#[test]
fn fastcgi_never_forwards_proxy_header_as_http_proxy() {
    let tmp = TempDir::new().unwrap();
    let mut configured = Service {
        id: "fastcgi-params".into(),
        name: "FastCGI params".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let php = service.php.as_ref().unwrap();
    let mut headers = HeaderMap::new();
    headers.insert("proxy", HeaderValue::from_static("http://attacker.invalid:8080"));
    headers.insert("user-agent", HeaderValue::from_static("security-test"));
    let uri: Uri = "/index.php?q=1".parse().unwrap();
    let encoded = fastcgi_params(
        &service,
        php,
        &Method::GET,
        &headers,
        &uri,
        "/index.php",
        None,
        Some("q=1"),
        &RequestContext {
            client_ip: "127.0.0.1".parse().unwrap(),
            client_port: Some(12345),
            server_name: "example.test".into(),
            server_port: 80,
            tls: false,
            version: Version::HTTP_11,
        },
    )
    .unwrap();
    assert!(!encoded.windows(b"HTTP_PROXY".len()).any(|window| window == b"HTTP_PROXY"));
    assert!(encoded.windows(b"HTTP_USER_AGENT".len()).any(|window| window == b"HTTP_USER_AGENT"));
}

#[test]
fn php_custom_fastcgi_params_and_php_values_are_validated() {
    let tmp = TempDir::new().unwrap();
    let mut configured = Service {
        id: "php-custom".into(),
        name: "PHP custom".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php {
            enabled: true,
            endpoint: "tcp:127.0.0.1:9000".into(),
            pass_authorization: false,
            custom_params: BTreeMap::from([("app_env".into(), "production".into())]),
            php_values: BTreeMap::from([("memory_limit".into(), "256M".into())]),
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    assert!(configured.php.custom_params.contains_key("APP_ENV"));
    let service = configured.compile().unwrap();
    let php = service.php.as_ref().unwrap();
    let mut headers = HeaderMap::new();
    headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
    let uri: Uri = "/index.php".parse().unwrap();
    let encoded = fastcgi_params(
        &service,
        php,
        &Method::GET,
        &headers,
        &uri,
        "/index.php",
        None,
        None,
        &RequestContext {
            client_ip: "127.0.0.1".parse().unwrap(),
            client_port: None,
            server_name: "example.test".into(),
            server_port: 443,
            tls: true,
            version: Version::HTTP_2,
        },
    )
    .unwrap();
    assert!(encoded.windows(b"APP_ENV".len()).any(|window| window == b"APP_ENV"));
    assert!(encoded.windows(b"production".len()).any(|window| window == b"production"));
    assert!(encoded.windows(b"PHP_VALUE".len()).any(|window| window == b"PHP_VALUE"));
    assert!(encoded.windows(b"memory_limit=256M".len()).any(|window| window == b"memory_limit=256M"));
    assert!(!encoded.windows(b"HTTP_AUTHORIZATION".len()).any(|window| window == b"HTTP_AUTHORIZATION"));
}

#[test]
fn fastcgi_path_info_keeps_script_filename_separate() {
    let tmp = TempDir::new().unwrap();
    let mut configured = Service {
        id: "php-path-info".into(),
        name: "PHP PATH_INFO".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php {
            enabled: true,
            path_info: true,
            endpoint: "tcp:127.0.0.1:9000".into(),
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    assert!(service.php.as_ref().unwrap().path_info);
    let uri: Uri = "/index.php/foo/bar?q=1".parse().unwrap();
    let encoded = fastcgi_params(
        &service,
        service.php.as_ref().unwrap(),
        &Method::GET,
        &HeaderMap::new(),
        &uri,
        "/index.php",
        Some("/foo/bar"),
        Some("q=1"),
        &RequestContext {
            client_ip: "127.0.0.1".parse().unwrap(),
            client_port: Some(12345),
            server_name: "example.test".into(),
            server_port: 80,
            tls: false,
            version: Version::HTTP_11,
        },
    )
    .unwrap();
    assert!(encoded.windows(b"PATH_INFO".len()).any(|window| window == b"PATH_INFO"));
    assert!(encoded.windows(b"/foo/bar".len()).any(|window| window == b"/foo/bar"));
    assert!(encoded.windows(b"SCRIPT_FILENAME".len()).any(|window| window == b"SCRIPT_FILENAME"));
}

#[test]
fn php_custom_fastcgi_params_cannot_override_core_or_php_admin_values() {
    let tmp = TempDir::new().unwrap();
    for name in ["SCRIPT_FILENAME", "HTTP_HOST", "PHP_VALUE", "PHP_ADMIN_VALUE"] {
        let mut configured = Service {
            id: "php-reserved".into(),
            name: "PHP reserved".into(),
            document_root: tmp.path().to_path_buf(),
            php: Php {
                custom_params: BTreeMap::from([(name.into(), "bad".into())]),
                ..Default::default()
            },
            ..Default::default()
        };
        assert!(configured.validate().unwrap_err().to_string().contains("reserved name"));
    }
}

#[test]
fn php_custom_fastcgi_data_has_a_combined_bound() {
    let tmp = TempDir::new().unwrap();
    let custom_params = (0..17)
        .map(|index| (format!("APP_{index}"), "x".repeat(8192)))
        .collect();
    let mut configured = Service {
        id: "php-custom-bound".into(),
        name: "PHP custom bound".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php { custom_params, ..Default::default() },
        ..Default::default()
    };
    assert!(configured
        .validate()
        .unwrap_err()
        .to_string()
        .contains("at most 128 KiB"));
}

#[test]
fn fastcgi_response_cannot_control_downstream_framing_or_hop_headers() {
    let (_, headers) = parse_cgi_headers(
        b"Content-Type: text/plain\r\nContent-Length: 999999\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nTE: trailers\r\nTrailer: X-Test\r\nProxy-Authenticate: Basic realm=x\r\nProxy-Authorization: secret\r\nX-App: ok\r\n",
    )
    .unwrap();
    assert_eq!(headers.get("x-app").unwrap(), "ok");
    for name in [
        "content-length",
        "transfer-encoding",
        "connection",
        "te",
        "trailer",
        "proxy-authenticate",
        "proxy-authorization",
    ] {
        assert!(!headers.contains_key(name), "unexpected FastCGI framing header: {name}");
    }
}

#[test]
fn fastcgi_response_rejects_informational_status_codes() {
    let error = parse_cgi_headers(b"Status: 101 Switching Protocols\r\nContent-Type: text/plain\r\n")
        .unwrap_err()
        .to_string();
    assert!(error.contains("unsupported informational/invalid status"));
}

#[tokio::test]
async fn hardening_blocks_common_probe_paths_and_trace() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
    std::fs::write(tmp.path().join(".env"), b"secret").unwrap();
    std::fs::write(tmp.path().join("backup.sql"), b"secret").unwrap();
    std::fs::write(tmp.path().join("public.txt"), b"public").unwrap();
    let mut configured = Service {
        id: "hardened".into(),
        name: "hardened".into(),
        document_root: tmp.path().to_path_buf(),
        index: vec![],
        directory_listing: true,
        hardening: Hardening { block_common_attacks: true, strip_unnecessary_headers: false },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    for path in ["/.env", "/wp-config.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/backup.sql"] {
        let response = serve_request(&service, &request(Method::GET, path), path).await;
        assert_eq!(response.status(), StatusCode::FORBIDDEN, "{path}");
    }
    let trace = serve_request(&service, &request(Method::TRACE, "/"), "/").await;
    assert_eq!(trace.status(), StatusCode::FORBIDDEN);
    let listing = serve_request(&service, &request(Method::GET, "/"), "/").await;
    let listing = String::from_utf8_lossy(&listing.into_body().collect().await.unwrap().to_bytes()).to_string();
    assert!(listing.contains("public.txt"));
    assert!(!listing.contains(".env"));
    assert!(!listing.contains("backup.sql"));
    let well_known = serve_request(&service, &request(Method::GET, "/.well-known/missing"), "/.well-known/missing").await;
    assert_eq!(well_known.status(), StatusCode::NOT_FOUND);
}

#[tokio::test]
async fn hardening_strips_fingerprint_headers_after_source_rules() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
    let mut configured = Service {
        id: "headers".into(),
        name: "headers".into(),
        document_root: tmp.path().to_path_buf(),
        response_headers: BTreeMap::from([
            ("server".into(), "Example/1.0".into()),
            ("x-powered-by".into(), "PHP/8.4".into()),
            ("x-custom".into(), "kept".into()),
        ]),
        hardening: Hardening { block_common_attacks: false, strip_unnecessary_headers: true },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_request(&service, &request(Method::GET, "/index.html"), "/index.html").await;
    assert_eq!(response.status(), StatusCode::OK);
    assert!(!response.headers().contains_key("server"));
    assert!(!response.headers().contains_key("x-powered-by"));
    assert_eq!(response.headers()["x-custom"], "kept");
}

#[test]
fn php_admin_values_are_operator_only_and_serialized() {
    let tmp = TempDir::new().unwrap();
    let mut configured = Service {
        id: "php-admin".into(), name: "PHP admin".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php {
            enabled: true, endpoint: "tcp:127.0.0.1:9000".into(),
            php_admin_values: BTreeMap::from([("open_basedir".into(), "/var/www/webmail/:/tmp/".into())]),
            ..Default::default()
        }, ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let encoded = fastcgi_params(
        &service, service.php.as_ref().unwrap(), &Method::GET, &HeaderMap::new(),
        &"/index.php".parse().unwrap(), "/index.php", None, None,
        &RequestContext { client_ip: "127.0.0.1".parse().unwrap(), client_port: None,
            server_name: "webmail.example.test".into(), server_port: 8589, tls: false,
            version: Version::HTTP_11 },
    ).unwrap();
    assert!(encoded.windows(b"PHP_ADMIN_VALUE".len()).any(|w| w == b"PHP_ADMIN_VALUE"));
    assert!(encoded.windows(b"open_basedir=/var/www/webmail/:/tmp/".len())
        .any(|w| w == b"open_basedir=/var/www/webmail/:/tmp/"));
    configured.php.php_values.insert("open_basedir".into(), "/".into());
    assert!(configured.validate().is_err());
    configured.php.php_values.clear();
    configured.php.php_admin_values.insert("unsafe".into(), "value\nother=1".into());
    assert!(configured.validate().is_err());
}