TestServer_ExposesExplicitHTTPError(t *testing.T)

{
	s := New()
	s.MapGet("/teapot", func(ctx *Context) error {
		return Error(418, "short and stout")
	})

	req := httptest.NewRequest("GET", "/teapot", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 418 {
		t.Fatalf("status = %d, want 418", w.Code)
	}
	if !strings.Contains(w.Body.String(), "short and stout") {
		t.Fatalf("response lost explicit error: %s", w.Body.String())
	}
}

func TestServer_Group(t *testing.T)

{
	s := New()
	api := s.Group("/api")
	api.MapGet("/users", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"path": "/api/users"})
	})

	req := httptest.NewRequest("GET", "/api/users", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("group route: got %d, want 200", w.Code)
	}
}

func TestServer_Routes(t *testing.T)

{
	s := New()
	s.MapGet("/hello", func(ctx *Context) error {
		ctx.String(200, "ok")
		return nil
	})
	s.MapPost("/data", func(ctx *Context) error {
		ctx.String(201, "ok")
		return nil
	})

	routes := s.Routes()
	if len(routes) != 2 {
		t.Fatalf("routes = %d, want 2", len(routes))
	}
	if routes[0].Method != "GET" || routes[0].Path != "/hello" {
		t.Errorf("route[0] = %s %s, want GET /hello", routes[0].Method, routes[0].Path)
	}
	if routes[1].Method != "POST" || routes[1].Path != "/data" {
		t.Errorf("route[1] = %s %s, want POST /data", routes[1].Method, routes[1].Path)
	}
}

func TestServer_HTTPTimeoutDefaults(t *testing.T)

{
	server := New().httpServer(":8080")
	if server.ReadHeaderTimeout <= 0 ||
		server.ReadTimeout <= 0 ||
		server.WriteTimeout <= 0 ||
		server.IdleTimeout <= 0 {
		t.Fatalf("HTTP timeouts are not configured: %#v", server)
	}
	if server.MaxHeaderBytes != maxRequestBodySize {
		t.Fatalf("MaxHeaderBytes = %d, want %d", server.MaxHeaderBytes, maxRequestBodySize)
	}
}

func TestServer_CORS(t *testing.T)

{
	s := New()
	s.Use(CORS("*"))
	s.MapGet("/test", func(ctx *Context) error {
		ctx.String(200, "ok")
		return nil
	})

	req := httptest.NewRequest("OPTIONS", "/test", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 204 {
		t.Errorf("CORS preflight: got %d, want 204", w.Code)
	}
	if w.Header().Get("Access-Control-Allow-Origin") != "*" {
		t.Errorf("CORS header: got %q", w.Header().Get("Access-Control-Allow-Origin"))
	}
}

func TestServer_CORSSelectsMatchingOrigin(t *testing.T)

{
	server := New()
	server.Use(CORS("https://one.example", "https://two.example"))
	if err := server.MapGet("/cors", func(ctx *Context) error {
		ctx.String(http.StatusOK, "ok")
		return nil
	}); err != nil {
		t.Fatal(err)
	}

	request := httptest.NewRequest(http.MethodGet, "/cors", nil)
	request.Header.Set("Origin", "https://two.example")
	response := httptest.NewRecorder()
	server.ServeHTTP(response, request)
	if got := response.Header().Get("Access-Control-Allow-Origin"); got != "https://two.example" {
		t.Fatalf("Access-Control-Allow-Origin = %q", got)
	}
	if !strings.Contains(response.Header().Get("Vary"), "Origin") {
		t.Fatalf("Vary = %q, want Origin", response.Header().Get("Vary"))
	}
}

func TestServer_CompressWritesGzip(t *testing.T)

{
	s := New()
	s.Use(Compress())
	s.MapGet("/compressed", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"message": "hello"})
	})

	req := httptest.NewRequest("GET", "/compressed", nil)
	req.Header.Set("Accept-Encoding", "gzip")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Header().Get("Content-Encoding") != "gzip" {
		t.Fatalf("Content-Encoding = %q", w.Header().Get("Content-Encoding"))
	}
	reader, err := gzip.NewReader(w.Body)
	if err != nil {
		t.Fatalf("gzip.NewReader() error = %v", err)
	}
	defer reader.Close()
	var body map[string]string
	if err := json.NewDecoder(reader).Decode(&body); err != nil {
		t.Fatalf("Decode() error = %v", err)
	}
	if body["message"] != "hello" {
		t.Fatalf("message = %q", body["message"])
	}
}

func TestServer_CompressRestoresWriterAfterPanic(t *testing.T)

{
	s := New()
	s.Use(Recovery())
	s.Use(Compress())
	if err := s.MapGet("/panic", func(*Context) error {
		panic("private failure")
	}); err != nil {
		t.Fatal(err)
	}

	req := httptest.NewRequest("GET", "/panic", nil)
	req.Header.Set("Accept-Encoding", "gzip")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != http.StatusInternalServerError {
		t.Fatalf("status = %d, want %d", w.Code, http.StatusInternalServerError)
	}
	if strings.Contains(w.Body.String(), "private failure") {
		t.Fatalf("response exposes panic details: %s", w.Body.String())
	}
}

func TestServer_CompressRequiresGzipEncodingToken(t *testing.T)

{
	s := New()
	s.Use(Compress())
	if err := s.MapGet("/plain", func(ctx *Context) error {
		return ctx.JSON(http.StatusOK, map[string]string{"message": "hello"})
	}); err != nil {
		t.Fatal(err)
	}

	for _, encoding := range []string{"xgzip", "gzip;q=0"} {
		req := httptest.NewRequest("GET", "/plain", nil)
		req.Header.Set("Accept-Encoding", encoding)
		w := httptest.NewRecorder()
		s.ServeHTTP(w, req)
		if got := w.Header().Get("Content-Encoding"); got != "" {
			t.Fatalf("Content-Encoding for %q = %q, want empty", encoding, got)
		}
	}
}

func TestServer_CompressHandlesJSONEncodingError(t *testing.T)

{
	s := New()
	s.Use(Compress())
	if err := s.MapGet("/invalid", func(ctx *Context) error {
		return ctx.JSON(http.StatusOK, make(chan int))
	}); err != nil {
		t.Fatal(err)
	}

	req := httptest.NewRequest("GET", "/invalid", nil)
	req.Header.Set("Accept-Encoding", "gzip")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != http.StatusInternalServerError {
		t.Fatalf("status = %d, want %d", w.Code, http.StatusInternalServerError)
	}
	if got := w.Header().Get("Content-Encoding"); got != "" {
		t.Fatalf("Content-Encoding = %q, want empty on encoding error", got)
	}
}

func TestServer_Bind(t *testing.T)

{
	s := New()
	s.MapPost("/data", func(ctx *Context) error {
		var body map[string]string
		if err := ctx.Bind(&body); err != nil {
			return err
		}
		return ctx.JSON(200, body)
	})

	req := httptest.NewRequest("POST", "/data", strings.NewReader(`{"key":"value"}`))
	req.Header.Set("Content-Type", "application/json")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("bind: got %d, want 200", w.Code)
	}
}

func TestServer_BindRejectsUnknownJSONField(t *testing.T)

{
	s := New()
	s.MapPost("/data", func(ctx *Context) error {
		var body struct {
			Name string `json:"name"`
		}
		return ctx.Bind(&body)
	})

	req := httptest.NewRequest("POST", "/data", strings.NewReader(`{"name":"Ada","admin":true}`))
	req.Header.Set("Content-Type", "application/json")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 400 {
		t.Fatalf("status = %d, want 400", w.Code)
	}
}

func TestServer_BindRejectsOversizedBody(t *testing.T)

{
	s := New()
	s.MapPost("/data", func(ctx *Context) error {
		var body map[string]string
		return ctx.Bind(&body)
	})

	body := `{"key":"` + strings.Repeat("x", maxRequestBodySize) + `"}`
	req := httptest.NewRequest("POST", "/data", strings.NewReader(body))
	req.Header.Set("Content-Type", "application/json")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 413 {
		t.Fatalf("status = %d, want 413", w.Code)
	}
}

func TestServer_BindRejectsUnsupportedMediaType(t *testing.T)

{
	s := New()
	s.MapPost("/data", func(ctx *Context) error {
		var body map[string]string
		return ctx.Bind(&body)
	})

	req := httptest.NewRequest("POST", "/data", strings.NewReader("name=Ada"))
	req.Header.Set("Content-Type", "text/plain")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 415 {
		t.Fatalf("status = %d, want 415", w.Code)
	}
}

func TestServer_FormBindUsesExplicitFields(t *testing.T)

{
	s := New()
	s.MapPost("/form", func(ctx *Context) error {
		var body struct {
			Name    string `form:"name"`
			IsAdmin bool   `json:"-"`
		}
		if err := ctx.Bind(&body); err != nil {
			return err
		}
		return ctx.JSON(200, body)
	})

	req := httptest.NewRequest(
		"POST",
		"/form",
		strings.NewReader("name=Ada&IsAdmin=true"),
	)
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Fatalf("status = %d, want 200", w.Code)
	}
	if strings.Contains(w.Body.String(), "true") {
		t.Fatalf("form bound an unlisted field: %s", w.Body.String())
	}
}

func TestHealthEndpoint(t *testing.T)

{
	s := New()
	s.MapGet("/health", HealthEndpoint(func(ctx context.Context) error {
		return nil
	}))

	req := httptest.NewRequest("GET", "/health", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)

	if w.Code != 200 {
		t.Errorf("health: got %d, want 200", w.Code)
	}
}

func TestServer_IntConstraint(t *testing.T)

{
	s := New()
	s.MapGet("/users/{id:int}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"id": ctx.Params["id"]})
	})

	req := httptest.NewRequest("GET", "/users/42", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Errorf("int constraint valid: got %d, want 200", w.Code)
	}

	req = httptest.NewRequest("GET", "/users/abc", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 404 {
		t.Errorf("int constraint invalid: got %d, want 404", w.Code)
	}
}

func TestServer_AlphaConstraint(t *testing.T)

{
	s := New()
	s.MapGet("/items/{slug:alpha}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"slug": ctx.Params["slug"]})
	})

	req := httptest.NewRequest("GET", "/items/hello", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Errorf("alpha constraint valid: got %d, want 200", w.Code)
	}

	req = httptest.NewRequest("GET", "/items/hello123", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 404 {
		t.Errorf("alpha constraint invalid: got %d, want 404", w.Code)
	}
}

func TestServer_CatchAll(t *testing.T)

{
	s := New()
	if err := s.MapGet("/static/{*filepath}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"path": ctx.Params["filepath"]})
	}); err != nil {
		t.Fatal(err)
	}
	if err := s.MapPost("/static/{*filepath}", func(ctx *Context) error {
		ctx.Response.WriteHeader(http.StatusCreated)
		return nil
	}); err != nil {
		t.Fatalf("MapPost() for existing catch-all: %v", err)
	}

	req := httptest.NewRequest("GET", "/static/css/main.css", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Fatalf("catch-all: got %d, want 200", w.Code)
	}
	var resp map[string]string
	json.NewDecoder(w.Body).Decode(&resp)
	if resp["path"] != "css/main.css" {
		t.Errorf("catch-all path: got %q, want %q", resp["path"], "css/main.css")
	}

	req = httptest.NewRequest("GET", "/static/a/b/c/d", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Fatalf("deep catch-all: got %d, want 200", w.Code)
	}
	json.NewDecoder(w.Body).Decode(&resp)
	if resp["path"] != "a/b/c/d" {
		t.Errorf("deep catch-all: got %q, want %q", resp["path"], "a/b/c/d")
	}

	req = httptest.NewRequest("POST", "/static/css/main.css", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != http.StatusCreated {
		t.Errorf("POST catch-all: got %d, want %d", w.Code, http.StatusCreated)
	}
}

func TestServer_RouteLookupBacktracksFromStaticBranch(t *testing.T)

{
	server := New()
	if err := server.MapGet("/users/new/details", func(ctx *Context) error {
		ctx.String(http.StatusOK, "static")
		return nil
	}); err != nil {
		t.Fatal(err)
	}
	if err := server.MapGet("/users/{id}/settings", func(ctx *Context) error {
		ctx.String(http.StatusOK, ctx.Params["id"])
		return nil
	}); err != nil {
		t.Fatal(err)
	}

	response := httptest.NewRecorder()
	server.ServeHTTP(
		response,
		httptest.NewRequest(http.MethodGet, "/users/new/settings", nil),
	)
	if response.Code != http.StatusOK || response.Body.String() != "new" {
		t.Fatalf("response = (%d, %q), want (200, new)", response.Code, response.Body.String())
	}
}

func TestServer_RouteLookupBacktracksAcrossMethods(t *testing.T)

{
	server := New()
	if err := server.MapGet("/items/static", func(ctx *Context) error {
		ctx.String(http.StatusOK, "static")
		return nil
	}); err != nil {
		t.Fatal(err)
	}
	if err := server.MapPost("/items/{id}", func(ctx *Context) error {
		ctx.String(http.StatusCreated, ctx.Params["id"])
		return nil
	}); err != nil {
		t.Fatal(err)
	}

	response := httptest.NewRecorder()
	server.ServeHTTP(
		response,
		httptest.NewRequest(http.MethodPost, "/items/static", nil),
	)
	if response.Code != http.StatusCreated || response.Body.String() != "static" {
		t.Fatalf("response = (%d, %q), want (201, static)", response.Code, response.Body.String())
	}
}

func TestServer_RejectsMalformedCatchAllRoutes(t *testing.T)

{
	for _, path := range []string{
		"/static/{*}",
		"/static/{*path}/suffix",
		"/static/{*path:int}",
		"/static/{{id}}",
		"/static/{id}/{id}",
		"/static/{bad-name}",
	} {
		t.Run(path, func(t *testing.T) {
			server := New()
			if err := server.MapGet(path, func(*Context) error { return nil }); err == nil {
				t.Fatalf("MapGet(%q) accepted a malformed catch-all", path)
			}
		})
	}
}

func TestServer_RejectsParameterCatchAllConflicts(t *testing.T)

{
	handler := func(*Context) error { return nil }
	for _, register := range []func(*Server) error{
		func(server *Server) error {
			if err := server.MapGet("/items/{id}", handler); err != nil {
				return err
			}
			return server.MapPost("/items/{*rest}", handler)
		},
		func(server *Server) error {
			if err := server.MapGet("/items/{*rest}", handler); err != nil {
				return err
			}
			return server.MapPost("/items/{id}", handler)
		},
	} {
		if err := register(New()); err == nil {
			t.Fatal("router accepted conflicting parameter and catch-all routes")
		}
	}
}

func TestServer_MethodMultiplex(t *testing.T)

{
	s := New()
	s.MapGet("/items/{id}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"method": "GET"})
	})
	s.MapPost("/items/{id}", func(ctx *Context) error {
		return ctx.JSON(201, map[string]string{"method": "POST"})
	})
	s.MapDelete("/items/{id}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"method": "DELETE"})
	})

	req := httptest.NewRequest("GET", "/items/1", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Errorf("GET: got %d, want 200", w.Code)
	}

	req = httptest.NewRequest("POST", "/items/1", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 201 {
		t.Errorf("POST: got %d, want 201", w.Code)
	}

	req = httptest.NewRequest("DELETE", "/items/1", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Errorf("DELETE: got %d, want 200", w.Code)
	}

	req = httptest.NewRequest("PUT", "/items/1", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 404 {
		t.Errorf("PUT not registered: got %d, want 404", w.Code)
	}
}

func TestServer_RegexConstraint(t *testing.T)

{
	s := New()
	s.MapGet("/files/{name:regex(^[a-z]+\\.txt$)}", func(ctx *Context) error {
		return ctx.JSON(200, map[string]string{"name": ctx.Params["name"]})
	})

	req := httptest.NewRequest("GET", "/files/readme.txt", nil)
	w := httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 200 {
		t.Errorf("regex valid: got %d, want 200, body: %s", w.Code, w.Body.String())
	}

	req = httptest.NewRequest("GET", "/files/README.TXT", nil)
	w = httptest.NewRecorder()
	s.ServeHTTP(w, req)
	if w.Code != 404 {
		t.Errorf("regex invalid: got %d, want 404", w.Code)
	}
}

func TestServer_RejectsAmbiguousParameterRoute(t *testing.T)

{
	s := New()
	if err := s.MapGet("/items/{id}", func(ctx *Context) error {
		return nil
	}); err != nil {
		t.Fatalf("MapGet() error = %v", err)
	}
	if err := s.MapGet("/items/{name}", func(ctx *Context) error {
		return nil
	}); err == nil {
		t.Fatal("MapGet() accepted an ambiguous parameter route")
	}
}

func Auth(secret []byte) Middleware

{
	if err := auth.ValidateHMACSecret(secret); err != nil {
		panic(err)
	}
	secret = append([]byte(nil), secret...)
	return func(next HandlerFunc) HandlerFunc {
		return func(ctx *Context) error {
			h := ctx.Request.Header.Get("Authorization")
			if h == "" {
				return ctx.JSON(http.StatusUnauthorized, map[string]string{"error": "missing Authorization header"})
			}

			parts := strings.SplitN(h, " ", 2)
			if len(parts) != 2 || strings.ToLower(parts[0]) != "bearer" {
				return ctx.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid Authorization format"})
			}

			payload, err := auth.VerifyToken(parts[1], secret)
			if err != nil {
				return ctx.JSON(http.StatusUnauthorized, map[string]string{"error": "invalid bearer token"})
			}

			ctx.Set("auth.payload", payload)
			return next(ctx)
		}
	}
}