86 lines
4.5 KiB
Markdown
86 lines
4.5 KiB
Markdown
---
|
||
id: review-002-client-policy-wire-tests
|
||
name: Wire tests — redirect policy, retry gate/budget, streaming terminal arms, TLS error arms (CLI-02/03, COV-10/11)
|
||
status: completed
|
||
depends_on: [review-002-fwd15-stream-timeout, review-002-cli01-retry-after-budget]
|
||
scope: moderate
|
||
risk: low
|
||
impact: component
|
||
level: implementation
|
||
tags: [client, review-002, coverage, adapters]
|
||
---
|
||
|
||
## Description
|
||
|
||
The crate's highest-value coverage gap: the outbound client's policy
|
||
stack — the code that protects credentials — has never run against a
|
||
redirect or a retry on the wire, and `forward_stream`'s terminal arms
|
||
are dark end-to-end (review 002 COV-11: `same_host_redirect_policy`
|
||
100% dark; COV-10: SSE terminal arms dark). Concretely:
|
||
|
||
- **CLI-02 (redirect)**: no test in the crate sends any 3xx. Add:
|
||
(a) same-host 302 → followed, credential headers forwarded;
|
||
(b) cross-host 302 → response surfaced (HTTP_302-family), the second
|
||
endpoint receives **zero requests** (count at the attacker server) —
|
||
the FWD-03 property, pinned. Hop-cap (>10) → loud error, third test.
|
||
The `spawn_responder` seam at forward.rs:1415-1477 already speaks
|
||
raw HTTP and can emit `location:`.
|
||
- **CLI-03 (retry)**: counting-responder tests: POST + 500 ⇒ exactly
|
||
1 upstream hit (method gate, :362-366); GET + 500×2 ⇒ 3 hits then
|
||
success; budget exhaustion (`max_total_retry_duration` small) stops
|
||
retries even under a generous attempt cap (:381); PEM
|
||
parse-failure arms (:487-507) via garbage-PEM files asserting
|
||
`CaBundleParse`/`ClientCertParse` + path (never key material).
|
||
- **COV-10 (streaming/forward terminal arms)**: (a) upstream SSE line
|
||
> 1 MiB without newline through the real `forward_stream` → single
|
||
INTERNAL terminal envelope, stream ends; (b) responder sends
|
||
`data: a\n\n` then aborts the socket → terminal error envelope;
|
||
(c) responder ends without trailing blank line → pending event
|
||
dispatched at EOF; (d) dead-port transport failure through both
|
||
`forward` (:719-722) and `forward_stream` (:851-853) → INTERNAL
|
||
envelope; (e) binary `application/octet-stream` 200 → byte-array
|
||
envelope (:638-643); (f) `application/json` 200 with malformed body
|
||
→ INTERNAL decode envelope (:656-658).
|
||
- Plus the small dark arms from COV-12 that live in this seam:
|
||
ApiKey/Basic malformed-credential loud arms (extend the FWD-08 test
|
||
family), declared-header-param invalid name/value rejections, and
|
||
`SharedHttpClient::config()` reflecting a reloaded config
|
||
(FWD-12's atomicity assertion).
|
||
|
||
## Acceptance Criteria
|
||
|
||
- [ ] Redirect: 3 tests (same-host follow, cross-host refuse +
|
||
zero-contact assert, hop-cap error) passing
|
||
- [ ] Retry: 3 tests (POST single-hit, GET retry-to-success with
|
||
counted hits, budget-bounded) passing
|
||
- [ ] TLS: 2 parse-failure tests (CaBundleParse, ClientCertParse) +
|
||
config()-after-reload assertion
|
||
- [ ] Streaming: 6 terminal-arm tests (oversized line, socket abort,
|
||
EOF-flush, dead-port×2, binary decode, malformed-JSON decode)
|
||
passing
|
||
- [ ] Credential arms: ApiKey/Basic malformed-value tests land
|
||
- [ ] `cargo test --all-features`, `cargo clippy --all-features
|
||
--all-targets -- -D warnings`, `cargo fmt --check` pass
|
||
|
||
## References
|
||
|
||
- docs/reviews/002-post-remediation-review.md (Part D', CLI-02/03; Part G', COV-09/10/11/12)
|
||
- src/client/http_client.rs:300-316 (redirect policy), :354-395 (retry gate/budget), :487-507 (PEM arms)
|
||
- src/adapters/forward.rs:1415-1477 (spawn_responder seam), :887-925 (stream terminal arms)
|
||
- tests/client_tls.rs (the TLS harness pattern)
|
||
- tasks/client/review-002-fwd15-stream-timeout.md and review-002-cli01-retry-after-budget.md (land first — these tests pin their new behavior too)
|
||
|
||
## Notes
|
||
|
||
Pure test-addition task (plus any test-seam helpers). Land after the
|
||
two client behavior tasks so the tests assert final semantics, not
|
||
interim ones. Slice: (1) redirect tests, (2) retry tests, (3)
|
||
streaming terminal arms, (4) TLS + config arms — independent commits.
|
||
If `spawn_responder` needs a "count requests per host" surface, build
|
||
it once and reuse — the cross-host zero-contact assertion is the
|
||
load-bearing one.
|
||
|
||
## Summary
|
||
|
||
CLI-02 redirect wire tests (same-host follows with credentials, cross-host surfaces + zero attacker hits, hop cap bounded); CLI-03 retry gate/budget counting-responder tests; COV-10 streaming terminal arms (oversized line, socket abort mid-frame, EOF flush, dead port); COV-11 TLS parse-failure arms incl. reqwest from_pem_bundle zero-section insight; COV-12 credential/header-param arms. Test-only.
|