static_assert(std::is_base_of_v<detail::response_body, T>,

"emplace_body: T must derive from detail::response_body");

assert(body_ == nullptr &&

"emplace_body: body slot already populated");

if constexpr (sizeof(T) <= body_buf_size && alignof(T) <= 16) {

// SBO inline path.

body_ = ::new (body_storage_) T(std::forward<Args>(args)...);

body_inline_ = true;

} else {

// Heap fallback. ::operator new(sizeof(T)) is paired exactly

// with the destructor's ::operator delete(body_); a plain

// `new T(...)` here would mismatch.

void* mem = ::operator new(sizeof(T));

try {

body_ = ::new (mem) T(std::forward<Args>(args)...);

} catch (...) {

::operator delete(mem);

throw;

}

body_inline_ = false;

}

kind_ = k;

http_response r;

r.status_code_ = http::http_utils::http_no_content; // 204

r.emplace_body<detail::empty_response_body>(body_kind::empty, mhd_flags);

return r;

std::string content_type) {

http_response r;

r.status_code_ = http::http_utils::http_ok; // 200

r.with_header(http::http_utils::http_header_content_type,

std::move(content_type));

r.emplace_body<detail::string_response_body>(body_kind::string,

std::move(response_body));

return r;

http_response r;

r.status_code_ = http::http_utils::http_ok;

// Match v1 file_response default Content-Type. Callers can override

// with .with_header("Content-Type", "...") in the chain.

r.with_header(http::http_utils::http_header_content_type,

http::http_utils::application_octet_stream);

r.emplace_body<detail::file_response_body>(body_kind::file, std::move(path));

return r;

// Deep-copy into the body's owned vector so the caller's span need

// not outlive the response. The buffers each entry's `base` points

// at remain BORROWED — see detail::iovec_response_body's lifetime contract.

std::vector<iovec_entry> v(entries.begin(), entries.end());

http_response r;

r.status_code_ = http::http_utils::http_ok;

r.emplace_body<detail::iovec_response_body>(body_kind::iovec, std::move(v));

return r;

http_response r;

r.status_code_ = http::http_utils::http_ok;

r.emplace_body<detail::pipe_response_body>(body_kind::pipe, fd);

return r;

std::function<ssize_t(std::uint64_t, char*, std::size_t)> producer) {

http_response r;

r.status_code_ = http::http_utils::http_ok;

r.emplace_body<detail::deferred_response_body>(body_kind::deferred,

std::move(producer));

return r;

std::string_view realm,

std::string response_body) {

// Security: reject scheme or realm values containing CR, LF, or NUL.

// Any of these characters can be used to inject additional HTTP headers

// into the WWW-Authenticate response header (CWE-113). This is always a

// caller error — callers must never pass untrusted user input as scheme

// or realm without first validating it. Throw std::invalid_argument so

// the error is visible and cannot be silently swallowed.

// detail::kForbiddenFieldChars is the same constant used by

// validate_http_field in http_response.cpp — shared to avoid a

// duplicate definition.

if (scheme.find_first_of(detail::kForbiddenFieldChars) != std::string_view::npos) {

throw std::invalid_argument(

"http_response::unauthorized: scheme contains forbidden control "

"character (CR, LF, or NUL)");

}

if (realm.find_first_of(detail::kForbiddenFieldChars) != std::string_view::npos) {

throw std::invalid_argument(

"http_response::unauthorized: realm contains forbidden control "

"character (CR, LF, or NUL)");

}

// Security: escape backslash and double-quote characters inside realm

// per RFC 7235 §2.1 quoted-string rules. RFC 7235 allows both to be

// escaped via the quoted-pair rule `\X`; an unescaped `"` terminates

// the quoted-string early (CWE-116) and an unescaped `\` is

// misinterpreted as starting an escape sequence by strict parsers.

// Backslash must be escaped first to avoid double-escaping the

// backslashes we insert for double-quote escaping.

//

// Fast path: the common case (e.g. the canonical `Basic realm="myrealm"`)

// has no backslash or double-quote to escape, so realm can be appended

// directly and the char-by-char copy + heap allocation below is skipped.

http_response r;

r.status_code_ = http::http_utils::http_unauthorized; // 401

// Build `<scheme> realm="<escaped_realm>"`. AC #3 requires byte-for-byte

// `Basic realm="myrealm"` for the canonical case (which has no quotes).

std::string challenge;

challenge.reserve(scheme.size() + realm.size() + 10);

challenge.append(scheme.data(), scheme.size());

challenge.append(" realm=\"");

if (realm.find_first_of("\\\"") == std::string_view::npos) {

challenge.append(realm.data(), realm.size());

} else {

std::string escaped_realm;

escaped_realm.reserve(realm.size());

for (char c : realm) {

if (c == '\\') {

escaped_realm.push_back('\\'); // escape backslash first

} else if (c == '"') {

escaped_realm.push_back('\\'); // escape double-quote

}

escaped_realm.push_back(c);

}

challenge.append(escaped_realm);

}

challenge.push_back('"');

r.with_header(http::http_utils::http_header_www_authenticate,

challenge);

// The body slot literally holds a string_response_body (possibly empty), so

// kind() reports body_kind::string. Switching to body_kind::empty

// for the empty-body case would fork the construction path and

// break the invariant that kind() reflects the placed-new body.

r.emplace_body<detail::string_response_body>(body_kind::string,

std::move(response_body));

return r;

// Same forbidden-character set as validate_http_field above.

auto reject_ctrl_chars = [](std::string_view field,

std::string_view value) {

if (value.find_first_of(detail::kForbiddenFieldChars) !=

std::string_view::npos) {

throw std::invalid_argument(

std::string("http_response::unauthorized(digest_challenge): ") +

std::string(field) +

" contains forbidden control character (CR, LF, or NUL)");

}

};

reject_ctrl_chars("realm", challenge.realm);

reject_ctrl_chars("opaque", challenge.opaque);

reject_ctrl_chars("domain", challenge.domain);

reject_ctrl_chars("response_body", challenge.response_body);

// qop="auth-int" is not implemented: the dispatch path

// (map_to_mhd_digest_args_) has no MHD mapping for it and would

// silently ignore the flag. Fail loudly rather than let a caller

// believe integrity protection was negotiated.

if (challenge.qop_auth_int) {

throw std::invalid_argument(

"http_response::unauthorized(digest_challenge): "

"qop_auth_int (qop=\"auth-int\") is not implemented; "

"leave it false");

}

detail::digest_challenge_response_body::params p{

/*realm=*/ std::move(challenge.realm),

/*opaque=*/ std::move(challenge.opaque),

/*domain=*/ std::move(challenge.domain),

/*body_text=*/ std::move(challenge.response_body),

/*algorithm=*/ challenge.algorithm,

/*qop_auth=*/ challenge.qop_auth,

/*qop_auth_int=*/ challenge.qop_auth_int,

/*signal_stale=*/ challenge.signal_stale,

/*userhash_support=*/ challenge.userhash_support,

/*prefer_utf8=*/ challenge.prefer_utf8,

};

http_response r;

r.status_code_ = http::http_utils::http_unauthorized; // 401

r.emplace_body<detail::digest_challenge_response_body>(

body_kind::digest_challenge, std::move(p));

return r;