async fn fastcgi_fixture(response_body: &'static [u8]) -> std::net::SocketAddr {
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let address = listener.local_addr().unwrap();
    tokio::spawn(async move {
        let (mut stream, _) = listener.accept().await.unwrap();
        let deadline = Instant::now() + Duration::from_secs(5);
        loop {
            let (kind, content) = read_fcgi_record(&mut stream, deadline).await.unwrap();
            if kind == FCGI_STDIN && content.is_empty() {
                break;
            }
        }
        let mut stdout = b"Status: 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nX-PHP-FPM: fixture\r\n\r\n".to_vec();
        stdout.extend_from_slice(response_body);
        write_fcgi_record(&mut stream, FCGI_STDOUT, &stdout).await.unwrap();
        write_fcgi_record(&mut stream, FCGI_STDOUT, &[]).await.unwrap();
        write_fcgi_record(&mut stream, FCGI_END_REQUEST, &[0u8; 8]).await.unwrap();
        stream.flush().await.unwrap();
    });
    address
}

#[tokio::test]
async fn php_fpm_executes_index_and_try_files_front_controller_without_source_disclosure() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"<?php echo 'SOURCE';").unwrap();
    let address = fastcgi_fixture(b"PHP-OK").await;
    let mut configured = Service {
        id: "php".into(),
        name: "PHP".into(),
        document_root: tmp.path().to_path_buf(),
        index: vec!["index.php".into()],
        try_files: vec!["$uri".into(), "/index.php?$query_string".into()],
        php: Php {
            enabled: true,
            endpoint: format!("tcp:{address}"),
            connect_timeout_ms: 500,
            request_timeout_ms: 5_000,
            max_concurrent_requests: 4,
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_body_request(
        &service,
        &request(Method::POST, "/missing?name=test"),
        "/missing",
        Body::from("payload"),
    )
    .await;
    assert_eq!(response.status(), StatusCode::OK);
    assert_eq!(response.headers()["x-php-fpm"], "fixture");
    let body = response.into_body().collect().await.unwrap().to_bytes();
    assert_eq!(body, "PHP-OK");
    assert!(!std::str::from_utf8(&body).unwrap().contains("SOURCE"));
}

#[tokio::test]
async fn php_fpm_executes_configured_directory_index() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"<?php echo 'INDEX-SOURCE';").unwrap();
    let address = fastcgi_fixture(b"PHP-INDEX").await;
    let mut configured = Service {
        id: "php-index".into(),
        name: "PHP index".into(),
        document_root: tmp.path().to_path_buf(),
        index: vec!["index.php".into()],
        php: Php {
            enabled: true,
            endpoint: format!("tcp:{address}"),
            connect_timeout_ms: 500,
            request_timeout_ms: 5_000,
            max_concurrent_requests: 4,
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
    assert_eq!(response.status(), StatusCode::OK);
    let body = response.into_body().collect().await.unwrap().to_bytes();
    assert_eq!(body, "PHP-INDEX");
    assert!(!String::from_utf8_lossy(&body).contains("INDEX-SOURCE"));
}

#[tokio::test]
async fn php_request_body_limit_returns_413_before_fastcgi_connect() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"<?php echo 'secret';").unwrap();
    let mut configured = Service {
        id: "php-body-limit".into(),
        name: "PHP body limit".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php {
            enabled: true,
            endpoint: "tcp:127.0.0.1:9".into(),
            max_request_body_bytes: 5,
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let mut req = request(Method::POST, "/index.php");
    req.headers_mut().insert(CONTENT_LENGTH, HeaderValue::from_static("10"));
    let response = serve_body_request(&service, &req, "/index.php", Body::from("0123456789")).await;
    assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
}

#[tokio::test]
async fn php_fpm_failure_returns_gateway_error_instead_of_php_source() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"SECRET-PHP-SOURCE").unwrap();
    let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
    let address = listener.local_addr().unwrap();
    drop(listener);
    let mut configured = Service {
        id: "php-fail".into(),
        name: "PHP fail".into(),
        document_root: tmp.path().to_path_buf(),
        php: Php {
            enabled: true,
            endpoint: format!("tcp:{address}"),
            connect_timeout_ms: 100,
            request_timeout_ms: 500,
            max_concurrent_requests: 1,
            ..Default::default()
        },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_request(
        &service,
        &request(Method::GET, "/index.php"),
        "/index.php",
    )
    .await;
    assert!(matches!(response.status(), StatusCode::BAD_GATEWAY | StatusCode::GATEWAY_TIMEOUT));
    let body = response.into_body().collect().await.unwrap().to_bytes();
    assert!(!String::from_utf8_lossy(&body).contains("SECRET-PHP-SOURCE"));
}

#[cfg(target_os = "linux")]
#[tokio::test]
async fn inside_root_symlink_policy_allows_only_targets_beneath_root() {
    use std::os::unix::fs::symlink;
    let tmp = TempDir::new().unwrap();
    let outside = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("inside.txt"), b"inside").unwrap();
    std::fs::write(outside.path().join("outside.txt"), b"outside").unwrap();
    symlink(tmp.path().join("inside.txt"), tmp.path().join("inside-link.txt")).unwrap();
    symlink(outside.path().join("outside.txt"), tmp.path().join("outside-link.txt")).unwrap();
    let mut configured = Service {
        id: "links".into(),
        name: "Links".into(),
        document_root: tmp.path().to_path_buf(),
        symlink_policy: SymlinkPolicy::InsideRoot,
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();

    let inside = serve_request(
        &service,
        &request(Method::GET, "/inside-link.txt"),
        "/inside-link.txt",
    )
    .await;
    assert_eq!(inside.status(), StatusCode::OK);
    assert_eq!(inside.into_body().collect().await.unwrap().to_bytes(), "inside");

    let outside = serve_request(
        &service,
        &request(Method::GET, "/outside-link.txt"),
        "/outside-link.txt",
    )
    .await;
    assert_eq!(outside.status(), StatusCode::FORBIDDEN);
}

#[tokio::test]
async fn empty_index_can_go_directly_to_directory_listing() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("file.txt"), b"x").unwrap();
    let mut configured = Service {
        id: "listing-only".into(),
        name: "Listing only".into(),
        document_root: tmp.path().to_path_buf(),
        index: Vec::new(),
        directory_listing: true,
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
    assert_eq!(response.status(), StatusCode::OK);
    let body = response.into_body().collect().await.unwrap().to_bytes();
    let body = std::str::from_utf8(&body).unwrap();
    assert!(body.contains("file.txt"));
    assert!(body.contains("DIRECTORY LISTING"));
    assert!(body.contains("RustProxy <b>0.27.3</b>"));
}

#[tokio::test]
async fn traversal_and_symlink_escape_are_not_served() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("ok.txt"), b"ok").unwrap();
    let service = service(tmp.path(), false);
    assert_eq!(
        serve_request(&service, &request(Method::GET, "/../secret"), "/../secret")
            .await
            .status(),
        StatusCode::BAD_REQUEST
    );

    #[cfg(unix)]
    {
        use std::os::unix::fs::symlink;
        let outside = TempDir::new().unwrap();
        std::fs::write(outside.path().join("secret.txt"), b"secret").unwrap();
        symlink(outside.path().join("secret.txt"), tmp.path().join("escape.txt")).unwrap();
        let response = serve_request(
            &service,
            &request(Method::GET, "/escape.txt"),
            "/escape.txt",
        )
        .await;
        assert_ne!(response.status(), StatusCode::OK);
    }
}
#[tokio::test]
async fn htaccess_wordpress_style_front_controller_and_protected_files_work() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.html"), b"front-controller").unwrap();
    std::fs::write(tmp.path().join("existing.txt"), b"existing").unwrap();
    std::fs::write(
        tmp.path().join(".htaccess"),
        br#"<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.html [L]
</IfModule>
"#,
    )
    .unwrap();
    let mut configured = Service {
        id: "htaccess-rewrite".into(),
        name: "htaccess rewrite".into(),
        document_root: tmp.path().to_path_buf(),
        htaccess: htaccess::Config { enabled: true, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();

    let rewritten = serve_request(&service, &request(Method::GET, "/missing"), "/missing").await;
    assert_eq!(rewritten.status(), StatusCode::OK);
    assert_eq!(rewritten.into_body().collect().await.unwrap().to_bytes(), "front-controller");

    let existing = serve_request(&service, &request(Method::GET, "/existing.txt"), "/existing.txt").await;
    assert_eq!(existing.status(), StatusCode::OK);
    assert_eq!(existing.into_body().collect().await.unwrap().to_bytes(), "existing");

    let protected = serve_request(&service, &request(Method::GET, "/.htaccess"), "/.htaccess").await;
    assert_eq!(protected.status(), StatusCode::FORBIDDEN);
}

#[tokio::test]
async fn htaccess_directory_index_mime_headers_expires_and_nested_scope_work() {
    let tmp = TempDir::new().unwrap();
    std::fs::create_dir(tmp.path().join("docs")).unwrap();
    std::fs::write(tmp.path().join("docs/home.foo"), b"nested").unwrap();
    std::fs::write(
        tmp.path().join("docs/.htaccess"),
        br#"DirectoryIndex home.foo
Options -Indexes
AddType text/x-foo .foo
Header always set X-Htaccess yes
ExpiresActive On
ExpiresByType text/x-foo "access plus 1 hour"
"#,
    )
    .unwrap();
    let mut configured = Service {
        id: "htaccess-nested".into(),
        name: "htaccess nested".into(),
        document_root: tmp.path().to_path_buf(),
        index: vec!["index.html".into()],
        directory_listing: true,
        htaccess: htaccess::Config { enabled: true, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    let service = configured.compile().unwrap();
    let response = serve_request(&service, &request(Method::GET, "/docs/"), "/docs/").await;
    assert_eq!(response.status(), StatusCode::OK);
    assert_eq!(response.headers()[CONTENT_TYPE], "text/x-foo");
    assert_eq!(response.headers()["x-htaccess"], "yes");
    assert_eq!(response.headers()[CACHE_CONTROL], "public, max-age=3600");
    assert!(response.headers().contains_key(http::header::EXPIRES));
    assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "nested");
}

#[tokio::test]
async fn php_source_extensions_are_not_served_without_php_fpm() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"<?php echo 'secret';").unwrap();
    let service = service(tmp.path(), false);
    let response = serve_request(&service, &request(Method::GET, "/index.php"), "/index.php").await;
    assert_eq!(response.status(), StatusCode::FORBIDDEN);
    let body = response.into_body().collect().await.unwrap().to_bytes();
    assert!(!String::from_utf8_lossy(&body).contains("secret"));
}

#[test]
fn htaccess_php_addhandler_requires_php_fpm() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.phtml"), b"secret").unwrap();
    std::fs::write(tmp.path().join(".htaccess"), b"AddHandler application/x-httpd-php .phtml\n").unwrap();
    let mut configured = Service {
        id: "htaccess-handler".into(),
        name: "htaccess handler".into(),
        document_root: tmp.path().to_path_buf(),
        htaccess: htaccess::Config { enabled: true, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    assert!(configured.compile().unwrap_err().to_string().contains("requires PHP-FPM"));
}

#[test]
fn htaccess_security_sensitive_unsupported_directives_fail_closed() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.php"), b"secret").unwrap();
    std::fs::write(
        tmp.path().join(".htaccess"),
        br#"<FilesMatch "\.php$">
SetHandler application/x-httpd-php
</FilesMatch>
"#,
    )
    .unwrap();
    let mut configured = Service {
        id: "htaccess-filesmatch".into(),
        name: "htaccess filesmatch".into(),
        document_root: tmp.path().to_path_buf(),
        htaccess: htaccess::Config { enabled: true, strict: false, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    let error = configured.compile().unwrap_err().to_string();
    assert!(error.contains("Files/FilesMatch"));
}

#[test]
fn htaccess_strict_mode_rejects_unsupported_directives() {
    let tmp = TempDir::new().unwrap();
    std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
    std::fs::write(tmp.path().join(".htaccess"), b"ErrorDocument 404 /404.html\n").unwrap();
    let mut configured = Service {
        id: "htaccess-strict".into(),
        name: "htaccess strict".into(),
        document_root: tmp.path().to_path_buf(),
        htaccess: htaccess::Config { enabled: true, strict: true, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    assert!(configured.compile().unwrap_err().to_string().contains("ErrorDocument"));
}

#[cfg(unix)]
#[test]
fn htaccess_configuration_file_cannot_be_a_symlink() {
    use std::os::unix::fs::symlink;
    let tmp = TempDir::new().unwrap();
    let outside = TempDir::new().unwrap();
    std::fs::write(outside.path().join("outside.conf"), b"RewriteEngine On\n").unwrap();
    symlink(outside.path().join("outside.conf"), tmp.path().join(".htaccess")).unwrap();
    let mut configured = Service {
        id: "htaccess-symlink".into(),
        name: "htaccess symlink".into(),
        document_root: tmp.path().to_path_buf(),
        htaccess: htaccess::Config { enabled: true, ..Default::default() },
        ..Default::default()
    };
    configured.validate().unwrap();
    let error = configured.compile().unwrap_err().to_string();
    assert!(error.contains("must not be a symlink"));
}