---
id: review-001-hyper-server-knobs
name: Configure hyper timeouts + decoy/405/proxy-path fixes (SRV-04, SRV-07, SRV-08, SRV-09, SRV-10)
status: pending
depends_on: []
scope: moderate
risk: low
impact: component
level: implementation
tags: [server, review-001, stealth]
---

## Description

Review 001 server-core minors, grouped because they are small, disjoint,
and all land in `src/server/`:

- **SRV-04**: `HyperBuilder` (`src/server/adapter.rs:217-224`) sets no
  timer — hyper 1.11 *silently ignores* `header_read_timeout` without one
  (verified against hyper source), so the slow-loris surface is open and
  every keep-alive knob is off. Set a timer (tokio) + `header_read_timeout`
  + h1/h2 keep-alive knobs. No concurrency cap exists in this crate (the
  accept loop is the consumer's) — document that boundary in the module
  doc.
- **SRV-05**: `with_decoy` consumes `extra_routes` via `.take()`
  (`adapter.rs:104`); a second builder call silently rebuilds without the
  custom routes. Clone (or error on double-build).
- **SRV-07**: the decoy is only the router `fallback` — method-mismatch
  requests return axum's bare 405 with no `Server: nginx` header, which
  single-handedly distinguishes alkhttp from nginx in decoy deployments
  (empirically verified). Wrap 405s with the decoy response.
- **SRV-08**: `percent_decode` maps `+`→space (wrong in a URI path) and
  per-byte→char (mojibake for non-ASCII filenames) — `decoy.rs:106-127`.
  Fix with proper UTF-8 percent-decoding; also move the blocking
  `is_dir()`/`is_file()` syscalls off the async path.
- **SRV-09**: `/openapi.json` error path echoes raw serde internals to
  unauthenticated callers and re-serializes the whole projection per
  request (`adapter.rs:250-254`); companion unguarded
  `.expect("to_openapi always emits…")` in `to_openapi.rs:67`. Cache the
  serialized doc, return a generic 500 body, remove the `expect`.
- **SRV-10**: WS upgrade hardcodes `NoCap` while the doc claims a
  stricter policy is passable — add the injection point or fix the doc;
  drop the double token resolution (router middleware + `ws_bearer_auth`).

## Acceptance Criteria

- [ ] Hyper configured with timer + header read timeout; knob values documented
- [ ] 405 responses carry the decoy `Server` header (test with `OPTIONS /search`)
- [ ] `%C3%A9` and `a+b.html` resolve correctly in the decoy static server (tests); async-path syscalls gone
- [ ] `/openapi.json` 500 body is generic; doc cached; `expect` removed
- [ ] Second `.with_decoy` no longer silently drops extra routes (test)
- [ ] SRV-10: policy injection point exists or doc corrected; single token resolution
- [ ] `cargo test`, `cargo test --all-features`, `cargo clippy --all-targets -- -D warnings` pass

## References

- docs/reviews/001-initial-implementation-review.md (Part A, SRV-04..SRV-10)
- docs/architecture/decisions/010-alpn-router-and-endpoint.md

## Notes

> Agent fills during implementation. Independent of the other
> review-001 tasks; can proceed in parallel.

## Summary

> Filled on completion.