//! Desired configuration and its validated, immutable routing snapshot.
use crate::{
    acl::{Acl, CompiledAcl},
    headers::{CompiledHeaders, HeaderRules},
};
use anyhow::{ensure, Context, Result};
use http::{header::HeaderValue, uri::Authority};
use serde::{Deserialize, Serialize};
use std::{
    collections::{HashMap, HashSet},
    net::{IpAddr, Ipv4Addr, SocketAddr},
    path::PathBuf,
    sync::Arc,
};
use url::{Host, Url};

pub const MAX_CONFIG_BYTES: usize = 262_144;
pub const MAX_BACKENDS: usize = 128;
pub const MAX_ROUTES: usize = 256;

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct Config {
    #[serde(default)]
    pub administration: crate::settings::Administration,
    #[serde(default)]
    pub logging: crate::logging::Settings,
    #[serde(default)]
    pub error_log: crate::logging::ErrorLogSettings,
    #[serde(default)]
    pub prometheus: crate::prometheus::Settings,
    #[serde(default)]
    pub listeners: crate::settings::Listeners,
    /// Legacy/default HTTP/2 lifecycle limits for listeners that do not yet
    /// persist an explicit `binding.http2_settings` object.
    #[serde(default)]
    pub http2: crate::settings::Http2Connections,
    #[serde(default)]
    pub docker_agents: crate::docker::Settings,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub streams: Vec<crate::stream::Host>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub redirects: Vec<crate::redirect::Host>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub not_found_hosts: Vec<crate::not_found::Host>,
    #[serde(default)]
    pub cache: crate::cache::Settings,
    #[serde(default)]
    pub transform: crate::transform::Settings,
    #[serde(default)]
    pub pages: crate::pages::GlobalPages,
    #[serde(default)]
    pub compression: crate::compression::Settings,
    #[serde(default)]
    pub server_header: crate::settings::ServerHeader,
    #[serde(default)]
    pub diagnostic_headers: crate::settings::DiagnosticHeaders,
    #[serde(default)]
    pub forwarding: crate::forwarding::Settings,
    #[serde(default, skip_serializing_if = "crate::tls::Settings::is_empty")]
    pub tls: crate::tls::Settings,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub web_services: Vec<crate::web_server::Service>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub vhosts: Vec<crate::vhost::Vhost>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub host_policies: Vec<HostPolicy>,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub acl_profiles: Vec<AclProfile>,
    #[serde(default, skip_serializing_if = "HeaderRules::is_empty")]
    pub headers: HeaderRules,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct HostPolicy {
    pub hosts: Vec<String>,
    pub acl: Acl,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(default, deny_unknown_fields)]
pub struct AclProfile {
    pub id: String,
    pub name: String,
    pub acl: Option<Acl>,
    pub country_access: crate::rate_limit::CountryAccess,
}
impl Default for AclProfile {
    fn default() -> Self {
        Self {
            id: String::new(),
            name: String::new(),
            acl: None,
            country_access: Default::default(),
        }
    }
}
#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct Backend {
    #[serde(default)]
    pub protocol: UpstreamProtocol,
    #[serde(default, skip_serializing_if = "Vec::is_empty")]
    pub address_allowlist: Vec<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tls_ca_pem: Option<String>,
    /// Optional DNS name used for TLS SNI and certificate hostname verification.
    /// TCP/DNS connection targeting remains pinned to `url`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tls_server_name: Option<String>,
    /// Verify the HTTPS backend certificate chain and server identity.
    /// Disabled by default for reverse-proxy compatibility; enable explicitly when required.
    #[serde(default)]
    pub tls_verify: bool,
    pub id: String,
    pub url: String,
    #[serde(default)]
    pub allow_private: bool,
    /// Explicitly allow a backend that resolves to a local RustProxy listener.
    /// This can expose the control plane or create a proxy loop and is off by default.
    #[serde(default)]
    pub accept_local_listener_risk: bool,
    #[serde(default)]
    pub preserve_host: bool,
}
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "lowercase")]
pub enum UpstreamProtocol {
    #[default]
    Http1,
    Http2,
    Auto,
}
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct Envelope {
    pub revision: u64,
    pub config: Config,
}
#[derive(Debug, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct Update {
    pub expected_revision: u64,
    pub config: Config,
}
#[derive(Debug, Clone)]
pub struct ValidationPolicy {
    pub tls_addr: Option<SocketAddr>,
    pub cert_dir: Option<PathBuf>,
    /// Resolved runtime data directory. Exposed only through authenticated admin status.
    pub data_dir: Option<PathBuf>,
    pub proxy_addr: SocketAddr,
    pub admin_addr: SocketAddr,
}
#[derive(Debug)]
pub struct CompiledBackend {
    pub address_policy: crate::upstream::AddressPolicy,
    pub client: crate::upstream::ProxyClient,
    pub websocket_client: crate::upstream::ProxyClient,
    pub id: String,
    /// Configured network origin used by raw TCP probes and policy checks.
    pub origin: String,
    /// HTTP request origin. For HTTPS this may carry a separate verified TLS name.
    pub request_origin: String,
    pub host_header: HeaderValue,
    pub preserve_host: bool,
    pub protocol: UpstreamProtocol,
    /// Whether backend TLS certificate chain/name verification is enabled.
    /// Retained in the compiled snapshot for failure diagnostics only.
    pub tls_verify: bool,
    pub accept_local_listener_risk: bool,
    /// True only when this backend URL names the configured administration socket
    /// directly. Used by the guarded control-plane reverse-proxy path.
    pub targets_admin_listener: bool,
}
#[derive(Debug, Clone)]
pub enum CompiledSource {
    ReverseProxy,
    WebServer(Arc<crate::web_server::CompiledService>),
}

#[derive(Debug, Clone)]
pub struct CompiledRoute {
    pub backend_id: Option<String>,
    pub bindings: Vec<crate::vhost::Listener>,
    pub frontend: Option<Arc<CompiledFrontend>>,
    pub pool: Option<Arc<crate::balance::Pool>>,
    pub cache: Option<bool>,
    pub id: String,
    pub path_prefix: String,
    pub match_type: crate::vhost::PathMatch,
    pub path_regex: Option<regex::Regex>,
    pub rewrite: crate::vhost::PathRewrite,
    pub response: Option<crate::vhost::LocationResponse>,
    pub source: CompiledSource,
    pub backend: Option<Arc<CompiledBackend>>,
    pub acl: Option<CompiledAcl>,
    pub headers: CompiledHeaders,
}
#[derive(Debug)]
pub struct CompiledFrontend {
    pub websockets: bool,
    pub websocket_legacy_support: bool,
    pub websocket_rfc8441: bool,
    pub websocket_rfc9220: bool,
    pub force_ssl: bool,
    pub forward_client_ip: bool,
    /// HTTPS target port used by Force SSL redirects. Port 443 wins when multiple TLS ports are selected.
    pub https_redirect_port: Option<u16>,
    pub http2_enabled: bool,
    pub http3_enabled: bool,
    pub tls_policy: crate::tls::ProtocolPolicy,
    pub tls: Option<Arc<rustls::ServerConfig>>,
    pub tls_http1: Option<Arc<rustls::ServerConfig>>,
    pub cloudflare_client_ip: bool,
    pub timing_headers: bool,
    pub backend_header: bool,
    pub backend_timing_header: bool,
    pub rate_limit: crate::rate_limit::Settings,
    pub basic_auth: Option<crate::basic_auth::Compiled>,
    pub metrics: Arc<crate::metrics::VhostMetrics>,
    pub server_header: crate::settings::ServerHeader,
    pub diagnostic_headers: crate::settings::DiagnosticHeaders,
    pub tinyauth: Option<crate::tinyauth::Compiled>,
    pub id: String,
    pub bindings: Vec<crate::vhost::Listener>,
    pub acl_profile_id: Option<String>,
    pub profile_acl: Option<CompiledAcl>,
    pub profile_country_access: crate::rate_limit::CountryAccess,
    pub acl: Option<CompiledAcl>,
    pub headers: CompiledHeaders,
    pub security: crate::security::CompiledSecurity,
    pub cache: crate::cache::Settings,
    pub transform: crate::transform::Settings,
    pub pages: crate::pages::VhostPages,
    pub proxy_timeouts: crate::vhost::ProxyTimeouts,
}
pub struct Snapshot {
    pub vhost_metrics: std::collections::BTreeMap<String, Arc<crate::metrics::VhostMetrics>>,
    pub forwarding: crate::forwarding::Compiled,
    pub quic_tls: Option<Arc<quinn::crypto::rustls::QuicServerConfig>>,
    pub listeners: Vec<crate::vhost::Listener>,
    pub pools: Vec<Arc<crate::balance::Pool>>,
    pub tls_http1: Option<Arc<rustls::ServerConfig>>,
    frontends: HashMap<String, Vec<Arc<CompiledFrontend>>>,
    pub tls: Option<Arc<rustls::ServerConfig>>,
    pub envelope: Envelope,
    routes: HashMap<String, Vec<CompiledRoute>>,
    /// Main vhost backend fallback, kept separate from user Custom locations.
    fallbacks: HashMap<String, Vec<CompiledRoute>>,
    redirects: HashMap<String, Vec<Arc<crate::redirect::CompiledHost>>>,
    not_found_hosts: HashMap<String, Vec<Arc<crate::not_found::CompiledHost>>>,
    host_acls: HashMap<String, Arc<CompiledAcl>>,
    pub headers: CompiledHeaders,
}
impl std::fmt::Debug for Snapshot {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        // QUIC crypto has no Debug implementation; never format private keys.
        f.debug_struct("Snapshot")
            .field("revision", &self.envelope.revision)
            .field("listeners", &self.listeners)
            .field("quic_tls", &self.quic_tls.is_some())
            .finish_non_exhaustive()
    }
}
impl Snapshot {
    fn host_patterns(host: &str) -> Vec<String> {
        let mut patterns = vec![host.to_owned()];
        for (index, _) in host.match_indices('.') {
            let suffix = &host[index + 1..];
            if suffix.contains('.') {
                patterns.push(format!("*.{suffix}"));
            }
        }
        patterns
    }
    pub fn host_allowed(&self, host: &str, peer: IpAddr) -> bool {
        for pattern in Self::host_patterns(host) {
            if let Some(acl) = self.host_acls.get(&pattern) {
                return acl.allows(peer);
            }
        }
        true
    }
    /// RFC 8441 SETTINGS_ENABLE_CONNECT_PROTOCOL is connection-scoped, so it is
    /// advertised only when at least one explicitly opted-in vhost is bound to
    /// this HTTP/2 listener. Request routing still enforces the per-vhost opt-in.
    pub fn websocket_rfc8441_on(&self, local: SocketAddr, tls: bool) -> bool {
        self.frontends.values().flatten().any(|frontend| {
            frontend.websockets
                && frontend.websocket_rfc8441
                && frontend.http2_enabled
                && frontend.bindings.iter().any(|binding| {
                    binding.matches(local, tls) && if tls { binding.http2 } else { binding.h2c }
                })
        })
    }

    /// RFC 9220 SETTINGS_ENABLE_CONNECT_PROTOCOL is connection-scoped, so it is
    /// advertised only when at least one explicitly opted-in vhost is bound to
    /// this QUIC listener. Request routing still enforces the per-vhost opt-in.
    pub fn websocket_rfc9220_on(&self, local: SocketAddr) -> bool {
        self.frontends.values().flatten().any(|frontend| {
            frontend.websockets
                && frontend.websocket_rfc9220
                && frontend.http3_enabled
                && frontend.bindings.iter().any(|binding| {
                    binding.tls && binding.http3.is_some() && binding.matches(local, true)
                })
        })
    }
    /// Production routing always uses the TCP connection's local endpoint.
    /// Exact hostnames win over the longest matching wildcard hostname.
    pub fn select_on(
        &self,
        host: &str,
        path: &str,
        local: SocketAddr,
        tls: bool,
    ) -> Option<&CompiledRoute> {
        for pattern in Self::host_patterns(host) {
            let fallback = self.fallbacks.get(&pattern).and_then(|routes| {
                routes
                    .iter()
                    .find(|route| route.bindings.iter().any(|l| l.matches(local, tls)))
            });
            // A claimed exact/wildcard vhost owns the request as a unit. First try
            // its Custom locations, then its main backend fallback; never continue
            // into a broader wildcard merely because no Custom location matched.
            if let Some(fallback) = fallback {
                return self
                    .routes
                    .get(&pattern)
                    .and_then(|routes| {
                        select_route(routes, path, |r| {
                            r.bindings.iter().any(|l| l.matches(local, tls))
                        })
                    })
                    .or(Some(fallback));
            }
        }
        None
    }
    pub fn frontend(
        &self,
        host: &str,
        local: SocketAddr,
        tls: bool,
    ) -> Option<&Arc<CompiledFrontend>> {
        for pattern in Self::host_patterns(host) {
            if let Some(frontend) = self.frontends.get(&pattern).and_then(|frontends| {
                frontends
                    .iter()
                    .find(|f| f.bindings.iter().any(|l| l.matches(local, tls)))
            }) {
                return Some(frontend);
            }
        }
        None
    }
    /// Select a redirect host/rule using the accepted socket, TLS state and normalized path.
    /// Exact hostnames win over the longest matching wildcard, matching vhost behavior.
    pub fn redirect_on(
        &self,
        host: &str,
        path: &str,
        local: SocketAddr,
        tls: bool,
    ) -> Option<(
        &Arc<crate::redirect::CompiledHost>,
        &crate::redirect::CompiledRule,
    )> {
        for pattern in Self::host_patterns(host) {
            if let Some((redirect, rule)) = self.redirects.get(&pattern).and_then(|redirects| {
                redirects.iter().find_map(|redirect| {
                    if !redirect
                        .bindings
                        .iter()
                        .any(|binding| binding.matches(local, tls))
                    {
                        return None;
                    }
                    redirect
                        .rules
                        .iter()
                        .find(|rule| rule.matches(path, tls))
                        .map(|rule| (redirect, rule))
                })
            }) {
                return Some((redirect, rule));
            }
        }
        None
    }
    /// Select a host-owned local 404/static response using the accepted socket.
    pub fn not_found_host_on(
        &self,
        host: &str,
        local: SocketAddr,
        tls: bool,
    ) -> Option<&Arc<crate::not_found::CompiledHost>> {
        for pattern in Self::host_patterns(host) {
            if let Some(item) = self.not_found_hosts.get(&pattern).and_then(|items| {
                items.iter().find(|item| {
                    item.bindings
                        .iter()
                        .any(|binding| binding.matches(local, tls))
                })
            }) {
                return Some(item);
            }
        }
        None
    }

    /// Legacy inspection helper only; network handlers must call select_on.
    pub fn select(&self, host: &str, path: &str) -> Option<&CompiledRoute> {
        for pattern in Self::host_patterns(host) {
            if let Some(fallback) = self
                .fallbacks
                .get(&pattern)
                .and_then(|routes| routes.first())
            {
                return self
                    .routes
                    .get(&pattern)
                    .and_then(|routes| select_route(routes, path, |_| true))
                    .or(Some(fallback));
            }
        }
        None
    }
}

fn select_route<'a, F>(
    routes: &'a [CompiledRoute],
    path: &str,
    allowed: F,
) -> Option<&'a CompiledRoute>
where
    F: Fn(&CompiledRoute) -> bool,
{
    if let Some(exact) = routes.iter().find(|route| {
        allowed(route)
            && route.match_type == crate::vhost::PathMatch::Exact
            && route.path_prefix == path
    }) {
        return Some(exact);
    }
    let prefix = routes
        .iter()
        .filter(|route| {
            allowed(route)
                && matches!(
                    route.match_type,
                    crate::vhost::PathMatch::Prefix | crate::vhost::PathMatch::PrefixPriority
                )
                && prefix_matches(&route.path_prefix, path)
        })
        .max_by_key(|route| route.path_prefix.len());
    if prefix.is_some_and(|route| route.match_type == crate::vhost::PathMatch::PrefixPriority) {
        return prefix;
    }
    if let Some(regex) = routes.iter().find(|route| {
        allowed(route)
            && matches!(
                route.match_type,
                crate::vhost::PathMatch::Regex | crate::vhost::PathMatch::RegexInsensitive
            )
            && route
                .path_regex
                .as_ref()
                .is_some_and(|regex| regex.is_match(path))
    }) {
        return Some(regex);
    }
    prefix
}

impl CompiledRoute {
    /// Return a normalized replacement path for the upstream hop. `None` means
    /// preserve the client's exact origin-form path bytes.
    pub fn rewritten_path(&self, path: &str) -> Result<Option<String>> {
        use crate::vhost::RewriteMode;
        let rewritten = match self.rewrite.mode {
            RewriteMode::Preserve => return Ok(None),
            RewriteMode::StripPrefix => {
                let tail = path.strip_prefix(&self.path_prefix).unwrap_or("");
                if tail.is_empty() {
                    "/".to_owned()
                } else {
                    tail.to_owned()
                }
            }
            RewriteMode::ReplacePrefix => {
                let tail = path.strip_prefix(&self.path_prefix).unwrap_or("");
                let base = self.rewrite.value.trim_end_matches('/');
                if tail.is_empty() {
                    if base.is_empty() {
                        "/".to_owned()
                    } else {
                        base.to_owned()
                    }
                } else if base.is_empty() || base == "/" {
                    tail.to_owned()
                } else {
                    format!("{base}{tail}")
                }
            }
            RewriteMode::Regex => self
                .path_regex
                .as_ref()
                .expect("regex rewrite was validated")
                .replace(path, self.rewrite.value.as_str())
                .into_owned(),
        };
        crate::acl::validate_decoded_routing_path(&rewritten)
            .context("invalid rewritten location path")?;
        Ok(Some(rewritten))
    }
}
pub fn prefix_matches(prefix: &str, path: &str) -> bool {
    prefix == "/"
        || path == prefix
        || path
            .strip_prefix(prefix)
            .is_some_and(|tail| tail.starts_with('/'))
}
pub(crate) fn valid_id(id: &str) -> bool {
    !id.is_empty()
        && id.len() <= 64
        && id
            .bytes()
            .all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
}
/// Vhost names are ASCII DNS names (IDNs must be provided as punycode) or IPv4.
pub fn normalize_host(value: &str) -> Result<String> {
    let host = value
        .strip_suffix('.')
        .unwrap_or(value)
        .to_ascii_lowercase();
    ensure!(
        !host.is_empty() && host.len() <= 253,
        "hostname length must be 1..253"
    );
    ensure!(
        host.split('.').all(|label| {
            !label.is_empty()
                && label.len() <= 63
                && !label.starts_with('-')
                && !label.ends_with('-')
                && label
                    .bytes()
                    .all(|b| b.is_ascii_alphanumeric() || b == b'-')
        }),
        "invalid hostname: use an ASCII hostname without a port or wildcard"
    );
    Ok(host)
}
/// Configured frontend patterns may use a single leading `*.` wildcard.
/// Runtime Host values remain exact and are normalized by `normalize_host`.
pub fn normalize_host_pattern(value: &str) -> Result<String> {
    let value = value.trim();
    if let Some(base) = value.strip_prefix("*.") {
        ensure!(
            !base.contains('*'),
            "wildcard hostname allows only one leading *."
        );
        let base = normalize_host(base)?;
        ensure!(
            base.contains('.') && base.parse::<IpAddr>().is_err(),
            "wildcard hostname requires a DNS suffix such as *.example.com"
        );
        return Ok(format!("*.{base}"));
    }
    ensure!(
        !value.contains('*'),
        "wildcard hostname allows only one leading *."
    );
    normalize_host(value)
}
pub fn request_host(value: &str) -> Result<String> {
    ensure!(!value.contains('@'), "invalid Host");
    let authority: Authority = value.parse().context("invalid Host authority")?;
    if let Some(port) = authority.port() {
        let number: u16 = port.as_str().parse().context("invalid Host port")?;
        ensure!(number > 0, "invalid Host port");
    }
    let host = authority
        .host()
        .trim_start_matches('[')
        .trim_end_matches(']');
    if let Ok(ip) = host.parse::<IpAddr>() {
        return Ok(ip.to_string());
    }
    normalize_host(host)
}
fn ipv4_policy(ip: Ipv4Addr, allow_private: bool) -> Result<()> {
    let [a, b, _, _] = ip.octets();
    ensure!(
        a != 0 && a < 224 && !ip.is_broadcast(),
        "unspecified/reserved/multicast target blocked"
    );
    ensure!(
        !(a == 169 && b == 254),
        "link-local and metadata targets are blocked"
    );
    ensure!(
        !(a == 100 && (64..=127).contains(&b)),
        "shared-address/metadata range is blocked"
    );
    ensure!(
        !(a == 198 && (b == 18 || b == 19)),
        "benchmark range is blocked"
    );
    ensure!(
        !ip.is_documentation(),
        "documentation address is not a backend"
    );
    ensure!(
        allow_private || (!ip.is_private() && !ip.is_loopback()),
        "private/loopback backend requires allow_private=true"
    );
    Ok(())
}
pub(crate) fn ip_policy(ip: IpAddr, allow_private: bool) -> Result<()> {
    match ip {
        IpAddr::V4(ip) => ipv4_policy(ip, allow_private),
        IpAddr::V6(ip) => {
            if let Some(v4) = ip.to_ipv4_mapped() {
                return ipv4_policy(v4, allow_private);
            }
            let s = ip.segments();
            ensure!(
                !ip.is_unspecified() && !ip.is_multicast(),
                "unspecified/multicast target blocked"
            );
            ensure!(
                s[0] & 0xffc0 != 0xfe80,
                "IPv6 link-local targets are blocked"
            );
            ensure!(
                !(s[0] == 0x2001 && s[1] == 0x0db8),
                "documentation address is not a backend"
            );
            // Only global unicast, ULA and loopback. Reject IPv4 translation/tunnel special ranges.
            let ula = s[0] & 0xfe00 == 0xfc00;
            let global =
                s[0] & 0xe000 == 0x2000 && s[0] != 0x2002 && !(s[0] == 0x2001 && s[1] == 0);
            ensure!(
                global || ula || ip.is_loopback(),
                "special IPv6 target blocked"
            );
            ensure!(
                allow_private || (!ula && !ip.is_loopback()),
                "private/loopback backend requires allow_private=true"
            );
            Ok(())
        }
    }
}
pub(crate) fn compile_backend(
    backend: &Backend,
    policy: &ValidationPolicy,
    bindings: &[SocketAddr],
    keepalive: &crate::balance::Keepalive,
) -> Result<CompiledBackend> {
    compile_backend_with_timeout(
        backend,
        policy,
        bindings,
        keepalive,
        std::time::Duration::from_secs(10),
    )
}

pub(crate) fn compile_backend_with_timeout(
    backend: &Backend,
    policy: &ValidationPolicy,
    bindings: &[SocketAddr],
    keepalive: &crate::balance::Keepalive,
    connect_timeout: std::time::Duration,
) -> Result<CompiledBackend> {
    ensure!(valid_id(&backend.id), "invalid backend id");
    ensure!(backend.url.len() <= 512, "backend URL too long");
    let url = Url::parse(&backend.url).context("invalid backend URL")?;
    ensure!(
        matches!(url.scheme(), "http" | "https"),
        "backend scheme must be http or https"
    );
    ensure!(backend.protocol == UpstreamProtocol::Http1 || !backend.preserve_host,
        "HTTP/2 or auto upstream requires preserve_host=false; use http1 for original Host preservation");
    ensure!(
        backend.tls_ca_pem.is_none() || url.scheme() == "https",
        "backend additional CA can only be used with an https:// URL; remove the CA or change the backend URL to HTTPS"
    );
    ensure!(
        backend.tls_server_name.is_none() || url.scheme() == "https",
        "backend TLS server name can only be used with an https:// URL; remove the TLS server name or change the backend URL to HTTPS"
    );
    let tls_server_name = backend
        .tls_server_name
        .as_deref()
        .map(normalize_host)
        .transpose()?;
    if let Some(name) = &tls_server_name {
        ensure!(
            name.parse::<IpAddr>().is_err(),
            "backend TLS server name must be the DNS name present in the certificate (for example origin.example.internal), not an IP address"
        );
    }
    ensure!(
        url.username().is_empty() && url.password().is_none(),
        "URL credentials are forbidden"
    );
    ensure!(
        url.path() == "/" && url.query().is_none() && url.fragment().is_none(),
        "backend URL must be an origin, without a path, query or fragment"
    );
    let address_policy = crate::upstream::AddressPolicy::new(backend)?
        .with_listeners(policy)
        .with_bindings(bindings);
    match url.host().context("backend host missing")? {
        Host::Ipv4(ip) => address_policy.check(IpAddr::V4(ip))?,
        Host::Ipv6(ip) => address_policy.check(IpAddr::V6(ip))?,
        Host::Domain(domain) => {
            normalize_host(domain)?;
        }
    }
    let port = url
        .port_or_known_default()
        .context("backend port missing")?;
    ensure!(port > 0, "backend port must be nonzero");
    let targets_admin_listener = match url.host().context("backend host missing")? {
        Host::Ipv4(ip) => {
            crate::vhost::socket_overlap(SocketAddr::new(IpAddr::V4(ip), port), policy.admin_addr)
        }
        Host::Ipv6(ip) => {
            crate::vhost::socket_overlap(SocketAddr::new(IpAddr::V6(ip), port), policy.admin_addr)
        }
        // DNS destinations remain subject to the normal self-target guard, but
        // are never trusted for administration-cookie passthrough. The special
        // control-plane path must point at the listener explicitly by IP.
        Host::Domain(_) => false,
    };
    // Exact local listener targets are rejected by AddressPolicy by default, including DNS
    // answers. An explicit per-backend risk acceptance can override only that self-target
    // guard; remote origins on any valid backend port, including 9090, remain valid.
    let authority = match url.host().context("backend host missing")? {
        Host::Ipv6(ip) => format!("[{ip}]:{port}"),
        host => format!("{host}:{port}"),
    };
    let request_authority = tls_server_name
        .as_deref()
        .map(|name| format!("{name}:{port}"))
        .unwrap_or_else(|| authority.clone());
    let client = crate::upstream::client_with_timeout(
        backend,
        address_policy.clone(),
        false,
        keepalive,
        connect_timeout,
    )?;
    let websocket_client = if backend.protocol == UpstreamProtocol::Http1 {
        client.clone()
    } else {
        crate::upstream::client_with_timeout(
            backend,
            address_policy.clone(),
            true,
            keepalive,
            connect_timeout,
        )?
    };
    Ok(CompiledBackend {
        address_policy,
        id: backend.id.clone(),
        origin: format!("{}://{authority}", url.scheme()),
        request_origin: format!("{}://{request_authority}", url.scheme()),
        host_header: authority.parse()?,
        preserve_host: backend.preserve_host,
        protocol: backend.protocol,
        tls_verify: backend.tls_verify,
        accept_local_listener_risk: backend.accept_local_listener_risk,
        targets_admin_listener,
        client,
        websocket_client,
    })
}
pub fn compile(config: Config, revision: u64, policy: &ValidationPolicy) -> Result<Snapshot> {
    compile_with_defaults(
        config,
        revision,
        policy,
        (policy.proxy_addr, policy.tls_addr),
    )
}
/// Validate both active sockets and the sockets that will be used after restart.
pub fn compile_with_defaults(
    config: Config,
    revision: u64,
    policy: &ValidationPolicy,
    defaults: (SocketAddr, Option<SocketAddr>),
) -> Result<Snapshot> {
    compile_reusing(config, revision, policy, defaults, None)
}
/// Rebuild clients and route policies, but retain compatible health observations,
/// full-exchange counters and affinity tokens through unrelated config edits.
pub fn compile_reusing(
    config: Config,
    revision: u64,
    policy: &ValidationPolicy,
    defaults: (SocketAddr, Option<SocketAddr>),
    previous: Option<&Snapshot>,
) -> Result<Snapshot> {
    compile_with_active(config, revision, policy, defaults, previous, &[])
}
pub fn compile_with_active(
    mut config: Config,
    revision: u64,
    policy: &ValidationPolicy,
    defaults: (SocketAddr, Option<SocketAddr>),
    previous: Option<&Snapshot>,
    active: &[crate::vhost::Listener],
) -> Result<Snapshot> {
    config.administration.validate(&config.tls)?;
    config.logging.validate()?;
    config.error_log.validate()?;
    let desired_admin = config.administration.resolved_listen(policy.admin_addr);
    // A persisted non-loopback address is only accepted with administration TLS.
    // When `listen` is omitted, the startup/CLI address remains authoritative and
    // its legacy plain-HTTP risk gate is enforced by main before compilation.
    ensure!(
        config.administration.listen.is_none()
            || desired_admin.ip().is_loopback()
            || config.administration.tls,
        "a persisted remote administration listener requires administration TLS"
    );
    let mut desired_policy = policy.clone();
    desired_policy.admin_addr = desired_admin;
    config.listeners.validate(&desired_policy)?;
    config.http2.validate()?;
    config.docker_agents.validate(&config.listeners)?;
    let certificate_ids: HashSet<_> = config
        .tls
        .certificates
        .iter()
        .map(|certificate| certificate.id.as_str())
        .collect();
    for agent in &config.docker_agents.agents {
        if let Some(id) = agent.certificate_id.as_deref() {
            ensure!(
                certificate_ids.contains(id),
                "Docker agent {} references unknown certificate id {}",
                agent.id,
                id
            );
        }
    }
    config.prometheus.validate()?;
    config.cache.validate()?;
    config.transform.validate()?;
    config.pages.validate()?;
    config.compression.validate()?;
    config.server_header.validate()?;
    let forwarding = config.forwarding.compile()?;
    ensure!(
        config.web_services.len() <= 128,
        "too many Web Services (max 128)"
    );
    let mut web_services = HashMap::new();
    for service in &mut config.web_services {
        service
            .validate()
            .with_context(|| format!("Web Service {}", service.id))?;
        let compiled = Arc::new(
            service
                .compile()
                .with_context(|| format!("Web Service {}", service.id))?,
        );
        ensure!(
            web_services.insert(service.id.clone(), compiled).is_none(),
            "duplicate Web Service id"
        );
    }
    ensure!(config.vhosts.len() <= 64, "too many vhosts (max 64)");
    let mut vhost_ids = HashSet::new();
    for host in &mut config.vhosts {
        host.validate()
            .with_context(|| format!("vhost {}", host.id))?;
        let validate_source = |source: &crate::vhost::Source| -> Result<()> {
            if let crate::vhost::Source::WebServer { web_service_id } = source {
                ensure!(
                    web_services.contains_key(web_service_id),
                    "vhost {} references unknown Web Service {}",
                    host.id,
                    web_service_id
                );
            }
            Ok(())
        };
        validate_source(&host.source)?;
        for route in &host.routes {
            if route.response.is_none() {
                validate_source(&route.source)?;
            }
        }
        ensure!(vhost_ids.insert(host.id.clone()), "duplicate vhost id");
    }
    ensure!(
        config.redirects.len() <= 64,
        "too many redirect hosts (max 64)"
    );
    let mut redirect_ids = HashSet::new();
    for redirect in &mut config.redirects {
        redirect
            .validate()
            .with_context(|| format!("redirect {}", redirect.id))?;
        ensure!(
            redirect_ids.insert(redirect.id.clone()),
            "duplicate redirect id"
        );
    }
    ensure!(
        config.not_found_hosts.len() <= 64,
        "too many 404 hosts (max 64)"
    );
    let mut not_found_ids = HashSet::new();
    for host in &mut config.not_found_hosts {
        host.validate()
            .with_context(|| format!("404 host {}", host.id))?;
        ensure!(
            not_found_ids.insert(host.id.clone()),
            "duplicate 404 host id"
        );
    }
    let effective_tls = crate::tls::for_all_frontends(
        &config.tls,
        &config.vhosts,
        &config.redirects,
        &config.not_found_hosts,
    )?;
    let tls = crate::tls::compile(&effective_tls, policy.cert_dir.as_deref())?;
    let tls_http1 = tls
        .as_ref()
        .map(|base| crate::tls::variant(base, &effective_tls.policy, false))
        .transpose()?;
    ensure!(
        config
            .vhosts
            .iter()
            .map(|h| h.backends.len())
            .sum::<usize>()
            <= MAX_BACKENDS,
        "too many backends across all pools (max 128)"
    );
    ensure!(
        config.vhosts.iter().map(|h| h.routes.len()).sum::<usize>() <= MAX_ROUTES,
        "too many paths across all vhosts (max 256)"
    );
    ensure!(
        config
            .redirects
            .iter()
            .map(|h| h.rules.len())
            .sum::<usize>()
            <= MAX_ROUTES,
        "too many rules across all redirect hosts (max 256)"
    );
    ensure!(
        serde_json::to_vec(&config)?.len() <= MAX_CONFIG_BYTES,
        "configuration too large"
    );
    let listeners = crate::vhost::listener_plan(&config, &desired_policy)?;
    crate::stream::validate(
        &mut config.streams,
        &listeners,
        desired_policy.admin_addr,
        config
            .prometheus
            .enabled
            .then_some(config.prometheus.listen),
    )?;
    if config.prometheus.enabled {
        ensure!(
            !crate::vhost::socket_overlap(config.prometheus.listen, desired_policy.admin_addr)
                && !listeners
                    .iter()
                    .any(|l| crate::vhost::socket_overlap(config.prometheus.listen, l.address)),
            "metrics: exporter address overlaps a proxy/administration listener"
        );
    }
    let mut guarded_bindings: Vec<_> = listeners.iter().map(|l| l.address).collect();
    if let Some(previous) = previous {
        guarded_bindings.extend(previous.listeners.iter().map(|l| l.address));
    }
    guarded_bindings.extend(active.iter().map(|l| l.address));
    // Startup/default addresses remain protected backend destinations even when
    // the desired named-listener plan changes before a restart.
    guarded_bindings.push(defaults.0);
    guarded_bindings.extend(defaults.1);
    guarded_bindings.extend([
        policy.proxy_addr,
        policy.admin_addr,
        desired_policy.admin_addr,
    ]);
    guarded_bindings.extend(policy.tls_addr);
    if config.prometheus.enabled {
        guarded_bindings.push(config.prometheus.listen);
    }
    if let Some(previous) = previous {
        if previous.envelope.config.prometheus.enabled {
            guarded_bindings.push(previous.envelope.config.prometheus.listen);
        }
    }
    guarded_bindings.sort();
    guarded_bindings.dedup();
    let global_headers = config.headers.compile()?;
    ensure!(
        config.host_policies.len() <= 256,
        "too many host ACL policies"
    );
    let mut host_acls = HashMap::new();
    for policy in &mut config.host_policies {
        ensure!(
            !policy.hosts.is_empty(),
            "host policy requires at least one hostname"
        );
        let compiled = Arc::new(policy.acl.compile()?);
        for host in &mut policy.hosts {
            *host = normalize_host_pattern(host)?;
            ensure!(
                host_acls.insert(host.clone(), compiled.clone()).is_none(),
                "duplicate host ACL policy"
            );
        }
    }
    ensure!(config.acl_profiles.len() <= 64, "at most 64 ACL profiles");
    let mut acl_profiles: HashMap<String, (Option<CompiledAcl>, crate::rate_limit::CountryAccess)> =
        HashMap::new();
    for profile in &mut config.acl_profiles {
        ensure!(valid_id(&profile.id), "invalid ACL profile id");
        ensure!(
            !profile.name.trim().is_empty()
                && profile.name.len() <= 96
                && !profile.name.chars().any(char::is_control),
            "ACL profile name must be 1..96 bytes without controls"
        );
        profile.name = profile.name.trim().to_owned();
        profile.country_access.validate()?;
        let acl = profile.acl.as_ref().map(Acl::compile).transpose()?;
        ensure!(
            acl_profiles
                .insert(profile.id.clone(), (acl, profile.country_access.clone()))
                .is_none(),
            "duplicate ACL profile id"
        );
    }
    for agent in &config.docker_agents.agents {
        if let Some(profile_id) = agent.acl_profile_id.as_deref() {
            ensure!(
                acl_profiles.contains_key(profile_id),
                "Docker agent {} references unknown default ACL profile {}",
                agent.id,
                profile_id
            );
        }
        for assignment in &agent.assignments {
            if let Some(profile_id) = assignment.acl_profile_id.as_deref() {
                ensure!(
                    acl_profiles.contains_key(profile_id),
                    "Docker assignment {} on agent {} references unknown ACL profile {}",
                    assignment.service_key,
                    agent.id,
                    profile_id
                );
            }
        }
    }
    let mut routes: HashMap<String, Vec<CompiledRoute>> = HashMap::new();
    let mut fallbacks: HashMap<String, Vec<CompiledRoute>> = HashMap::new();
    let mut frontends: HashMap<String, Vec<Arc<CompiledFrontend>>> = HashMap::new();
    let mut redirects: HashMap<String, Vec<Arc<crate::redirect::CompiledHost>>> = HashMap::new();
    let mut not_found_hosts: HashMap<String, Vec<Arc<crate::not_found::CompiledHost>>> =
        HashMap::new();
    let mut claimed_hosts: HashMap<String, Vec<crate::vhost::Listener>> = HashMap::new();
    for redirect in &config.redirects {
        let bindings = redirect.frontend.resolved(&config.listeners)?;
        // Disabled redirect hosts reserve their names as vhosts do, preventing
        // an overlapping fallback from unexpectedly taking traffic.
        for name in &redirect.frontend.hosts {
            let claimed = claimed_hosts.entry(name.clone()).or_default();
            for a in claimed.iter() {
                for b in &bindings {
                    ensure!(
                        !crate::vhost::socket_overlap(a.address, b.address),
                        "overlapping frontend bindings for hostname {}",
                        name
                    );
                }
            }
            claimed.extend(bindings.iter().copied());
        }
        if redirect.enabled {
            let compiled = Arc::new(crate::redirect::compile(redirect, &config.listeners)?);
            for name in &redirect.frontend.hosts {
                redirects
                    .entry(name.clone())
                    .or_default()
                    .push(compiled.clone());
            }
        }
    }
    for host in &config.not_found_hosts {
        let bindings = host.frontend.resolved(&config.listeners)?;
        // Disabled local-response hosts reserve names too, avoiding accidental
        // exposure through a broader wildcard vhost.
        for name in &host.frontend.hosts {
            let claimed = claimed_hosts.entry(name.clone()).or_default();
            for a in claimed.iter() {
                for b in &bindings {
                    ensure!(
                        !crate::vhost::socket_overlap(a.address, b.address),
                        "overlapping frontend bindings for hostname {}",
                        name
                    );
                }
            }
            claimed.extend(bindings.iter().copied());
        }
        if host.enabled {
            let compiled = Arc::new(crate::not_found::compile(host, &config.listeners)?);
            for name in &host.frontend.hosts {
                not_found_hosts
                    .entry(name.clone())
                    .or_default()
                    .push(compiled.clone());
            }
        }
    }
    let mut pools = Vec::new();
    let mut vhost_metrics = std::collections::BTreeMap::new();
    for host in &mut config.vhosts {
        let host_bindings = host.frontend.resolved(&config.listeners)?;
        let tls_ports: HashSet<u16> = host_bindings
            .iter()
            .filter(|binding| binding.tls)
            .map(|binding| binding.address.port())
            .collect();
        if host.websocket_rfc8441 {
            ensure!(
                host_bindings.iter().any(|binding| {
                    (binding.tls && binding.http2) || (!binding.tls && binding.h2c)
                }),
                "vhost {} RFC 8441 requires at least one selected HTTP/2-capable listener",
                host.id
            );
        }
        if host.websocket_rfc9220 {
            ensure!(
                host_bindings
                    .iter()
                    .any(|binding| binding.tls && binding.http3.is_some()),
                "vhost {} RFC 9220 requires at least one selected HTTP/3 listener",
                host.id
            );
        }
        let https_redirect_port = if host.force_ssl {
            ensure!(
                host_bindings.iter().any(|binding| !binding.tls),
                "vhost {} Force SSL requires at least one selected plain HTTP listener",
                host.id
            );
            ensure!(
                !tls_ports.is_empty(),
                "vhost {} Force SSL requires at least one selected TLS listener",
                host.id
            );
            if tls_ports.contains(&443) {
                Some(443)
            } else {
                ensure!(
                    tls_ports.len() == 1,
                    "vhost {} Force SSL cannot choose an HTTPS target: select one TLS port or include port 443",
                    host.id
                );
                tls_ports.iter().copied().next()
            }
        } else {
            None
        };
        let cookie = host
            .load_balancing
            .sticky
            .cookie_name
            .as_deref()
            .unwrap_or("");
        ensure!(
            !(cookie.starts_with("__Host-") || cookie.starts_with("__Secure-"))
                || host_bindings.iter().all(|l| l.tls),
            "prefixed affinity cookies require TLS on every resolved frontend"
        );
        // Disabled vhosts also reserve their name, preventing fallback exposure.
        for name in &host.frontend.hosts {
            let claimed = claimed_hosts.entry(name.clone()).or_default();
            for a in claimed.iter() {
                for b in &host_bindings {
                    ensure!(
                        !crate::vhost::socket_overlap(a.address, b.address),
                        "overlapping frontend bindings for hostname {}",
                        name
                    );
                }
            }
            claimed.extend(host_bindings.iter().copied());
        }
        let mut compiled_members = Vec::new();
        for definition in &host.backends {
            let mut backend = compile_backend_with_timeout(
                &definition.backend(),
                &desired_policy,
                &guarded_bindings,
                &host.load_balancing.keepalive,
                host.proxy_timeouts
                    .connect_timeout()
                    .unwrap_or(std::time::Duration::from_secs(10)),
            )
            .with_context(|| format!("vhost {} backend {}", host.id, definition.id))?;
            backend.id = format!("{}/{}", host.id, definition.id);
            compiled_members.push(Arc::new(backend));
        }
        let pool = if compiled_members.is_empty() {
            None
        } else {
            let mut pool = crate::balance::Pool::new(
                host.id.clone(),
                host.load_balancing.clone(),
                &host.backends,
                compiled_members,
            )?;
            if let Some(old) = previous.and_then(|s| s.pools.iter().find(|p| p.id == host.id)) {
                pool.reuse_observations(old);
            }
            Some(Arc::new(pool))
        };
        let metrics = previous
            .and_then(|s| s.vhost_metrics.get(&host.id))
            .cloned()
            .unwrap_or_else(|| Arc::new(crate::metrics::VhostMetrics::default()));
        vhost_metrics.insert(host.id.clone(), metrics.clone());
        let tls_policy = if let Some(policy) = &host.tls_policy {
            policy.validate_narrower_than(&effective_tls.policy)?;
            policy.clone()
        } else {
            effective_tls.policy.clone()
        };
        if host.http3_enabled
            && host_bindings.iter().any(|binding| binding.http3.is_some())
            && tls_policy != effective_tls.policy
        {
            anyhow::bail!(
                "vhost {} uses HTTP/3, so its TLS policy must match the global TLS policy; disable HTTP/3 to use a per-vhost TLS override",
                host.id
            );
        }
        let frontend_tls = tls
            .as_ref()
            .map(|base| crate::tls::variant(base, &tls_policy, true))
            .transpose()?;
        let frontend_tls_http1 = tls
            .as_ref()
            .map(|base| crate::tls::variant(base, &tls_policy, false))
            .transpose()?;
        let (profile_acl, profile_country_access) = match host.acl_profile_id.as_deref() {
            Some(id) => acl_profiles.get(id).cloned().ok_or_else(|| {
                anyhow::anyhow!("vhost {} references unknown ACL profile {}", host.id, id)
            })?,
            None => (None, crate::rate_limit::CountryAccess::default()),
        };
        let frontend = Arc::new(CompiledFrontend {
            metrics,
            websockets: host.websockets,
            websocket_legacy_support: host.websocket_legacy_support,
            websocket_rfc8441: host.websocket_rfc8441,
            websocket_rfc9220: host.websocket_rfc9220,
            force_ssl: host.force_ssl,
            forward_client_ip: host.forward_client_ip,
            https_redirect_port,
            http2_enabled: host.http2_enabled,
            http3_enabled: host.http3_enabled,
            tls_policy,
            tls: frontend_tls,
            tls_http1: frontend_tls_http1,
            cloudflare_client_ip: host.cloudflare_client_ip,
            timing_headers: host.timing_headers,
            backend_header: host.backend_header,
            backend_timing_header: host.backend_timing_header,
            rate_limit: host.rate_limit.clone(),
            basic_auth: host.basic_auth.compile()?,
            server_header: host
                .server_header
                .clone()
                .unwrap_or_else(|| config.server_header.clone()),
            diagnostic_headers: host
                .diagnostic_headers
                .clone()
                .unwrap_or_else(|| config.diagnostic_headers.clone()),
            tinyauth: host.tinyauth.compile(&desired_policy, &guarded_bindings)?,
            id: host.id.clone(),
            bindings: host_bindings,
            acl_profile_id: host.acl_profile_id.clone(),
            profile_acl,
            profile_country_access,
            acl: host.acl.as_ref().map(Acl::compile).transpose()?,
            headers: host.headers.compile()?,
            security: host.security_headers.compile()?,
            cache: host.cache.resolve(&config.cache)?,
            transform: host.transform.resolve(&config.transform)?,
            pages: host.pages.clone(),
            proxy_timeouts: host.proxy_timeouts.clone(),
        });
        if host.enabled {
            let (fallback_source, fallback_pool, fallback_backend) = match &host.source {
                crate::vhost::Source::ReverseProxy => {
                    let pool = pool.as_ref().ok_or_else(|| {
                        anyhow::anyhow!(
                            "vhost {} Reverse Proxy source has no backend pool",
                            host.id
                        )
                    })?;
                    (
                        CompiledSource::ReverseProxy,
                        Some(pool.clone()),
                        Some(pool.members[0].backend.clone()),
                    )
                }
                crate::vhost::Source::WebServer { web_service_id } => (
                    CompiledSource::WebServer(web_services[web_service_id].clone()),
                    None,
                    None,
                ),
            };
            let fallback = CompiledRoute {
                backend_id: None,
                bindings: frontend.bindings.clone(),
                frontend: Some(frontend.clone()),
                pool: fallback_pool,
                cache: None,
                id: format!("{}/main", host.id),
                path_prefix: "/".into(),
                match_type: crate::vhost::PathMatch::Prefix,
                path_regex: None,
                rewrite: crate::vhost::PathRewrite::default(),
                response: None,
                source: fallback_source,
                backend: fallback_backend,
                acl: None,
                headers: crate::headers::CompiledHeaders::default(),
            };
            for name in &host.frontend.hosts {
                fallbacks
                    .entry(name.clone())
                    .or_default()
                    .push(fallback.clone());
            }
        }
        let mut path_ids = HashSet::new();
        let mut path_bindings = HashSet::new();
        for route in &mut host.routes {
            ensure!(
                valid_id(&route.id) && path_ids.insert(route.id.clone()),
                "invalid/duplicate vhost path id"
            );
            let path_regex = match route.match_type {
                crate::vhost::PathMatch::Regex | crate::vhost::PathMatch::RegexInsensitive => {
                    ensure!(
                        !route.path_prefix.is_empty()
                            && route.path_prefix.len() <= 1024
                            && !route.path_prefix.chars().any(char::is_control),
                        "invalid vhost location regex"
                    );
                    let mut builder = regex::RegexBuilder::new(&route.path_prefix);
                    builder
                        .case_insensitive(
                            route.match_type == crate::vhost::PathMatch::RegexInsensitive,
                        )
                        .size_limit(2 * 1024 * 1024)
                        .dfa_size_limit(2 * 1024 * 1024);
                    Some(builder.build().context("invalid vhost location regex")?)
                }
                crate::vhost::PathMatch::Exact => {
                    ensure!(
                        !route.path_prefix.contains('?')
                            && !route.path_prefix.contains('#')
                            && !route.path_prefix.bytes().any(|b| b <= 32 || b == 127),
                        "invalid exact location path"
                    );
                    route.path_prefix = crate::acl::routing_path(&route.path_prefix)
                        .context("invalid exact location path")?;
                    None
                }
                crate::vhost::PathMatch::Prefix | crate::vhost::PathMatch::PrefixPriority => {
                    normalize_prefix(&mut route.path_prefix)?;
                    None
                }
            };
            ensure!(
                path_bindings.insert((route.match_type, route.path_prefix.clone())),
                "duplicate vhost location matcher"
            );
            validate_route_rewrite(route, path_regex.as_ref())?;
            validate_location_response(route.response.as_ref())?;
            let acl = route.acl.as_ref().map(Acl::compile).transpose()?;
            let headers = route.headers.compile()?;
            if route.source.is_reverse_proxy() {
                if let Some(id) = &route.backend_id {
                    ensure!(
                        host.backends.iter().any(|b| &b.id == id),
                        "vhost path references unknown backend {}",
                        id
                    );
                }
            }
            if host.enabled && route.enabled {
                let (source, route_pool, backend) = if route.response.is_some() {
                    // Local return is handled before source dispatch and needs no origin.
                    (CompiledSource::ReverseProxy, None, None)
                } else {
                    match &route.source {
                        crate::vhost::Source::ReverseProxy => {
                            let pool = pool.as_ref().ok_or_else(|| {
                                anyhow::anyhow!(
                                    "vhost {} location {} Reverse Proxy source has no backend pool",
                                    host.id,
                                    route.id
                                )
                            })?;
                            let backend = if let Some(id) = route.backend_id.as_deref() {
                                pool.members
                                    .iter()
                                    .find(|member| member.definition.id == id)
                                    .map(|member| member.backend.clone())
                                    .ok_or_else(|| anyhow::anyhow!("unknown backend {id}"))?
                            } else {
                                pool.members[0].backend.clone()
                            };
                            (
                                CompiledSource::ReverseProxy,
                                Some(pool.clone()),
                                Some(backend),
                            )
                        }
                        crate::vhost::Source::WebServer { web_service_id } => (
                            CompiledSource::WebServer(web_services[web_service_id].clone()),
                            None,
                            None,
                        ),
                    }
                };
                let compiled = CompiledRoute {
                    backend_id: route.backend_id.clone(),
                    bindings: frontend.bindings.clone(),
                    frontend: Some(frontend.clone()),
                    pool: route_pool,
                    cache: route.cache,
                    id: format!("{}/{}", host.id, route.id),
                    path_prefix: route.path_prefix.clone(),
                    match_type: route.match_type,
                    path_regex,
                    rewrite: route.rewrite.clone(),
                    response: route.response.clone(),
                    source,
                    backend,
                    acl,
                    headers,
                };
                for name in &host.frontend.hosts {
                    routes
                        .entry(name.clone())
                        .or_default()
                        .push(compiled.clone());
                }
            }
        }
        if host.enabled {
            for name in &host.frontend.hosts {
                frontends
                    .entry(name.clone())
                    .or_default()
                    .push(frontend.clone());
            }
            if let Some(pool) = pool {
                pools.push(pool);
            }
        }
    }
    let quic_tls = tls
        .as_ref()
        .map(|tls| crate::http3::crypto(tls, &effective_tls.policy))
        .transpose()?;
    ensure!(
        !listeners.iter().any(|l| l.http3.is_some()) || quic_tls.is_some(),
        "HTTP/3 requires available TLS certificates"
    );
    ensure!(
        !listeners.iter().any(|l| l.http3.is_some()) || effective_tls.policy.allows_http3(),
        "HTTP/3 listeners require TLS 1.3 and a TLS 1.3 cipher suite in the global TLS policy"
    );
    Ok(Snapshot {
        vhost_metrics,
        forwarding,
        quic_tls,
        listeners,
        pools,
        tls,
        tls_http1,
        frontends,
        envelope: Envelope { revision, config },
        routes,
        fallbacks,
        redirects,
        not_found_hosts,
        host_acls,
        headers: global_headers,
    })
}
fn normalize_prefix(prefix: &mut String) -> Result<()> {
    ensure!(
        prefix.starts_with('/')
            && prefix.len() <= 512
            && !prefix.contains('?')
            && !prefix.contains('#')
            && !prefix.bytes().any(|b| b <= 32 || b == 127),
        "invalid path prefix"
    );
    if prefix.len() > 1 {
        *prefix = prefix.trim_end_matches('/').to_owned();
        ensure!(!prefix.is_empty(), "invalid path prefix");
    }
    *prefix = crate::acl::routing_path(prefix)?;
    Ok(())
}

fn validate_route_rewrite(
    route: &crate::vhost::PathRoute,
    regex: Option<&regex::Regex>,
) -> Result<()> {
    use crate::vhost::{PathMatch, RewriteMode};
    ensure!(
        route.rewrite.value.len() <= 2048,
        "location rewrite value is too long"
    );
    ensure!(
        !route.rewrite.value.chars().any(char::is_control),
        "location rewrite contains a control character"
    );
    match route.rewrite.mode {
        RewriteMode::Preserve => ensure!(
            route.rewrite.value.is_empty(),
            "preserve rewrite has no value"
        ),
        RewriteMode::StripPrefix => ensure!(
            matches!(
                route.match_type,
                PathMatch::Prefix | PathMatch::PrefixPriority | PathMatch::Exact
            ),
            "strip-prefix rewrite requires a prefix/exact location"
        ),
        RewriteMode::ReplacePrefix => {
            ensure!(
                matches!(
                    route.match_type,
                    PathMatch::Prefix | PathMatch::PrefixPriority | PathMatch::Exact
                ),
                "replace-prefix rewrite requires a prefix/exact location"
            );
            let mut replacement = route.rewrite.value.clone();
            normalize_prefix(&mut replacement).context("invalid location replacement prefix")?;
        }
        RewriteMode::Regex => ensure!(regex.is_some(), "regex rewrite requires a regex location"),
    }
    Ok(())
}

fn validate_location_response(response: Option<&crate::vhost::LocationResponse>) -> Result<()> {
    let Some(response) = response else {
        return Ok(());
    };
    ensure!(
        (200..=599).contains(&response.status),
        "location response status must be 200..599"
    );
    ensure!(
        response.body.len() <= 65_536,
        "location response body is too large"
    );
    ensure!(
        !response.content_type.is_empty()
            && response.content_type.len() <= 256
            && http::HeaderValue::from_str(&response.content_type).is_ok(),
        "invalid location response content type"
    );
    Ok(())
}
pub fn demo_config(addr: SocketAddr) -> Config {
    let mut host: crate::vhost::Vhost = serde_json::from_value(serde_json::json!({
        "id":"demo", "frontend":{"hosts":["localhost","127.0.0.1","demo.localhost"],
            "listener_ids":["http"]},
        "backends":[{"id":"demo", "url":format!("http://{addr}"), "allow_private":true}],
        "load_balancing":{"health_check":{"mode":"off"}}, "routes":[{"id":"root"}]
    }))
    .expect("static vhost demo");
    host.load_balancing.health_check.mode = crate::balance::HealthMode::Off;
    Config {
        listeners: crate::settings::Listeners::from_startup(
            "127.0.0.1:8080".parse().expect("static demo listener"),
            None,
        ),
        vhosts: vec![host],
        ..Config::default()
    }
}
#[cfg(test)]
mod tests {
    use super::*;
    fn policy() -> ValidationPolicy {
        ValidationPolicy {
            tls_addr: None,
            cert_dir: None,
            data_dir: None,
            proxy_addr: "127.0.0.1:8080".parse().unwrap(),
            admin_addr: "127.0.0.1:9090".parse().unwrap(),
        }
    }
    #[test]
    fn missing_http2_settings_use_release_defaults() {
        let config: Config = serde_json::from_value(serde_json::json!({})).unwrap();
        assert_eq!(config.http2, crate::settings::Http2Connections::default());
        config.http2.validate().unwrap();
    }

    #[test]
    fn normalized_unicode_prefix_survives_serialization_and_recompile() {
        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
        config.vhosts[0].routes[0].path_prefix = "/caf%C3%A9".into();
        let first = compile(config, 0, &policy()).unwrap();
        let saved = serde_json::to_string(&first.envelope.config).unwrap();
        let second = compile(serde_json::from_str(&saved).unwrap(), 1, &policy()).unwrap();
        assert!(second.select("localhost", "/caf\u{e9}/hello").is_some());
    }
    #[test]
    fn web_server_main_source_needs_no_backend_pool() {
        let tmp = tempfile::TempDir::new().unwrap();
        std::fs::write(tmp.path().join("index.html"), b"hello").unwrap();
        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
        config.web_services.push(crate::web_server::Service {
            id: "site".into(),
            name: "Site".into(),
            document_root: tmp.path().to_path_buf(),
            index: vec!["index.html".into()],
            directory_listing: false,
            ..Default::default()
        });
        config.vhosts[0].source = crate::vhost::Source::WebServer {
            web_service_id: "site".into(),
        };
        config.vhosts[0].backends.clear();
        config.vhosts[0].routes.clear();
        let snapshot = compile(config, 1, &policy()).unwrap();
        let route = snapshot.select("localhost", "/").unwrap();
        assert!(matches!(&route.source, CompiledSource::WebServer(_)));
        assert!(route.pool.is_none());
        assert!(route.backend.is_none());
        assert!(snapshot.pools.is_empty());
    }

    #[test]
    fn web_server_and_reverse_proxy_can_share_one_vhost() {
        let tmp = tempfile::TempDir::new().unwrap();
        std::fs::write(tmp.path().join("index.html"), b"hello").unwrap();
        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
        config.web_services.push(crate::web_server::Service {
            id: "site".into(),
            name: "Site".into(),
            document_root: tmp.path().to_path_buf(),
            index: vec!["index.html".into()],
            directory_listing: false,
            ..Default::default()
        });
        let host = &mut config.vhosts[0];
        host.source = crate::vhost::Source::WebServer {
            web_service_id: "site".into(),
        };
        host.routes = vec![crate::vhost::PathRoute {
            id: "api".into(),
            path_prefix: "/api".into(),
            source: crate::vhost::Source::ReverseProxy,
            ..Default::default()
        }];
        let snapshot = compile(config, 1, &policy()).unwrap();
        let root = snapshot.select("localhost", "/").unwrap();
        let api = snapshot.select("localhost", "/api/test").unwrap();
        assert!(matches!(&root.source, CompiledSource::WebServer(_)));
        assert!(matches!(&api.source, CompiledSource::ReverseProxy));
        assert!(api.pool.is_some());
        assert!(api.backend.is_some());
    }

    #[test]
    fn one_web_service_can_be_reused_by_multiple_vhosts() {
        let tmp = tempfile::TempDir::new().unwrap();
        std::fs::write(tmp.path().join("index.html"), b"shared").unwrap();
        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
        config.web_services.push(crate::web_server::Service {
            id: "shared-site".into(),
            name: "Shared site".into(),
            document_root: tmp.path().to_path_buf(),
            index: vec!["index.html".into()],
            directory_listing: false,
            ..Default::default()
        });
        let first = &mut config.vhosts[0];
        first.source = crate::vhost::Source::WebServer {
            web_service_id: "shared-site".into(),
        };
        first.backends.clear();
        first.routes.clear();

        let mut second = first.clone();
        second.id = "shared-second".into();
        second.frontend.hosts = vec!["second.localhost".into()];
        config.vhosts.push(second);

        let snapshot = compile(config, 1, &policy()).unwrap();
        let first_route = snapshot.select("localhost", "/").unwrap();
        let second_route = snapshot.select("second.localhost", "/").unwrap();
        assert!(
            matches!(&first_route.source, CompiledSource::WebServer(service) if service.id == "shared-site")
        );
        assert!(
            matches!(&second_route.source, CompiledSource::WebServer(service) if service.id == "shared-site")
        );
    }

    #[test]
    fn unknown_web_service_reference_is_rejected() {
        let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
        config.vhosts[0].source = crate::vhost::Source::WebServer {
            web_service_id: "missing".into(),
        };
        let error = compile(config, 1, &policy()).unwrap_err().to_string();
        assert!(error.contains("unknown Web Service"), "{error}");
    }

    #[test]
    fn missing_source_fields_remain_reverse_proxy_for_old_configs() {
        let source: crate::vhost::Source =
            serde_json::from_value(serde_json::json!({"type":"reverse_proxy"})).unwrap();
        assert_eq!(source, crate::vhost::Source::ReverseProxy);
        let route: crate::vhost::PathRoute =
            serde_json::from_value(serde_json::json!({"id":"legacy"})).unwrap();
        assert_eq!(route.source, crate::vhost::Source::ReverseProxy);
    }

    #[test]
    fn host_normalization() {
        assert_eq!(request_host("EXAMPLE.com.:8080").unwrap(), "example.com");
        for invalid in [
            "",
            "a..b",
            "*.test",
            "a/b",
            "user@host",
            "-bad.test",
            "a:99999",
        ] {
            assert!(request_host(invalid).is_err(), "{invalid}");
        }
    }
    #[test]
    fn wildcard_host_patterns_are_normalized_and_exact_hosts_win() {
        assert_eq!(
            normalize_host_pattern("*.Example.TEST.").unwrap(),
            "*.example.test"
        );
        for invalid in ["*", "foo.*.test", "*.com", "*.*.example.test"] {
            assert!(normalize_host_pattern(invalid).is_err(), "{invalid}");
        }

        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].id = "wildcard".into();
        c.vhosts[0].frontend.hosts = vec!["*.example.test".into()];
        let mut exact = c.vhosts[0].clone();
        exact.id = "exact".into();
        exact.frontend.hosts = vec!["api.example.test".into()];
        c.vhosts.push(exact);
        let snapshot = compile(c, 1, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        assert_eq!(
            snapshot
                .select_on("api.example.test", "/", local, false)
                .unwrap()
                .id,
            "exact/main"
        );
        assert_eq!(
            snapshot
                .select_on("www.example.test", "/", local, false)
                .unwrap()
                .id,
            "wildcard/main"
        );
    }
    #[test]
    fn reusable_acl_profile_reference_is_compiled_and_unknown_reference_fails() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.acl_profiles = serde_json::from_value(serde_json::json!([{
            "id":"office", "name":"Office",
            "acl":{"default":"deny","rules":[{"network":"10.0.0.0/8","action":"allow"}]},
            "country_access":{"mode":"block","countries":["RU"]}
        }]))
        .unwrap();
        c.vhosts[0].acl_profile_id = Some("office".into());
        let snapshot = compile(c.clone(), 1, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        let frontend = snapshot.frontend("localhost", local, false).unwrap();
        assert_eq!(frontend.acl_profile_id.as_deref(), Some("office"));
        assert!(frontend
            .profile_acl
            .as_ref()
            .unwrap()
            .allows("10.2.3.4".parse().unwrap()));
        assert!(!frontend
            .profile_acl
            .as_ref()
            .unwrap()
            .allows("192.0.2.1".parse().unwrap()));
        assert!(!frontend.profile_country_access.allows(Some("RU")));

        c.vhosts[0].acl_profile_id = Some("missing".into());
        assert!(compile(c, 2, &policy()).is_err());
    }

    #[test]
    fn rfc8441_is_advertised_only_on_opted_in_h2_capable_listener() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].websockets = true;
        c.vhosts[0].websocket_rfc8441 = true;
        let error = compile(c.clone(), 1, &policy()).unwrap_err().to_string();
        assert!(error.contains("HTTP/2-capable listener"), "{error}");

        c.listeners.endpoints[0].binding.h2c = true;
        let snapshot = compile(c.clone(), 2, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        assert!(snapshot.websocket_rfc8441_on(local, false));
        assert!(!snapshot.websocket_rfc8441_on(local, true));

        c.vhosts[0].websocket_rfc8441 = false;
        let snapshot = compile(c, 3, &policy()).unwrap();
        assert!(!snapshot.websocket_rfc8441_on(local, false));
    }
    #[test]
    fn force_ssl_requires_plain_http_and_chooses_https_target() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].force_ssl = true;
        let error = compile(c.clone(), 1, &policy()).unwrap_err().to_string();
        assert!(
            error.contains("at least one selected TLS listener"),
            "{error}"
        );

        c.listeners.endpoints.push(crate::settings::NamedListener {
            id: "https-a".into(),
            name: "HTTPS A".into(),
            scope: crate::settings::ListenerScope::Internal,
            enabled: true,
            binding: crate::vhost::Listener {
                address: "127.0.0.1:8443".parse().unwrap(),
                tls: true,
                http2: true,
                http2_settings: Some(crate::settings::Http2Connections::default()),
                h2c: false,
                http3: None,
            },
            additional_addresses: vec![],
        });
        c.listeners.endpoints.push(crate::settings::NamedListener {
            id: "https-b".into(),
            name: "HTTPS B".into(),
            scope: crate::settings::ListenerScope::Internal,
            enabled: true,
            binding: crate::vhost::Listener {
                address: "127.0.0.1:9443".parse().unwrap(),
                tls: true,
                http2: true,
                http2_settings: Some(crate::settings::Http2Connections::default()),
                h2c: false,
                http3: None,
            },
            additional_addresses: vec![],
        });
        c.vhosts[0].frontend.listener_ids = vec!["http".into(), "https-a".into(), "https-b".into()];
        let error = compile(c.clone(), 2, &policy()).unwrap_err().to_string();
        assert!(error.contains("cannot choose an HTTPS target"), "{error}");

        c.listeners
            .endpoints
            .iter_mut()
            .find(|item| item.id == "https-b")
            .unwrap()
            .binding
            .address = "127.0.0.1:443".parse().unwrap();
        let snapshot = compile(c.clone(), 3, &policy()).unwrap();
        let frontend = snapshot
            .frontend("localhost", "127.0.0.1:8080".parse().unwrap(), false)
            .unwrap();
        assert_eq!(frontend.https_redirect_port, Some(443));

        c.vhosts[0].frontend.listener_ids = vec!["https-a".into(), "https-b".into()];
        let error = compile(c, 4, &policy()).unwrap_err().to_string();
        assert!(error.contains("plain HTTP listener"), "{error}");
    }
    #[test]
    fn backend_tls_server_name_keeps_network_origin_and_changes_verified_request_name() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
        c.vhosts[0].backends[0].allow_private = true;
        c.vhosts[0].backends[0].tls_server_name = Some("Backend.Unitra.Internal.".into());
        let s = compile(c, 1, &policy()).unwrap();
        let backend = &s.pools[0].members[0].backend;
        assert_eq!(backend.origin, "https://10.87.20.2:443");
        assert_eq!(
            backend.request_origin,
            "https://backend.unitra.internal:443"
        );
    }
    #[test]
    fn tls_server_name_is_https_dns_only() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].backends[0].tls_server_name = Some("backend.internal".into());
        assert!(compile(c.clone(), 1, &policy()).is_err());
        c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
        c.vhosts[0].backends[0].tls_server_name = Some("10.87.20.2".into());
        assert!(compile(c, 1, &policy()).is_err());
    }
    #[test]
    fn backend_tls_verification_defaults_off_and_can_be_enabled_explicitly() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        assert!(!c.vhosts[0].backends[0].tls_verify);
        assert!(compile(c.clone(), 1, &policy()).is_ok());

        c.vhosts[0].backends[0].url = "https://10.87.20.2:443".into();
        c.vhosts[0].backends[0].allow_private = true;
        c.vhosts[0].backends[0].tls_ca_pem = Some("not a certificate".into());
        assert!(compile(c.clone(), 1, &policy()).is_ok());

        c.vhosts[0].backends[0].tls_verify = true;
        assert!(compile(c, 1, &policy()).is_err());
    }
    #[test]
    fn redirect_hosts_share_listener_routing_without_opening_vhost_routes() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.redirects = serde_json::from_value(serde_json::json!([{
            "id":"legacy","name":"Legacy","frontend":{"hosts":["old.localhost"],"listener_ids":["http"]},
            "rules":[{"id":"root","target":"https://new.localhost/","status_code":308}]
        }])).unwrap();
        let snapshot = compile(c, 1, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        let (_host, rule) = snapshot
            .redirect_on("old.localhost", "/a", local, false)
            .unwrap();
        assert_eq!(rule.id, "root");
        assert!(snapshot
            .select_on("old.localhost", "/a", local, false)
            .is_none());
    }

    #[test]
    fn custom_locations_override_but_main_vhost_remains_fallback() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        // The demo document still contains the pre-0.16 synthetic root route.
        // Validation must normalize it away and keep the main backend internally.
        let mut custom = c.vhosts[0].routes[0].clone();
        custom.id = "test".into();
        custom.path_prefix = "/test".into();
        custom.response = Some(crate::vhost::LocationResponse {
            status: 200,
            content_type: "text/plain".into(),
            body: "ok".into(),
        });
        c.vhosts[0].routes.push(custom);
        let snapshot = compile(c, 1, &policy()).unwrap();

        assert_eq!(
            snapshot.select("localhost", "/test").unwrap().id,
            "demo/test"
        );
        assert_eq!(
            snapshot.select("localhost", "/test/a").unwrap().id,
            "demo/test"
        );
        assert_eq!(snapshot.select("localhost", "/").unwrap().id, "demo/main");
        assert_eq!(
            snapshot.select("localhost", "/abc").unwrap().id,
            "demo/main"
        );
        assert_eq!(
            snapshot.select("localhost", "/static/a.js").unwrap().id,
            "demo/main"
        );
        assert!(snapshot.envelope.config.vhosts[0]
            .routes
            .iter()
            .all(|route| !route.is_legacy_main_fallback()));
    }

    #[test]
    fn deliberate_root_custom_location_can_override_main_fallback() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        let root = &mut c.vhosts[0].routes[0];
        root.response = Some(crate::vhost::LocationResponse {
            status: 204,
            content_type: "text/plain".into(),
            body: String::new(),
        });
        let snapshot = compile(c, 1, &policy()).unwrap();
        assert_eq!(
            snapshot.select("localhost", "/anything").unwrap().id,
            "demo/root"
        );
    }

    #[test]
    fn direct_admin_listener_backend_is_marked_for_guarded_control_plane_use() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.administration.listen = Some("0.0.0.0:9090".parse().unwrap());
        c.administration.tls = true;
        c.vhosts[0].backends[0].url = "https://127.0.0.1:9090".into();
        c.vhosts[0].backends[0].allow_private = true;
        c.vhosts[0].backends[0].accept_local_listener_risk = true;
        let snapshot = compile(c, 1, &policy()).unwrap();
        assert!(snapshot.pools[0].members[0].backend.targets_admin_listener);
    }

    #[test]
    fn backend_diagnostic_flags_compile_to_frontend() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].backend_header = true;
        c.vhosts[0].backend_timing_header = true;
        let snapshot = compile(c, 1, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        let frontend = snapshot.frontend("localhost", local, false).unwrap();
        assert!(frontend.backend_header);
        assert!(frontend.backend_timing_header);
    }

    #[test]
    fn path_boundaries() {
        assert!(prefix_matches("/api", "/api"));
        assert!(prefix_matches("/api", "/api/users"));
        assert!(!prefix_matches("/api", "/apix"));
        assert!(prefix_matches("/", "/anything"));
    }
    #[test]
    fn private_requires_opt_in_and_metadata_always_denied() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        assert!(compile(c.clone(), 1, &policy()).is_ok());
        c.vhosts[0].backends[0].allow_private = false;
        assert!(compile(c.clone(), 1, &policy()).is_err());
        c.vhosts[0].backends[0].allow_private = true;
        for target in [
            "http://169.254.169.254",
            "http://100.100.100.200",
            "http://0.0.0.0",
            "http://127.0.0.1:9090",
            "http://[::ffff:169.254.169.254]",
            "http://[fe80::1]",
            "http://user:pass@127.0.0.1:9000",
        ] {
            c.vhosts[0].backends[0].url = target.into();
            assert!(compile(c.clone(), 1, &policy()).is_err(), "{target}");
        }
        c.vhosts[0].backends[0].url = "http://127.0.0.1:9090".into();
        c.vhosts[0].backends[0].accept_local_listener_risk = true;
        assert!(compile(c.clone(), 1, &policy()).is_ok());
        c.vhosts[0].backends[0].allow_private = false;
        assert!(compile(c, 1, &policy()).is_err());
    }
    #[test]
    fn longest_prefix_and_aliases() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        let mut specific = c.vhosts[0].routes[0].clone();
        specific.id = "api".into();
        specific.path_prefix = "/api".into();
        c.vhosts[0].routes.push(specific);
        let s = compile(c, 7, &policy()).unwrap();
        assert_eq!(s.select("localhost", "/api/x").unwrap().id, "demo/api");
        assert_eq!(s.select("demo.localhost", "/apix").unwrap().id, "demo/main");
        assert!(s.select("unknown", "/").is_none());
        assert_eq!(s.envelope.revision, 7);
    }
    #[test]
    fn nginx_style_location_precedence_exact_priority_regex_prefix() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].routes[0].id = "root".into();

        let mut prefix = c.vhosts[0].routes[0].clone();
        prefix.id = "api-prefix".into();
        prefix.path_prefix = "/api".into();

        let mut regex = c.vhosts[0].routes[0].clone();
        regex.id = "api-regex".into();
        regex.match_type = crate::vhost::PathMatch::Regex;
        regex.path_prefix = r"^/api/v[0-9]+/".into();

        let mut exact = c.vhosts[0].routes[0].clone();
        exact.id = "api-exact".into();
        exact.match_type = crate::vhost::PathMatch::Exact;
        exact.path_prefix = "/api/v1/fixed".into();

        let mut trailing_exact = c.vhosts[0].routes[0].clone();
        trailing_exact.id = "trailing-exact".into();
        trailing_exact.match_type = crate::vhost::PathMatch::Exact;
        trailing_exact.path_prefix = "/trailing/".into();

        c.vhosts[0]
            .routes
            .extend([prefix.clone(), regex, exact, trailing_exact]);
        let snapshot = compile(c.clone(), 1, &policy()).unwrap();
        assert_eq!(
            snapshot.select("localhost", "/api/v1/fixed").unwrap().id,
            "demo/api-exact"
        );
        assert_eq!(
            snapshot.select("localhost", "/api/v2/users").unwrap().id,
            "demo/api-regex"
        );
        assert_eq!(
            snapshot.select("localhost", "/api/plain").unwrap().id,
            "demo/api-prefix"
        );
        assert_eq!(
            snapshot.select("localhost", "/trailing/").unwrap().id,
            "demo/trailing-exact"
        );
        assert_eq!(
            snapshot.select("localhost", "/trailing").unwrap().id,
            "demo/main"
        );

        c.vhosts[0].routes.retain(|route| route.id != "api-prefix");
        prefix.match_type = crate::vhost::PathMatch::PrefixPriority;
        prefix.id = "api-priority".into();
        c.vhosts[0].routes.push(prefix);
        let snapshot = compile(c, 2, &policy()).unwrap();
        assert_eq!(
            snapshot.select("localhost", "/api/v2/users").unwrap().id,
            "demo/api-priority"
        );
    }
    #[test]
    fn location_rewrites_are_normalized_and_regex_captures_expand() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        let route = &mut c.vhosts[0].routes[0];
        route.match_type = crate::vhost::PathMatch::Regex;
        route.path_prefix = r"^/api/v([0-9]+)(/.*)$".into();
        route.rewrite = crate::vhost::PathRewrite {
            mode: crate::vhost::RewriteMode::Regex,
            value: "/service/${1}${2}".into(),
        };
        let snapshot = compile(c, 1, &policy()).unwrap();
        let selected = snapshot.select("localhost", "/api/v42/items").unwrap();
        assert_eq!(
            selected
                .rewritten_path("/api/v42/items")
                .unwrap()
                .as_deref(),
            Some("/service/42/items")
        );
        assert_eq!(
            selected
                .rewritten_path("/api/v42/Ubuntu 14.04 LTS")
                .unwrap()
                .as_deref(),
            Some("/service/42/Ubuntu 14.04 LTS")
        );
    }
    #[test]
    fn custom_location_response_is_validated() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].routes[0].response = Some(crate::vhost::LocationResponse {
            status: 200,
            content_type: "application/json".into(),
            body: r#"{"ok":true}"#.into(),
        });
        assert!(compile(c.clone(), 1, &policy()).is_ok());
        c.vhosts[0].routes[0].response.as_mut().unwrap().status = 199;
        assert!(compile(c.clone(), 1, &policy()).is_err());
        c.vhosts[0].routes[0].response.as_mut().unwrap().status = 200;
        c.vhosts[0].routes[0]
            .response
            .as_mut()
            .unwrap()
            .content_type = "text/plain\r\nx-bad: 1".into();
        assert!(compile(c, 1, &policy()).is_err());
    }
    #[test]
    fn local_response_hosts_reserve_frontends_and_do_not_require_backends() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.not_found_hosts = serde_json::from_value(serde_json::json!([{
            "id":"missing",
            "name":"Missing site",
            "frontend":{"hosts":["missing.localhost"],"listener_ids":["http"]},
            "page":{"kind":"html","status":404,"html":"<h1>Not found</h1>"}
        }]))
        .unwrap();
        let snapshot = compile(c.clone(), 1, &policy()).unwrap();
        let local: SocketAddr = "127.0.0.1:8080".parse().unwrap();
        let host = snapshot
            .not_found_host_on("missing.localhost", local, false)
            .unwrap();
        assert_eq!(host.id, "missing");
        assert_eq!(host.page.status, Some(404));

        c.not_found_hosts[0].frontend.hosts = vec!["localhost".into()];
        assert!(compile(c, 2, &policy()).is_err());
    }

    #[test]
    fn conflicts_are_rejected() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        let mut duplicate = c.vhosts[0].routes[0].clone();
        duplicate.id = "other".into();
        c.vhosts[0].routes.push(duplicate);
        assert!(compile(c, 0, &policy()).is_err());
    }
    #[test]
    fn tls12_only_vhost_override_is_valid_without_http3_listener() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.vhosts[0].tls_policy = Some(crate::tls::ProtocolPolicy {
            tls12: true,
            tls13: false,
            cipher_suites: vec![],
        });
        assert!(compile(c, 1, &policy()).is_ok());
    }

    #[test]
    fn persisted_remote_administration_requires_tls() {
        let mut c = demo_config("127.0.0.1:9000".parse().unwrap());
        c.administration.listen = Some("192.0.2.10:9090".parse().unwrap());
        assert!(compile(c.clone(), 1, &policy()).is_err());
        c.administration.tls = true;
        assert!(compile(c, 1, &policy()).is_ok());
    }
    #[test]
    fn legacy_startup_remote_administration_is_left_to_cli_risk_gate() {
        let mut p = policy();
        p.admin_addr = "0.0.0.0:9090".parse().unwrap();
        let c = demo_config("127.0.0.1:9000".parse().unwrap());
        assert!(c.administration.listen.is_none());
        assert!(compile(c, 1, &p).is_ok());
    }
}