#include <curl/curl.h>

#include <unistd.h>

#include <fcntl.h>

#include <sys/stat.h>

#include <cstdio>

#include <cstdlib>

#include <cstring>

#include <memory>

#include <string>

#include "./httpserver.hpp"

#include "./littletest.hpp"

#include "./curl_helpers.hpp"

#include "./stream_capture_helpers.hpp"

using httpserver::webserver;

using httpserver::create_webserver;

using httpserver::http_request;

using httpserver::http_response;

using httpserver::http_resource;

using httpserver_test::begin_capture;

using httpserver_test::end_capture;

using httpserver_test::writefunc;

namespace {

class echo_resource : public http_resource {

};

CURLcode run_one_post(uint16_t port, const std::string& path,

}

} // namespace

LT_BEGIN_SUITE(dump_set_suite)

void set_up() {}

void tear_down() {}

LT_END_SUITE(dump_set_suite)

LT_BEGIN_AUTO_TEST(dump_set_suite, startup_warning_emitted_exactly_once_across_multiple_webservers)

auto stderr_cap = begin_capture(STDERR_FILENO, "set_stderr");

// ---- First webserver: should warn ------------------------------------

auto ws1 = std::make_unique<webserver>(

create_webserver(9182)

.start_method(httpserver::http::http_utils::INTERNAL_SELECT)

.max_threads(2));

auto r1 = std::make_shared<echo_resource>();

ws1->register_path("echo", r1);

ws1->start(false);

CURLcode res1 = run_one_post(9182, "echo", "secret=opted-in-body");

ws1->stop();

// Quiesce point for the one-warning-per-process assertion below:

// webserver::stop() (called above and again by ~webserver via

// reset()) invokes MHD_stop_daemon(), which blocks until all active

// connections are drained and every libmicrohttpd worker thread has

// been joined (see webserver::stop() in src/detail/webserver_lifecycle.cpp

// and the stop_and_wait() contract in src/webserver.cpp). ws1's MHD

// threads are therefore fully gone before ws2 starts -- nothing from

// ws1 can write to the captured stderr concurrently with ws2's

// start(), so counting "SECURITY WARNING" occurrences across both

// lifetimes is race-free.

ws1.reset();

// ---- Second webserver: warning must NOT fire again ------------------

auto ws2 = std::make_unique<webserver>(

create_webserver(9183)

.start_method(httpserver::http::http_utils::INTERNAL_SELECT)

.max_threads(2));

auto r2 = std::make_shared<echo_resource>();

ws2->register_path("echo", r2);

ws2->start(false);

CURLcode res2 = run_one_post(9183, "echo", "trailing=body");

ws2->stop();

ws2.reset();

std::string captured_stderr = end_capture(stderr_cap, STDERR_FILENO);

LT_CHECK_EQ(res1, 0);

LT_CHECK_EQ(res2, 0);

// The warning is fired through the project's tagged-prefix shape and

// names the env var, the SECURITY WARNING marker, and the

// credential / PII risk.

LT_CHECK(captured_stderr.find("LIBHTTPSERVER_DEBUG_DUMP_REQUEST_BODY")

!= std::string::npos);

LT_CHECK(captured_stderr.find("SECURITY WARNING")

!= std::string::npos);

// Names the risk explicitly so an operator scanning logs sees what's at

// stake.

LT_CHECK(captured_stderr.find("credentials")

!= std::string::npos);

// Idempotence: only one occurrence of the warning marker across two

// start() calls.

auto count_substring = [](const std::string& hay,

const std::string& needle) {

size_t n = 0;

size_t pos = 0;

while ((pos = hay.find(needle, pos)) != std::string::npos) {

++n;

pos += needle.size();

}

return n;

};

LT_CHECK_EQ(count_substring(captured_stderr, "SECURITY WARNING"),

static_cast<size_t>(1));

LT_END_AUTO_TEST(startup_warning_emitted_exactly_once_across_multiple_webservers)

LT_BEGIN_AUTO_TEST(dump_set_suite, dump_body_to_stdout_when_env_set)

auto stdout_cap = begin_capture(STDOUT_FILENO, "set_stdout2");

auto ws3 = std::make_unique<webserver>(

create_webserver(9185)

.start_method(httpserver::http::http_utils::INTERNAL_SELECT)

.max_threads(2));

auto r3 = std::make_shared<echo_resource>();

ws3->register_path("echo", r3);

ws3->start(false);

CURLcode res3 = run_one_post(9185, "echo", "solo=body-dump");

ws3->stop();

ws3.reset();

std::string captured_stdout = end_capture(stdout_cap, STDOUT_FILENO);

LT_CHECK_EQ(res3, 0);

LT_CHECK(captured_stdout.find("Writing content:") != std::string::npos);

LT_CHECK(captured_stdout.find("solo=body-dump") != std::string::npos);

LT_END_AUTO_TEST(dump_body_to_stdout_when_env_set)

LT_BEGIN_AUTO_TEST_ENV()

#if defined(_WIN32) && !defined(__CYGWIN__)

// reason: this suite's positive assertions rely on the POSIX stdout/stderr

// capture harness (stream_capture_helpers.hpp), which does not behave under

// MSYS2/mingw — the dump itself works ("Writing content:" is emitted) but

// the captured buffers come back empty, so the presence/count checks here

// fail while the absence-based unset/zero variants pass vacuously. Skip the

// whole binary on Windows (exit 77 -> Automake SKIP).

std::fprintf(stderr, "[SKIP] debug_dump_request_body_set: POSIX stdout/"

"stderr capture harness unavailable on Windows\n");

return 77;

#else

// Opt in BEFORE the test bodies run (and BEFORE the magic-static

// cache in the body pipeline is initialised on first dispatch).

::setenv("LIBHTTPSERVER_DEBUG_DUMP_REQUEST_BODY", "1", 1);

#endif

// Kept outside the #if/#else so AUTORUN_TESTS() (which declares the

// __lt_result__ that LT_END_AUTO_TEST_ENV returns) is always compiled;

// on Windows it is unreachable after the return 77 above.

AUTORUN_TESTS()

LT_END_AUTO_TEST_ENV()