"set-cookie",

"content-length",

"transfer-encoding",

"server",

"x-request-id",

pub method: &'a Method,

pub uri: &'a Uri,

pub remote_addr: SocketAddr,

pub request_id: &'a str,

headers: &'a http::HeaderMap,

cookies: PluginCookies,

metadata: &'a [(String, String)],

pub(crate) fn new(

method: &'a Method,

uri: &'a Uri,

remote_addr: SocketAddr,

request_id: &'a str,

headers: &'a http::HeaderMap,

cookies: PluginCookies,

metadata: &'a [(String, String)],

) -> Self {

Self {

method,

uri,

remote_addr,

request_id,

headers,

cookies,

metadata,

}

}

/// Read a request header. `Cookie` header is blocked — use `cookie()`.

pub fn header(&self, name: &str) -> Option<&HeaderValue> {

if name.eq_ignore_ascii_case("cookie") {

None

} else {

self.headers.get(name)

}

}

/// Read this plugin's cookie by key (prefix applied automatically).

pub fn cookie(&self, key: &str) -> Option<&str> {

self.cookies.get(key)

}

/// Look up a metadata value by key.

pub fn metadata(&self, key: &str) -> Option<&str> {

self.metadata

.iter()

.find(|(k, _)| k == key)

.map(|(_, v)| v.as_str())

}

pub(crate) metadata: Vec<(String, String)>,

pub(crate) early_response: Option<http::Response<ResponseBody>>,

pub(crate) request_id_override: Option<String>,

pub(crate) profiling_mode: Option<crate::profiling::ProfilingMode>,

pub(crate) profiling_run_id: Option<String>,

pub(crate) fn new() -> Self {

Self {

metadata: Vec::new(),

early_response: None,

request_id_override: None,

profiling_mode: None,

profiling_run_id: None,

}

}

/// Add metadata (visible to other plugins and core via event metadata).

pub fn set_metadata(&mut self, key: impl Into<String>, value: impl Into<String>) {

self.metadata.push((key.into(), value.into()));

}

/// Short-circuit the pipeline with an early response.

pub fn set_early_response(&mut self, response: http::Response<ResponseBody>) {

self.early_response = Some(response);

}

/// Override the request ID (e.g. with a trace-derived identifier).

pub fn set_request_id(&mut self, id: String) {

self.request_id_override = Some(id);

}

/// Select a profiling mode for this request (and record its run id). The

/// worker thread reads these fields before calling

/// `ProfilingContext::reset`, so a later plugin can still override the

/// decision. Typical callers: `ox_profiler` (ProfileAll on trigger hit).

pub fn set_profiling_decision(

&mut self,

mode: crate::profiling::ProfilingMode,

run_id: String,

) {

self.profiling_mode = Some(mode);

self.profiling_run_id = Some(run_id);

}

pub status: StatusCode,

pub request_id: &'a str,

headers: &'a http::HeaderMap,

metadata: &'a [(String, String)],

pub(crate) fn new(

status: StatusCode,

request_id: &'a str,

headers: &'a http::HeaderMap,

metadata: &'a [(String, String)],

) -> Self {

Self {

status,

request_id,

headers,

metadata,

}

}

pub fn header(&self, name: &str) -> Option<&HeaderValue> {

self.headers.get(name)

}

/// Look up a metadata value by key.

pub fn metadata(&self, key: &str) -> Option<&str> {

self.metadata

.iter()

.find(|(k, _)| k == key)

.map(|(_, v)| v.as_str())

}

plugin_name: &'a str,

pub(crate) add_headers: Vec<(HeaderName, HeaderValue)>,

pub(crate) set_cookies: Vec<PluginSetCookie>,

pub(crate) fn new(plugin_name: &'a str) -> Self {

Self {

plugin_name,

add_headers: Vec::new(),

set_cookies: Vec::new(),

}

}

/// Add a response header. Dangerous headers are silently blocked.

pub fn add_header(&mut self, name: &str, value: HeaderValue) {

if BLOCKED_RESPONSE_HEADERS

.iter()

.any(|blocked| blocked.eq_ignore_ascii_case(name))

{

tracing::warn!(plugin = self.plugin_name, header = name, "Blocked header");

return;

}

if let Ok(header_name) = name.parse::<HeaderName>() {

self.add_headers.push((header_name, value));

}

}

/// Set a cookie (automatically prefixed with `__oxp_{plugin_name}_`).

pub fn set_cookie(&mut self, key: &str, value: &str, opts: CookieOptions) {

self.set_cookies.push(PluginSetCookie {

key: key.to_string(),

value: value.to_string(),

opts,

});

}

pub request_id: &'a str,

pub method: &'a str,

pub path: &'a str,

pub status: u16,

pub duration: Duration,

pub remote_addr: SocketAddr,

pub request_body_size: u64,

pub response_size: u64,

metadata: &'a [(String, String)],

/// PHP errors captured during script execution (empty for static files).

pub php_errors: &'a [crate::types::PhpScriptError],

/// Finalized span tree for the request. `None` when APM is disabled or no spans.

pub profile_tree: Option<&'a std::sync::Arc<crate::profiling::SpanTree>>,

/// Time spent waiting in the worker queue (microseconds).

pub queue_wait_us: Option<u64>,

/// PHP script execution time (microseconds).

pub php_exec_us: Option<u64>,

#[allow(clippy::too_many_arguments)]

pub(crate) fn new(

request_id: &'a str,

method: &'a str,

path: &'a str,

status: u16,

duration: Duration,

remote_addr: SocketAddr,

request_body_size: u64,

response_size: u64,

metadata: &'a [(String, String)],

php_errors: &'a [crate::types::PhpScriptError],

profile_tree: Option<&'a std::sync::Arc<crate::profiling::SpanTree>>,

queue_wait_us: Option<u64>,

php_exec_us: Option<u64>,

) -> Self {

Self {

request_id,

method,

path,

status,

duration,

remote_addr,

request_body_size,

response_size,

metadata,

php_errors,

profile_tree,

queue_wait_us,

php_exec_us,

}

}

/// Look up a metadata value by key.

pub fn metadata(&self, key: &str) -> Option<&str> {

self.metadata

.iter()

.find(|(k, _)| k == key)

.map(|(_, v)| v.as_str())

}

fn handle(&self, view: &PluginRequestView, actions: &mut PluginRequestActions);

fn priority(&self) -> Priority {

0

}

fn handle(&self, view: &PluginResponseView, actions: &mut PluginResponseActions<'_>);

fn priority(&self) -> Priority {

0

}

fn handle(&self, view: &PluginCompleteView);

fn priority(&self) -> Priority {

0

}

fn collect(&self, output: &mut String) {

(self)(output)

}

pub method: &'a Method,

pub path: &'a str,

pub headers: &'a http::HeaderMap,

pub query: Option<&'a str>,

pub fn header(&self, name: &str) -> Option<&HeaderValue> {

self.headers.get(name)

}

F: Fn(&PluginInternalRequest) -> http::Response<ResponseBody> + Send + Sync,

fn handle(&self, req: &PluginInternalRequest) -> http::Response<ResponseBody> {

(self)(req)

}

use super::*;

#[test]

fn test_request_view_blocks_cookie_header() {

let mut headers = http::HeaderMap::new();

headers.insert("cookie", "session=abc".parse().unwrap());

headers.insert("authorization", "Bearer tok".parse().unwrap());

let cookies = PluginCookies { cookies: vec![] };

let addr: SocketAddr = "127.0.0.1:8080".parse().unwrap();

let uri: Uri = "/test".parse().unwrap();

let view =

PluginRequestView::new(&Method::GET, &uri, addr, "req123", &headers, cookies, &[]);

assert!(view.header("cookie").is_none());

assert!(view.header("Cookie").is_none());

assert!(view.header("COOKIE").is_none());

assert!(view.header("authorization").is_some());

}

#[test]

fn test_request_view_cookie_access() {

let headers = http::HeaderMap::new();

let cookies = PluginCookies {

cookies: vec![("token".into(), "abc".into())],

};

let addr: SocketAddr = "127.0.0.1:8080".parse().unwrap();

let uri: Uri = "/test".parse().unwrap();

let view =

PluginRequestView::new(&Method::GET, &uri, addr, "req123", &headers, cookies, &[]);

assert_eq!(view.cookie("token"), Some("abc"));

assert_eq!(view.cookie("other"), None);

}

#[test]

fn test_request_actions_metadata() {

let mut actions = PluginRequestActions::new();

actions.set_metadata("user_id", "42");

assert_eq!(actions.metadata.len(), 1);

assert_eq!(

actions.metadata[0],

("user_id".to_string(), "42".to_string())

);

}

#[test]

fn test_response_view_header() {

let mut headers = http::HeaderMap::new();

headers.insert("x-custom", "val".parse().unwrap());

let view = PluginResponseView::new(StatusCode::OK, "req123", &headers, &[]);

assert_eq!(view.header("x-custom").unwrap(), "val");

assert!(view.header("missing").is_none());

}

#[test]

fn test_blocked_response_header() {

let mut actions = PluginResponseActions::new("test");

actions.add_header("set-cookie", "session=stolen".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked

actions.add_header("Set-Cookie", "session=stolen".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked (case insensitive)

actions.add_header("content-length", "100".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked

actions.add_header("transfer-encoding", "chunked".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked

actions.add_header("server", "evil".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked

actions.add_header("x-request-id", "fake".parse().unwrap());

assert!(actions.add_headers.is_empty()); // blocked

}

#[test]

fn test_allowed_response_header() {

let mut actions = PluginResponseActions::new("test");

actions.add_header("x-custom", "value".parse().unwrap());

assert_eq!(actions.add_headers.len(), 1);

actions.add_header("access-control-allow-origin", "*".parse().unwrap());

assert_eq!(actions.add_headers.len(), 2);

}

#[test]

fn test_response_actions_set_cookie() {

let mut actions = PluginResponseActions::new("test");

actions.set_cookie("token", "abc", CookieOptions::default());

assert_eq!(actions.set_cookies.len(), 1);

assert_eq!(actions.set_cookies[0].key, "token");

assert_eq!(actions.set_cookies[0].value, "abc");

}

#[test]

fn test_internal_request_header() {

let mut headers = http::HeaderMap::new();

headers.insert("accept", "application/json".parse().unwrap());

let req = PluginInternalRequest {

method: &Method::GET,

path: "/__test/status",

headers: &headers,

query: None,

};

assert!(req.header("accept").is_some());

}

#[test]

fn test_request_view_metadata_accessor() {

let headers = http::HeaderMap::new();

let cookies = PluginCookies { cookies: vec![] };

let addr: SocketAddr = "127.0.0.1:8080".parse().unwrap();

let uri: Uri = "/test".parse().unwrap();

let metadata = vec![

("trace_id".to_string(), "abc123".to_string()),

("span_id".to_string(), "def456".to_string()),

];

let view = PluginRequestView::new(

&Method::GET,

&uri,

addr,

"req123",

&headers,

cookies,

&metadata,

);

assert_eq!(view.metadata("trace_id"), Some("abc123"));

assert_eq!(view.metadata("span_id"), Some("def456"));

assert_eq!(view.metadata("missing"), None);

}

#[test]

fn test_request_id_override() {

let mut actions = PluginRequestActions::new();

assert!(actions.request_id_override.is_none());

actions.set_request_id("trace-derived-id".to_string());

assert_eq!(

actions.request_id_override,

Some("trace-derived-id".to_string())

);

}