alkhttp/tasks/client/review-002-client-policy-wire-tests.md

id, name, status, depends_on, scope, risk, impact, level, tags

id	name	status	depends_on	scope	risk	impact	level	tags
review-002-client-policy-wire-tests	Wire tests — redirect policy, retry gate/budget, streaming terminal arms, TLS error arms (CLI-02/03, COV-10/11)	completed	review-002-fwd15-stream-timeout review-002-cli01-retry-after-budget	moderate	low	component	implementation	client review-002 coverage adapters

Description

The crate's highest-value coverage gap: the outbound client's policy stack — the code that protects credentials — has never run against a redirect or a retry on the wire, and forward_stream's terminal arms are dark end-to-end (review 002 COV-11: same_host_redirect_policy 100% dark; COV-10: SSE terminal arms dark). Concretely:

• CLI-02 (redirect): no test in the crate sends any 3xx. Add: (a) same-host 302 → followed, credential headers forwarded; (b) cross-host 302 → response surfaced (HTTP_302-family), the second endpoint receives zero requests (count at the attacker server) — the FWD-03 property, pinned. Hop-cap (>10) → loud error, third test. The spawn_responder seam at forward.rs:1415-1477 already speaks raw HTTP and can emit location:.
• CLI-03 (retry): counting-responder tests: POST + 500 ⇒ exactly 1 upstream hit (method gate, :362-366); GET + 500×2 ⇒ 3 hits then success; budget exhaustion (max_total_retry_duration small) stops retries even under a generous attempt cap (:381); PEM parse-failure arms (:487-507) via garbage-PEM files asserting CaBundleParse/ClientCertParse + path (never key material).
• COV-10 (streaming/forward terminal arms): (a) upstream SSE line

  1 MiB without newline through the real forward_stream → single INTERNAL terminal envelope, stream ends; (b) responder sends data: a\n\n then aborts the socket → terminal error envelope; (c) responder ends without trailing blank line → pending event dispatched at EOF; (d) dead-port transport failure through both forward (:719-722) and forward_stream (:851-853) → INTERNAL envelope; (e) binary application/octet-stream 200 → byte-array envelope (:638-643); (f) application/json 200 with malformed body → INTERNAL decode envelope (:656-658).

• Plus the small dark arms from COV-12 that live in this seam: ApiKey/Basic malformed-credential loud arms (extend the FWD-08 test family), declared-header-param invalid name/value rejections, and SharedHttpClient::config() reflecting a reloaded config (FWD-12's atomicity assertion).

Acceptance Criteria

• Redirect: 3 tests (same-host follow, cross-host refuse + zero-contact assert, hop-cap error) passing
• Retry: 3 tests (POST single-hit, GET retry-to-success with counted hits, budget-bounded) passing
• TLS: 2 parse-failure tests (CaBundleParse, ClientCertParse) + config()-after-reload assertion
• Streaming: 6 terminal-arm tests (oversized line, socket abort, EOF-flush, dead-port×2, binary decode, malformed-JSON decode) passing
• Credential arms: ApiKey/Basic malformed-value tests land
• cargo test --all-features, cargo clippy --all-features --all-targets -- -D warnings, cargo fmt --check pass

References

• docs/reviews/002-post-remediation-review.md (Part D', CLI-02/03; Part G', COV-09/10/11/12)
• src/client/http_client.rs:300-316 (redirect policy), :354-395 (retry gate/budget), :487-507 (PEM arms)
• src/adapters/forward.rs:1415-1477 (spawn_responder seam), :887-925 (stream terminal arms)
• tests/client_tls.rs (the TLS harness pattern)
• tasks/client/review-002-fwd15-stream-timeout.md and review-002-cli01-retry-after-budget.md (land first — these tests pin their new behavior too)

Notes

Pure test-addition task (plus any test-seam helpers). Land after the two client behavior tasks so the tests assert final semantics, not interim ones. Slice: (1) redirect tests, (2) retry tests, (3) streaming terminal arms, (4) TLS + config arms — independent commits. If spawn_responder needs a "count requests per host" surface, build it once and reuse — the cross-host zero-contact assertion is the load-bearing one.

Summary

CLI-02 redirect wire tests (same-host follows with credentials, cross-host surfaces + zero attacker hits, hop cap bounded); CLI-03 retry gate/budget counting-responder tests; COV-10 streaming terminal arms (oversized line, socket abort mid-frame, EOF flush, dead port); COV-11 TLS parse-failure arms incl. reqwest from_pem_bundle zero-section insight; COV-12 credential/header-param arms. Test-only.