xocomil 0.3.0

//! HTTP request body: zero-copy parsing, chunked decoding, and streaming.
//!
//! Two modes of operation:
//!
//! - **Complete buffer** — use [`RequestBody::parse`] when the full body is
//!   already in memory (e.g. after [`Request::parse`](crate::request::Request::parse)).
//! - **Streaming** — use [`ReadRequest::stream_body_to`](crate::request::ReadRequest::stream_body_to)
//!   to pipe decoded body data from a reader to any [`std::io::Write`]
//!   destination (file, `Vec<u8>`, `io::sink()`, etc.). No caller-managed
//!   body buffer required.
//!
//! # Complete-buffer example
//!
//! ```
//! use xocomil::body::{BodyKind, RequestBody};
//!
//! let mut buf = *b"5\r\nhello\r\n0\r\n\r\n";
//! let body = RequestBody::parse(&mut buf, BodyKind::Chunked).unwrap();
//! assert_eq!(body.data(), b"hello");
//! ```
//!
//! # Streaming example
//!
//! ```
//! use xocomil::request::Request;
//!
//! let raw = b"POST / HTTP/1.1\r\nHost: localhost\r\nContent-Length: 5\r\n\r\nhello";
//! let mut buf = [0u8; 1024];
//! let rr = Request::<32>::read(&mut &raw[..], &mut buf).unwrap();
//!
//! let mut body = Vec::new();
//! rr.stream_body_to(&mut &b""[..], &mut body).unwrap();
//! // (In practice the reader would be a BufReader<TcpStream>)
//! ```

use std::io::{self, BufRead, Read, Write};

use crate::ascii::HttpChar;
use crate::bytes::ByteSearch;
use crate::error::{BodyErrorKind, Error};

// ---------------------------------------------------------------------------
// BodyKind
// ---------------------------------------------------------------------------

/// How the request body is framed.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum BodyKind {
    /// No body expected.
    None,
    /// Body with a known byte length (Content-Length header).
    ContentLength(u64),
    /// Chunked transfer encoding.
    Chunked,
}

/// Map an I/O error to [`Error`], translating unexpected-EOF into the
/// body-specific variant so callers get a clear "body incomplete" error
/// instead of a generic I/O one.
#[inline]
fn map_io_err(e: io::Error) -> Error {
    if e.kind() == io::ErrorKind::UnexpectedEof {
        Error::from(BodyErrorKind::UnexpectedEof)
    } else {
        e.into()
    }
}

// ---------------------------------------------------------------------------
// RequestBody (complete-buffer path)
// ---------------------------------------------------------------------------

/// Zero-copy view of a parsed HTTP request body.
///
/// Borrows directly from the caller's buffer. For chunked
/// Transfer-Encoding, the data has been decoded in-place (chunk framing
/// stripped) before this view is created.
#[derive(Debug)]
pub struct RequestBody<'buf> {
    data: &'buf [u8],
}

impl<'buf> RequestBody<'buf> {
    /// An empty body (no data).
    pub const EMPTY: Self = Self { data: &[] };

    /// Parse a request body from the body region of a buffer.
    ///
    /// For [`BodyKind::ContentLength`], returns a slice of `data[..len]`.
    /// For [`BodyKind::Chunked`], decodes in-place and returns the
    /// decoded slice. The buffer is modified only for chunked encoding.
    ///
    /// # Errors
    ///
    /// Returns <code>[Error::Body]([BodyErrorKind::BodyTooLarge])</code> if the
    /// Content-Length exceeds the buffer. Returns chunked decoding errors
    /// for malformed input.
    pub fn parse(data: &'buf mut [u8], kind: BodyKind) -> Result<Self, Error> {
        match kind {
            BodyKind::None => Ok(Self::EMPTY),
            BodyKind::ContentLength(len) => {
                let len =
                    usize::try_from(len).map_err(|_| Error::from(BodyErrorKind::BodyTooLarge))?;
                if len > data.len() {
                    return Err(Error::from(BodyErrorKind::BodyTooLarge));
                }
                Ok(Self { data: &data[..len] })
            }
            BodyKind::Chunked => {
                let decoded = decode_chunked(data)?;
                Ok(Self {
                    data: &data[..decoded],
                })
            }
        }
    }

    /// The body data as raw bytes.
    #[inline]
    #[must_use]
    pub const fn data(&self) -> &'buf [u8] {
        self.data
    }

    /// The body data as a UTF-8 string.
    ///
    /// # Errors
    ///
    /// Returns `Utf8Error` if the body is not valid UTF-8.
    #[inline]
    pub const fn as_str(&self) -> Result<&'buf str, std::str::Utf8Error> {
        std::str::from_utf8(self.data)
    }

    /// The body length in bytes.
    #[inline]
    #[must_use]
    pub const fn len(&self) -> usize {
        self.data.len()
    }

    /// Returns `true` if the body is empty.
    #[inline]
    #[must_use]
    pub const fn is_empty(&self) -> bool {
        self.data.is_empty()
    }
}

/// Default maximum body size for streaming (8 MiB).
pub const DEFAULT_MAX_BODY_SIZE: u64 = 8 * 1024 * 1024;

/// Pass as `max_body_size` to disable body size limits.
pub const UNLIMITED_BODY_SIZE: u64 = u64::MAX;

// ---------------------------------------------------------------------------
// Streaming body to impl Write
// ---------------------------------------------------------------------------

/// Read a single byte via `fill_buf`/`consume` (no per-byte syscall).
#[inline]
fn read_byte(reader: &mut impl BufRead) -> Result<u8, Error> {
    let buf = reader.fill_buf().map_err(map_io_err)?;
    if buf.is_empty() {
        return Err(Error::from(BodyErrorKind::UnexpectedEof));
    }
    let b = buf[0];
    reader.consume(1);
    Ok(b)
}

/// Default stack buffer size for chunk size lines (512 bytes).
///
/// Accommodates arbitrary chunk extensions (RFC 7230 §4.1.1).
/// Pass a different value via the const generic on
/// [`stream_body_with`] to adjust.
pub const DEFAULT_CHUNK_LINE_BUF: usize = 512;

/// Read a chunk size line (`<hex>[;ext]\r\n`) from a buffered reader.
/// Uses `fill_buf`/`consume` to batch reads from the underlying source.
///
/// The const generic `BUF` controls the stack buffer size for the line.
fn read_chunk_size_line<const BUF: usize>(reader: &mut impl BufRead) -> Result<u64, Error> {
    let mut line = [0u8; BUF];
    let mut len = 0;

    loop {
        let buf = reader.fill_buf().map_err(map_io_err)?;
        if buf.is_empty() {
            return Err(Error::from(BodyErrorKind::UnexpectedEof));
        }

        // Scan the fill buffer for \n (end of chunk-size line).
        if let Some(pos) = buf.iter().position(|&b| b == HttpChar::LineFeed) {
            let take = pos + 1;
            if len + take > line.len() {
                return Err(Error::from(BodyErrorKind::InvalidChunkSize));
            }
            line[len..len + take].copy_from_slice(&buf[..take]);
            len += take;
            reader.consume(take);

            if len >= 2 && line[len - 2] == HttpChar::CarriageReturn {
                return parse_chunk_size(&line[..len - 2]);
            }
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }

        // No \n yet — consume everything and continue.
        let avail = buf.len();
        if len + avail > line.len() {
            return Err(Error::from(BodyErrorKind::InvalidChunkSize));
        }
        line[len..len + avail].copy_from_slice(buf);
        len += avail;
        reader.consume(avail);
    }
}

/// Default maximum bytes consumed while reading trailer headers (8 KiB).
/// Prevents a malicious client from sending an infinite trailer stream.
pub const DEFAULT_MAX_TRAILER_SIZE: usize = 8192;

/// Maximum size of a single trailer line, including its terminating
/// `\r\n`. Lines longer than this are rejected as malformed. The
/// overall trailer block is still capped at `max_trailer_size`.
const MAX_TRAILER_LINE: usize = 1024;

/// Read trailer headers after the final `0\r\n` chunk, validating each
/// line and consuming through the terminating `\r\n`.
///
/// Reads at most `max_trailer_size` bytes total. Returns an error if
/// the trailers are not terminated within that limit, if any single
/// trailer line exceeds [`MAX_TRAILER_LINE`] bytes, or if any non-empty
/// trailer line is not a syntactically valid header field.
///
/// Validation matches request header parsing: each non-empty line must
/// have a TCHAR-only field name, a colon, and a value with no NUL,
/// bare CR, or bare LF. This prevents request smuggling via a peer
/// sneaking a `\r\n\r\n` sequence inside trailer-line bytes — which
/// would otherwise terminate the trailer block prematurely and bleed
/// subsequent bytes into the next request on a keep-alive connection
/// (RFC 7230 §4.1.2 / §3.5).
fn skip_trailers(reader: &mut impl BufRead, max_trailer_size: usize) -> Result<(), Error> {
    let mut line = [0u8; MAX_TRAILER_LINE];
    let mut total_consumed: usize = 0;

    loop {
        // Read one trailer line (including its trailing \r\n) into `line`.
        let mut len = 0usize;
        loop {
            let buf = reader.fill_buf().map_err(map_io_err)?;
            if buf.is_empty() {
                return Err(Error::from(BodyErrorKind::UnexpectedEof));
            }

            // Scan the fill buffer for \n (end of trailer line).
            if let Some(pos) = buf.iter().position(|&b| b == HttpChar::LineFeed) {
                let take = pos + 1;
                if len + take > line.len() {
                    return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
                }
                if total_consumed + take > max_trailer_size {
                    return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
                }
                line[len..len + take].copy_from_slice(&buf[..take]);
                len += take;
                total_consumed += take;
                reader.consume(take);
                break;
            }

            // No \n yet — copy everything available and continue reading.
            let avail = buf.len();
            if len + avail > line.len() {
                return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
            }
            if total_consumed + avail > max_trailer_size {
                return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
            }
            line[len..len + avail].copy_from_slice(buf);
            len += avail;
            total_consumed += avail;
            reader.consume(avail);
        }

        // Line must end with \r\n (we already know it ends with \n).
        if len < 2 || line[len - 2] != HttpChar::CarriageReturn {
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }

        // Empty line (just \r\n) terminates the trailer block.
        if len == 2 {
            return Ok(());
        }

        // Validate this trailer line as a real header field. Pass the
        // full slice including \r\n — `scan_header_line` requires the
        // \r\n terminator to detect end-of-line and rejects NUL, bare
        // CR/LF in the value plus non-TCHAR bytes in the name.
        crate::scan::scan_header_line(&line[..len])
            .map_err(|_| Error::from(BodyErrorKind::MalformedChunkedEncoding))?;
    }
}

/// Stream a chunked body from `source` to `writer`, decoding on the fly.
fn stream_chunked<const CHUNK_LINE_BUF: usize>(
    source: &mut impl BufRead,
    writer: &mut impl Write,
    max_body_size: u64,
    max_trailer_size: usize,
) -> Result<u64, Error> {
    let mut total = 0u64;

    loop {
        let chunk_size = read_chunk_size_line::<CHUNK_LINE_BUF>(source)?;
        if chunk_size == 0 {
            skip_trailers(source, max_trailer_size)?;
            break;
        }

        let next_total = total
            .checked_add(chunk_size)
            .ok_or_else(|| Error::from(BodyErrorKind::BodyTooLarge))?;
        if next_total > max_body_size {
            return Err(Error::from(BodyErrorKind::BodyTooLarge));
        }

        // Use fill_buf/consume directly instead of io::copy, which
        // allocates an 8 KiB internal buffer. For small chunks (common in
        // server-sent events and real-world chunked encoding), this avoids
        // the intermediate buffer entirely.
        let mut remaining = chunk_size;
        while remaining > 0 {
            let buf = source.fill_buf().map_err(map_io_err)?;
            if buf.is_empty() {
                return Err(Error::from(BodyErrorKind::UnexpectedEof));
            }
            #[allow(clippy::cast_possible_truncation)]
            let n = (buf.len() as u64).min(remaining) as usize;
            writer.write_all(&buf[..n]).map_err(map_io_err)?;
            source.consume(n);
            remaining -= n as u64;
        }
        total = next_total;

        // Verify and consume trailing \r\n after chunk data.
        let cr = read_byte(source)?;
        let lf = read_byte(source)?;
        if cr != HttpChar::CarriageReturn || lf != HttpChar::LineFeed {
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }
    }

    Ok(total)
}

/// Stream the request body from a reader to a writer.
///
/// Uses [`DEFAULT_CHUNK_LINE_BUF`] (512 bytes) for the chunk size line
/// buffer. Use [`stream_body_with`] to specify a custom buffer size.
///
/// Body bytes already in the header buffer (`prefetch`) are written
/// first, then remaining data is read from `reader`. For chunked
/// encoding, chunk framing is stripped on the fly — only decoded body
/// data reaches the writer.
///
/// For best performance, wrap unbuffered readers (e.g. raw `TcpStream`)
/// in a `BufReader` — chunked decoding reads individual bytes for
/// framing, which would otherwise cause a syscall per byte.
///
/// Returns the number of decoded body bytes written.
///
/// # Errors
///
/// Returns <code>[Error::Body]([BodyErrorKind::BodyTooLarge])</code> if the
/// body exceeds `max_body_size`.
/// Returns <code>[Error::Body]([BodyErrorKind::UnexpectedEof])</code> if the
/// connection closes before the body is complete.
/// Returns chunked decoding errors for malformed input.
pub fn stream_body(
    reader: &mut impl BufRead,
    writer: &mut impl Write,
    prefetch: &[u8],
    kind: BodyKind,
    max_body_size: u64,
) -> Result<u64, Error> {
    stream_body_impl::<DEFAULT_CHUNK_LINE_BUF>(
        reader,
        writer,
        prefetch,
        kind,
        max_body_size,
        DEFAULT_MAX_TRAILER_SIZE,
    )
}

/// Stream the request body with compile-time configuration.
///
/// Like [`stream_body`] but all tunables are const generics:
///
/// - `CHUNK_LINE_BUF` — stack buffer size for chunk size lines during
///   chunked transfer decoding. A larger buffer accommodates chunk
///   extensions (RFC 7230 §4.1.1); a smaller one saves stack space.
///   Has no effect when `kind` is not [`BodyKind::Chunked`].
///
/// - `MAX_BODY_SIZE` — maximum decoded body bytes. Returns
///   <code>[Error::Body]([BodyErrorKind::BodyTooLarge])</code> if exceeded.
///
/// - `MAX_TRAILER_SIZE` — maximum bytes consumed while skipping trailer
///   headers after the final chunk. Has no effect when `kind` is not
///   [`BodyKind::Chunked`]. Defaults to [`DEFAULT_MAX_TRAILER_SIZE`]
///   when calling [`stream_body`].
///
/// # Errors
///
/// Returns <code>[Error::Body]([BodyErrorKind::BodyTooLarge])</code> if the
/// body exceeds `MAX_BODY_SIZE`.
/// Returns <code>[Error::Body]([BodyErrorKind::UnexpectedEof])</code> if the
/// connection closes before the body is complete.
/// Returns chunked decoding errors for malformed input.
pub fn stream_body_with<
    const CHUNK_LINE_BUF: usize,
    const MAX_BODY_SIZE: u64,
    const MAX_TRAILER_SIZE: usize,
>(
    reader: &mut impl BufRead,
    writer: &mut impl Write,
    prefetch: &[u8],
    kind: BodyKind,
) -> Result<u64, Error> {
    stream_body_impl::<CHUNK_LINE_BUF>(
        reader,
        writer,
        prefetch,
        kind,
        MAX_BODY_SIZE,
        MAX_TRAILER_SIZE,
    )
}

/// Shared implementation for [`stream_body`] and [`stream_body_with`].
fn stream_body_impl<const CHUNK_LINE_BUF: usize>(
    reader: &mut impl BufRead,
    writer: &mut impl Write,
    prefetch: &[u8],
    kind: BodyKind,
    max_body_size: u64,
    max_trailer_size: usize,
) -> Result<u64, Error> {
    match kind {
        BodyKind::None => Ok(0),
        BodyKind::ContentLength(len) => {
            if len > max_body_size {
                return Err(Error::from(BodyErrorKind::BodyTooLarge));
            }
            let prefetch_len = u64::try_from(prefetch.len()).unwrap_or(u64::MAX);
            let pre_len = prefetch_len.min(len);
            // pre_len <= prefetch.len() (a usize), so this cast is safe.
            #[allow(clippy::cast_possible_truncation)]
            let pre_bytes = pre_len as usize;
            if pre_bytes > 0 {
                writer
                    .write_all(&prefetch[..pre_bytes])
                    .map_err(map_io_err)?;
            }
            let remaining = len - pre_len;
            if remaining == 0 {
                return Ok(len);
            }
            let copied = io::copy(&mut reader.take(remaining), writer).map_err(map_io_err)?;
            if copied < remaining {
                return Err(Error::from(BodyErrorKind::UnexpectedEof));
            }
            Ok(len)
        }
        BodyKind::Chunked => {
            // For chunked encoding, prefetch may contain partial chunk
            // framing, so we must feed it through the chunk decoder.
            // Chain<Cursor, &mut impl BufRead> implements BufRead directly
            // since both sides implement BufRead — no extra BufReader needed.
            let cursor = io::Cursor::new(prefetch);
            let mut source = cursor.chain(reader);
            stream_chunked::<CHUNK_LINE_BUF>(&mut source, writer, max_body_size, max_trailer_size)
        }
    }
}

// ---------------------------------------------------------------------------
// BodyReader: streaming Read adapter for request bodies
// ---------------------------------------------------------------------------

/// Internal state for [`BodyReader`].
enum BodyReaderState {
    /// No more body data — `read` returns `Ok(0)`.
    Done,
    /// Plain `Content-Length` body. `remaining` is the number of body
    /// bytes still to surface to the caller.
    ContentLength { remaining: u64 },
    /// Chunked transfer-encoded body. `remaining` is the bytes left in
    /// the current chunk (zero between chunks; the next call advances
    /// to the next chunk-size line).
    Chunked { remaining: u64 },
}

/// Streaming `Read` adapter over a request body.
///
/// Wraps a [`BufRead`] source (the live connection) and a *prefetch*
/// slice (any body bytes that arrived in the same read as the
/// headers). For [`BodyKind::Chunked`], chunk framing is stripped on
/// the fly — only decoded body bytes are returned from
/// [`io::Read::read`]. The terminating zero-chunk and
/// trailer headers are consumed but not surfaced.
///
/// Most extractors will get one of these from
/// [`ReadRequest::body_reader`](crate::request::ReadRequest::body_reader);
/// you only need to construct one directly when feeding bytes from a
/// non-`ReadRequest` source.
///
/// # Example
///
/// ```
/// use std::io::Read;
/// use xocomil::body::{BodyKind, BodyReader, DEFAULT_MAX_BODY_SIZE};
///
/// let source = b"hello world";
/// let mut reader = BodyReader::new(
///     &source[..],
///     b"",
///     BodyKind::ContentLength(11),
///     DEFAULT_MAX_BODY_SIZE,
/// );
/// let mut out = Vec::new();
/// reader.read_to_end(&mut out).unwrap();
/// assert_eq!(out, b"hello world");
/// ```
pub struct BodyReader<'p, R: BufRead> {
    /// Chained prefetch + underlying reader. `BufRead` is implemented by
    /// `Chain` itself when both halves are `BufRead`, so no extra
    /// buffering layer is needed.
    source: io::Chain<io::Cursor<&'p [u8]>, R>,
    state: BodyReaderState,
    /// Bytes already surfaced to the caller (decoded). Counted against
    /// `max_body_size` for both Content-Length and chunked bodies.
    decoded: u64,
    max_body_size: u64,
    /// Stack buffer size for chunk-size lines, threaded as a value
    /// rather than a const generic so [`BodyReader`] can be a single
    /// type. Defaults to [`DEFAULT_CHUNK_LINE_BUF`].
    chunk_line_buf: usize,
    /// Maximum bytes consumed while skipping trailer headers after the
    /// final chunk. Threaded as a value rather than a const generic so
    /// [`BodyReader`] can be a single type. Defaults to
    /// [`DEFAULT_MAX_TRAILER_SIZE`].
    max_trailer_size: usize,
}

impl<'p, R: BufRead> BodyReader<'p, R> {
    /// Construct a body reader from a prefetch slice, the live reader,
    /// the framing kind, and a body-size limit.
    ///
    /// Pass [`UNLIMITED_BODY_SIZE`] to disable the size limit.
    /// Use [`DEFAULT_CHUNK_LINE_BUF`] worth of stack space for the
    /// chunk-size line; for compile-time tuning of that buffer, call
    /// [`with_chunk_line_buf`](Self::with_chunk_line_buf).
    /// Trailer headers are capped at [`DEFAULT_MAX_TRAILER_SIZE`] bytes;
    /// override via [`with_max_trailer_size`](Self::with_max_trailer_size).
    #[must_use]
    pub fn new(reader: R, prefetch: &'p [u8], kind: BodyKind, max_body_size: u64) -> Self {
        let state = match kind {
            BodyKind::None => BodyReaderState::Done,
            BodyKind::ContentLength(len) => BodyReaderState::ContentLength { remaining: len },
            BodyKind::Chunked => BodyReaderState::Chunked { remaining: 0 },
        };
        Self {
            source: io::Cursor::new(prefetch).chain(reader),
            state,
            decoded: 0,
            max_body_size,
            chunk_line_buf: DEFAULT_CHUNK_LINE_BUF,
            max_trailer_size: DEFAULT_MAX_TRAILER_SIZE,
        }
    }

    /// Override the chunk-size line buffer size (default
    /// [`DEFAULT_CHUNK_LINE_BUF`]). Has no effect for non-chunked
    /// bodies.
    #[must_use]
    pub const fn with_chunk_line_buf(mut self, buf: usize) -> Self {
        self.chunk_line_buf = buf;
        self
    }

    /// Override the maximum trailer size in bytes (default
    /// [`DEFAULT_MAX_TRAILER_SIZE`]). Has no effect for non-chunked
    /// bodies.
    #[must_use]
    pub const fn with_max_trailer_size(mut self, n: usize) -> Self {
        self.max_trailer_size = n;
        self
    }
}

impl<R: BufRead> io::Read for BodyReader<'_, R> {
    fn read(&mut self, buf: &mut [u8]) -> io::Result<usize> {
        if buf.is_empty() {
            return Ok(0);
        }
        match self.state {
            BodyReaderState::Done => Ok(0),
            BodyReaderState::ContentLength { remaining } => {
                if remaining == 0 {
                    self.state = BodyReaderState::Done;
                    return Ok(0);
                }
                #[allow(clippy::cast_possible_truncation)]
                let want = (remaining.min(buf.len() as u64)) as usize;
                let n = self.source.read(&mut buf[..want])?;
                if n == 0 {
                    return Err(io::Error::from(Error::from(BodyErrorKind::UnexpectedEof)));
                }
                self.decoded = self
                    .decoded
                    .checked_add(n as u64)
                    .ok_or_else(|| io::Error::from(Error::from(BodyErrorKind::BodyTooLarge)))?;
                if self.decoded > self.max_body_size {
                    return Err(io::Error::from(Error::from(BodyErrorKind::BodyTooLarge)));
                }
                self.state = BodyReaderState::ContentLength {
                    remaining: remaining - n as u64,
                };
                if remaining - n as u64 == 0 {
                    self.state = BodyReaderState::Done;
                }
                Ok(n)
            }
            BodyReaderState::Chunked { remaining } => self.read_chunked(buf, remaining),
        }
    }
}

impl<R: BufRead> BodyReader<'_, R> {
    fn read_chunked(&mut self, buf: &mut [u8], mut remaining: u64) -> io::Result<usize> {
        // If we're between chunks, consume the next size line.
        if remaining == 0 {
            let size = read_chunk_size_line_dyn(&mut self.source, self.chunk_line_buf)?;
            if size == 0 {
                skip_trailers(&mut self.source, self.max_trailer_size)?;
                self.state = BodyReaderState::Done;
                return Ok(0);
            }
            if self
                .decoded
                .checked_add(size)
                .is_none_or(|t| t > self.max_body_size)
            {
                return Err(io::Error::from(Error::from(BodyErrorKind::BodyTooLarge)));
            }
            remaining = size;
        }

        // Read up to min(remaining, buf.len()) bytes from the source.
        #[allow(clippy::cast_possible_truncation)]
        let want = remaining.min(buf.len() as u64) as usize;
        let n = self.source.read(&mut buf[..want])?;
        if n == 0 {
            return Err(io::Error::from(Error::from(BodyErrorKind::UnexpectedEof)));
        }
        self.decoded = self
            .decoded
            .checked_add(n as u64)
            .ok_or_else(|| io::Error::from(Error::from(BodyErrorKind::BodyTooLarge)))?;
        let new_remaining = remaining - n as u64;

        // If we consumed the chunk fully, eat the trailing CRLF.
        if new_remaining == 0 {
            let cr = read_byte(&mut self.source).map_err(io::Error::from)?;
            let lf = read_byte(&mut self.source).map_err(io::Error::from)?;
            if cr != HttpChar::CarriageReturn || lf != HttpChar::LineFeed {
                return Err(io::Error::from(Error::from(
                    BodyErrorKind::MalformedChunkedEncoding,
                )));
            }
        }
        self.state = BodyReaderState::Chunked {
            remaining: new_remaining,
        };
        Ok(n)
    }
}

/// Dynamic-size variant of [`read_chunk_size_line`] for use from
/// [`BodyReader`], which can't carry a const generic.
///
/// Allocates a small `Vec` on first call but only when the line spans
/// multiple `fill_buf` reads — for the common case of a short chunk
/// header inside one fill, no allocation occurs.
fn read_chunk_size_line_dyn(reader: &mut impl BufRead, max: usize) -> Result<u64, Error> {
    // Try the zero-allocation fast path first: chunk header fully in
    // one fill_buf window.
    {
        let buf = reader.fill_buf().map_err(map_io_err)?;
        if buf.is_empty() {
            return Err(Error::from(BodyErrorKind::UnexpectedEof));
        }
        if let Some(lf) = buf.iter().position(|&b| b == HttpChar::LineFeed) {
            if lf + 1 > max {
                return Err(Error::from(BodyErrorKind::InvalidChunkSize));
            }
            if lf < 1 || buf[lf - 1] != HttpChar::CarriageReturn {
                return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
            }
            let size = parse_chunk_size(&buf[..lf - 1])?;
            reader.consume(lf + 1);
            return Ok(size);
        }
    }

    // Slow path: line spans reads. Spill into a heap buffer up to `max`.
    let mut line: Vec<u8> = Vec::new();
    loop {
        let buf = reader.fill_buf().map_err(map_io_err)?;
        if buf.is_empty() {
            return Err(Error::from(BodyErrorKind::UnexpectedEof));
        }
        if let Some(pos) = buf.iter().position(|&b| b == HttpChar::LineFeed) {
            let take = pos + 1;
            if line.len() + take > max {
                return Err(Error::from(BodyErrorKind::InvalidChunkSize));
            }
            line.extend_from_slice(&buf[..take]);
            reader.consume(take);
            if line.len() >= 2 && line[line.len() - 2] == HttpChar::CarriageReturn {
                return parse_chunk_size(&line[..line.len() - 2]);
            }
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }
        let avail = buf.len();
        if line.len() + avail > max {
            return Err(Error::from(BodyErrorKind::InvalidChunkSize));
        }
        line.extend_from_slice(buf);
        reader.consume(avail);
    }
}

// ---------------------------------------------------------------------------
// Chunked decoding (complete-buffer, in-place)
// ---------------------------------------------------------------------------

/// Parse a hex chunk size. Stops at `;` (chunk extension) or end of slice.
#[inline]
fn parse_chunk_size(bytes: &[u8]) -> Result<u64, Error> {
    let mut n: u64 = 0;
    let mut digits = 0u32;

    for &b in bytes {
        // Why: RFC 7230 §4.1.1 defines `chunk = chunk-size [ chunk-ext ] CRLF`,
        // and §3.2.3 (BWS) permits optional whitespace around the `;` and within
        // the extension. We stop at `;` and do not validate the extension content
        // because (a) BWS is allowed there, (b) we don't surface chunk extensions
        // to callers, and (c) only chunk-size matters for framing. Empty
        // extensions (`5;`) and BWS-padded forms (`5; ext`) are intentionally accepted.
        if b == b';' {
            break;
        }
        let digit = match b {
            b'0'..=b'9' => b - b'0',
            b'a'..=b'f' => b - b'a' + 10,
            b'A'..=b'F' => b - b'A' + 10,
            _ => return Err(Error::from(BodyErrorKind::InvalidChunkSize)),
        };
        digits += 1;
        n = n
            .checked_mul(16)
            .and_then(|v| v.checked_add(u64::from(digit)))
            .ok_or_else(|| Error::from(BodyErrorKind::InvalidChunkSize))?;
    }

    if digits == 0 {
        return Err(Error::from(BodyErrorKind::InvalidChunkSize));
    }
    Ok(n)
}

/// Decode chunked transfer encoding in-place.
///
/// The input must contain a complete chunked body (including the
/// terminating `0\r\n\r\n`). After decoding, `data[..returned_len]`
/// contains the concatenated chunk data. Trailer headers are discarded.
///
/// # Errors
///
/// Returns <code>[Error::Body]([BodyErrorKind::InvalidChunkSize])</code> if a
/// chunk size is not valid hex.
/// Returns <code>[Error::Body]([BodyErrorKind::MalformedChunkedEncoding])</code>
/// if the framing is invalid.
#[inline]
pub fn decode_chunked(data: &mut [u8]) -> Result<usize, Error> {
    let len = data.len();
    let mut read_pos = 0;
    let mut write_pos = 0;

    loop {
        let crlf = data[read_pos..]
            .find_crlf(0)
            .ok_or_else(|| Error::from(BodyErrorKind::MalformedChunkedEncoding))?;

        let size = usize::try_from(parse_chunk_size(&data[read_pos..read_pos + crlf])?)
            .map_err(|_| Error::from(BodyErrorKind::InvalidChunkSize))?;
        read_pos += crlf + 2;

        if size == 0 {
            break;
        }

        let chunk_end = read_pos
            .checked_add(size)
            .and_then(|s| s.checked_add(2))
            .ok_or_else(|| Error::from(BodyErrorKind::MalformedChunkedEncoding))?;
        if chunk_end > len {
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }

        data.copy_within(read_pos..read_pos + size, write_pos);
        write_pos += size;
        read_pos += size;

        if data[read_pos..].find_crlf(0) != Some(0) {
            return Err(Error::from(BodyErrorKind::MalformedChunkedEncoding));
        }
        read_pos += 2;
    }

    Ok(write_pos)
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use crate::error::{BodyErrorKind, Error};

    use super::*;

    // -- parse_chunk_size ---------------------------------------------------

    #[test]
    fn chunk_size_simple() {
        assert_eq!(parse_chunk_size(b"0").unwrap(), 0);
        assert_eq!(parse_chunk_size(b"5").unwrap(), 5);
        assert_eq!(parse_chunk_size(b"a").unwrap(), 10);
        assert_eq!(parse_chunk_size(b"F").unwrap(), 15);
        assert_eq!(parse_chunk_size(b"1a").unwrap(), 26);
        assert_eq!(parse_chunk_size(b"ff").unwrap(), 255);
        assert_eq!(parse_chunk_size(b"FF").unwrap(), 255);
    }

    #[test]
    fn chunk_size_with_extension() {
        assert_eq!(parse_chunk_size(b"a;ext=val").unwrap(), 10);
        assert_eq!(parse_chunk_size(b"0;ext").unwrap(), 0);
    }

    #[test]
    fn chunk_size_empty() {
        assert!(parse_chunk_size(b"").is_err());
    }

    #[test]
    fn chunk_size_invalid_hex() {
        assert!(parse_chunk_size(b"zz").is_err());
    }

    #[test]
    fn chunk_size_overflow() {
        assert!(parse_chunk_size(b"ffffffffffffffff0").is_err());
    }

    // -- decode_chunked (in-place) ------------------------------------------

    #[test]
    fn decode_single_chunk() {
        let mut data = *b"5\r\nhello\r\n0\r\n\r\n";
        let n = decode_chunked(&mut data).unwrap();
        assert_eq!(&data[..n], b"hello");
    }

    #[test]
    fn decode_multiple_chunks() {
        let mut data = b"5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n".to_vec();
        let n = decode_chunked(&mut data).unwrap();
        assert_eq!(&data[..n], b"hello world");
    }

    #[test]
    fn decode_empty_body() {
        let mut data = *b"0\r\n\r\n";
        let n = decode_chunked(&mut data).unwrap();
        assert_eq!(n, 0);
    }

    #[test]
    fn decode_with_chunk_extension() {
        let mut data = b"5;name=val\r\nhello\r\n0\r\n\r\n".to_vec();
        let n = decode_chunked(&mut data).unwrap();
        assert_eq!(&data[..n], b"hello");
    }

    #[test]
    fn decode_truncated_chunk() {
        let mut data = *b"5\r\nhel";
        assert!(decode_chunked(&mut data).is_err());
    }

    #[test]
    fn decode_missing_crlf_after_chunk() {
        let mut data = *b"5\r\nhelloXX0\r\n\r\n";
        assert!(decode_chunked(&mut data).is_err());
    }

    // -- RequestBody::parse -------------------------------------------------

    #[test]
    fn parse_none() {
        let mut data = [];
        let body = RequestBody::parse(&mut data, BodyKind::None).unwrap();
        assert!(body.is_empty());
        assert_eq!(body.len(), 0);
    }

    #[test]
    fn parse_content_length() {
        let mut data = *b"hello world";
        let body = RequestBody::parse(&mut data, BodyKind::ContentLength(5)).unwrap();
        assert_eq!(body.data(), b"hello");
        assert_eq!(body.as_str().unwrap(), "hello");
        assert_eq!(body.len(), 5);
        assert!(!body.is_empty());
    }

    #[test]
    fn parse_content_length_too_large() {
        let mut data = *b"hi";
        let err = RequestBody::parse(&mut data, BodyKind::ContentLength(100)).unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::BodyTooLarge)));
    }

    #[test]
    fn parse_chunked() {
        let mut data = *b"5\r\nhello\r\n0\r\n\r\n";
        let body = RequestBody::parse(&mut data, BodyKind::Chunked).unwrap();
        assert_eq!(body.data(), b"hello");
    }

    // -- stream_body --------------------------------------------------------

    #[test]
    fn stream_none() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b""[..],
            &mut out,
            b"",
            BodyKind::None,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 0);
        assert!(out.is_empty());
    }

    #[test]
    fn stream_content_length_all_prefetch() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b""[..],
            &mut out,
            b"hello",
            BodyKind::ContentLength(5),
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_content_length_no_prefetch() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"hello"[..],
            &mut out,
            b"",
            BodyKind::ContentLength(5),
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_content_length_partial_prefetch() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b" world"[..],
            &mut out,
            b"hello",
            BodyKind::ContentLength(11),
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 11);
        assert_eq!(out, b"hello world");
    }

    #[test]
    fn stream_content_length_eof() {
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"hi"[..],
            &mut out,
            b"",
            BodyKind::ContentLength(100),
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::UnexpectedEof)));
    }

    #[test]
    fn stream_chunked_single() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"5\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_multiple() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 11);
        assert_eq!(out, b"hello world");
    }

    #[test]
    fn stream_chunked_with_prefetch() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"llo\r\n0\r\n\r\n"[..],
            &mut out,
            b"5\r\nhe",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_empty() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 0);
        assert!(out.is_empty());
    }

    #[test]
    fn stream_chunked_with_extension() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"5;ext=val\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_with_trailers() {
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"5\r\nhello\r\n0\r\nTrailer: val\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_accepts_well_formed_trailer() {
        // Multiple syntactically valid trailer lines must parse cleanly.
        let mut out = Vec::new();
        let n = stream_body(
            &mut &b"5\r\nhello\r\n0\r\nX-One: a\r\nX-Two: b\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_rejects_trailer_with_embedded_cr() {
        // A bare CR inside a trailer value (not followed by LF). If
        // skip_trailers consumed bytes opaquely, this would either be
        // accepted or — worse — let a peer sneak `\r\n\r\n` into the
        // value and bleed bytes into the next request. With real
        // header validation, scan_header_line rejects bare CR/LF in
        // values.
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"5\r\nhello\r\n0\r\nTrailer: va\rlue\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(
            err,
            Error::Body(BodyErrorKind::MalformedChunkedEncoding)
        ));
    }

    #[test]
    fn stream_chunked_rejects_trailer_without_colon() {
        // A non-empty trailer line with no colon is not a valid header
        // field and must be rejected.
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"5\r\nhello\r\n0\r\nNotAHeader\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(
            err,
            Error::Body(BodyErrorKind::MalformedChunkedEncoding)
        ));
    }

    #[test]
    fn stream_chunked_eof() {
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"5\r\nhe"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::UnexpectedEof)));
    }

    #[test]
    fn stream_chunked_bad_crlf_after_data() {
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"5\r\nhelloXX"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(
            err,
            Error::Body(BodyErrorKind::MalformedChunkedEncoding)
        ));
    }

    // -- Body size limits ---------------------------------------------------

    #[test]
    fn stream_chunked_huge_chunk_size_does_not_overflow_limit() {
        // Regression: a chunk size near u64::MAX must not wrap when added
        // to `total` and silently bypass the body-size limit.
        let huge = format!("{:x}\r\n", u64::MAX - 1);
        let mut input = huge.into_bytes();
        input.extend_from_slice(b"data\r\n0\r\n\r\n");
        let mut out = Vec::new();
        let err = stream_body(
            &mut input.as_slice(),
            &mut out,
            b"",
            BodyKind::Chunked,
            1024,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::BodyTooLarge)));
    }

    #[test]
    fn decode_chunked_huge_size_does_not_overflow() {
        // Regression: read_pos + size + 2 must not wrap.
        let huge = format!("{:x}\r\n", usize::MAX - 1);
        let mut input = huge.into_bytes();
        input.extend_from_slice(b"x");
        assert!(decode_chunked(&mut input).is_err());
    }

    #[test]
    fn stream_content_length_too_large() {
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"hello"[..],
            &mut out,
            b"",
            BodyKind::ContentLength(5),
            4,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::BodyTooLarge)));
    }

    #[test]
    fn stream_chunked_too_large() {
        let mut out = Vec::new();
        let err = stream_body(
            &mut &b"5\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
            4,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::BodyTooLarge)));
    }

    // -- Error (unified) ----------------------------------------------------

    #[test]
    fn error_display() {
        assert_eq!(
            BodyErrorKind::BodyTooLarge.to_string(),
            "body exceeds buffer size"
        );
        assert_eq!(
            BodyErrorKind::UnexpectedEof.to_string(),
            "connection closed before body complete"
        );
        assert_eq!(
            BodyErrorKind::InvalidChunkSize.to_string(),
            "invalid chunk size"
        );
        assert_eq!(
            BodyErrorKind::MalformedChunkedEncoding.to_string(),
            "malformed chunked encoding"
        );
    }

    #[test]
    fn error_converts_to_io_error() {
        let err = Error::Body(BodyErrorKind::InvalidChunkSize);
        let io_err: io::Error = err.into();
        assert_eq!(io_err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn error_from_io() {
        let io_err = io::Error::new(io::ErrorKind::BrokenPipe, "pipe");
        let err = Error::from(io_err);
        assert!(matches!(err, Error::Io(_)));
        assert!(std::error::Error::source(&err).is_some());
    }

    #[test]
    fn error_io_roundtrip() {
        let io_err = io::Error::new(io::ErrorKind::BrokenPipe, "pipe");
        let err = Error::from(io_err);
        let back: io::Error = err.into();
        assert_eq!(back.kind(), io::ErrorKind::BrokenPipe);
    }

    // -- Trailer byte limit -------------------------------------------------

    #[test]
    fn stream_chunked_trailers_within_limit() {
        let mut trailer = Vec::new();
        // ~200 bytes of trailers, well within 8 KiB.
        for i in 0..5 {
            trailer.extend_from_slice(format!("X-Trailer-{i}: value-{i}\r\n").as_bytes());
        }
        trailer.extend_from_slice(b"\r\n");

        let mut input = b"5\r\nhello\r\n0\r\n".to_vec();
        input.extend_from_slice(&trailer);

        let mut out = Vec::new();
        let n = stream_body(
            &mut input.as_slice(),
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_chunked_trailers_exceed_limit() {
        // Build trailers that exceed MAX_TRAILER_SIZE (8 KiB).
        let mut trailer = Vec::new();
        for i in 0..500 {
            trailer.extend_from_slice(format!("X-T-{i}: {}\r\n", "x".repeat(20)).as_bytes());
        }
        // Don't terminate — the limit should fire first.

        let mut input = b"5\r\nhello\r\n0\r\n".to_vec();
        input.extend_from_slice(&trailer);

        let mut out = Vec::new();
        let err = stream_body(
            &mut input.as_slice(),
            &mut out,
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        )
        .unwrap_err();
        assert!(matches!(
            err,
            Error::Body(BodyErrorKind::MalformedChunkedEncoding)
        ));
    }

    // -- Custom chunk line buffer -------------------------------------------

    #[test]
    fn stream_body_with_custom_chunk_buf() {
        let mut out = Vec::new();
        let n = stream_body_with::<64, { UNLIMITED_BODY_SIZE }, { DEFAULT_MAX_TRAILER_SIZE }>(
            &mut &b"5\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
        )
        .unwrap();
        assert_eq!(n, 5);
        assert_eq!(out, b"hello");
    }

    #[test]
    fn stream_body_with_tiny_chunk_buf_rejects_long_extension() {
        // Chunk size line with extension exceeds 16-byte buffer.
        let mut out = Vec::new();
        let err = stream_body_with::<16, { UNLIMITED_BODY_SIZE }, { DEFAULT_MAX_TRAILER_SIZE }>(
            &mut &b"5;extension=very-long-value\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::InvalidChunkSize)));
    }

    #[test]
    fn stream_chunked_custom_max_trailer_size() {
        // Tiny trailer cap (16 bytes) with trailers that easily exceed it.
        let mut out = Vec::new();
        let err = stream_body_with::<{ DEFAULT_CHUNK_LINE_BUF }, { UNLIMITED_BODY_SIZE }, 16>(
            &mut &b"5\r\nhello\r\n0\r\nX-Trailer: this-value-is-way-too-long\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
        )
        .unwrap_err();
        assert!(matches!(
            err,
            Error::Body(BodyErrorKind::MalformedChunkedEncoding)
        ));
    }

    // -- BodyReader (streaming Read adapter) --------------------------------

    use std::io::Read;

    #[test]
    fn body_reader_none_returns_zero() {
        let mut r = BodyReader::new(&b""[..], b"", BodyKind::None, UNLIMITED_BODY_SIZE);
        let mut out = [0u8; 8];
        assert_eq!(r.read(&mut out).unwrap(), 0);
    }

    #[test]
    fn body_reader_content_length_all_prefetch() {
        let mut r = BodyReader::new(
            &b""[..],
            b"hello",
            BodyKind::ContentLength(5),
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello");
    }

    #[test]
    fn body_reader_content_length_split() {
        let mut r = BodyReader::new(
            &b" world"[..],
            b"hello",
            BodyKind::ContentLength(11),
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello world");
    }

    #[test]
    fn body_reader_content_length_eof() {
        let mut r = BodyReader::new(
            &b"hi"[..],
            b"",
            BodyKind::ContentLength(100),
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        let err = r.read_to_end(&mut out).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn body_reader_chunked_single() {
        let mut r = BodyReader::new(
            &b"5\r\nhello\r\n0\r\n\r\n"[..],
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello");
    }

    #[test]
    fn body_reader_chunked_multiple() {
        let mut r = BodyReader::new(
            &b"5\r\nhello\r\n6\r\n world\r\n0\r\n\r\n"[..],
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello world");
    }

    #[test]
    fn body_reader_chunked_with_prefetch() {
        let mut r = BodyReader::new(
            &b"llo\r\n0\r\n\r\n"[..],
            b"5\r\nhe",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello");
    }

    #[test]
    fn body_reader_chunked_with_trailers() {
        let mut r = BodyReader::new(
            &b"5\r\nhello\r\n0\r\nTrailer: val\r\n\r\n"[..],
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        r.read_to_end(&mut out).unwrap();
        assert_eq!(out, b"hello");
    }

    #[test]
    fn body_reader_chunked_too_large() {
        let mut r = BodyReader::new(&b"5\r\nhello\r\n0\r\n\r\n"[..], b"", BodyKind::Chunked, 4);
        let mut out = Vec::new();
        let err = r.read_to_end(&mut out).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn body_reader_content_length_too_large() {
        let mut r = BodyReader::new(&b"hello"[..], b"", BodyKind::ContentLength(5), 4);
        let mut out = Vec::new();
        let err = r.read_to_end(&mut out).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn body_reader_small_buffer_drains_chunked() {
        // Caller-provided buffer smaller than the chunk — exercises the
        // "remaining > buf.len()" path for several iterations.
        let mut r = BodyReader::new(
            &b"b\r\nhello world\r\n0\r\n\r\n"[..],
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        let mut tmp = [0u8; 3];
        loop {
            let n = r.read(&mut tmp).unwrap();
            if n == 0 {
                break;
            }
            out.extend_from_slice(&tmp[..n]);
        }
        assert_eq!(out, b"hello world");
    }

    #[test]
    fn body_reader_chunked_eof_mid_chunk() {
        let mut r = BodyReader::new(&b"5\r\nhe"[..], b"", BodyKind::Chunked, UNLIMITED_BODY_SIZE);
        let mut out = Vec::new();
        let err = r.read_to_end(&mut out).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn body_reader_chunked_bad_terminator() {
        let mut r = BodyReader::new(
            &b"5\r\nhelloXX"[..],
            b"",
            BodyKind::Chunked,
            UNLIMITED_BODY_SIZE,
        );
        let mut out = Vec::new();
        let err = r.read_to_end(&mut out).unwrap_err();
        assert_eq!(err.kind(), io::ErrorKind::InvalidData);
    }

    #[test]
    fn stream_body_with_const_max_body_size() {
        let mut out = Vec::new();
        let err = stream_body_with::<{ DEFAULT_CHUNK_LINE_BUF }, 4, { DEFAULT_MAX_TRAILER_SIZE }>(
            &mut &b"5\r\nhello\r\n0\r\n\r\n"[..],
            &mut out,
            b"",
            BodyKind::Chunked,
        )
        .unwrap_err();
        assert!(matches!(err, Error::Body(BodyErrorKind::BodyTooLarge)));
    }

    // -- BodyReader: Ok(0) from underlying reader is treated as EOF ---------
    //
    // These tests pin the framing-safe behavior of `BodyReader::read`:
    // when the underlying source returns `Ok(0)` (a normal "end of
    // stream" signal from `Read`) before the body is complete, we MUST
    // surface an error rather than loop. Without these tests, a future
    // refactor could turn the EOF check into a `continue` and silently
    // introduce an infinite loop in the connection handler.
    //
    // The error path goes through `BodyErrorKind::UnexpectedEof` ->
    // `Error` -> `io::Error`, which lands as
    // `io::ErrorKind::InvalidData` (see the `error_converts_to_io_error`
    // test above and the conversion sites near the `n == 0` checks in
    // `BodyReader::read` and `BodyReader::read_chunked`).

    /// `BufRead` source that always reports end-of-stream: `fill_buf`
    /// returns an empty slice and `read` returns `Ok(0)`. Used to
    /// simulate a peer that closed the connection mid-body without
    /// surfacing an OS-level error.
    struct AlwaysZero;

    impl io::Read for AlwaysZero {
        fn read(&mut self, _buf: &mut [u8]) -> io::Result<usize> {
            Ok(0)
        }
    }

    impl io::BufRead for AlwaysZero {
        fn fill_buf(&mut self) -> io::Result<&[u8]> {
            Ok(&[])
        }
        fn consume(&mut self, _amt: usize) {}
    }

    #[test]
    #[allow(clippy::never_loop)] // iteration cap is intentional — guards against hangs
    fn body_reader_content_length_returns_eof_on_zero_read() {
        // ContentLength(10) but the source yields no bytes — the very
        // first read must error, not loop.
        let mut r = BodyReader::new(
            AlwaysZero,
            b"",
            BodyKind::ContentLength(10),
            UNLIMITED_BODY_SIZE,
        );
        let mut buf = [0u8; 8];

        // Bound the work: if a future bug turns this into a loop, we
        // detect it via the iteration cap rather than hanging the test
        // runner.
        let mut errored = false;
        for _ in 0..16 {
            match r.read(&mut buf) {
                Ok(0) => panic!("BodyReader returned Ok(0) instead of EOF error"),
                Ok(n) => panic!("BodyReader returned Ok({n}) from a zero-yielding source"),
                Err(e) => {
                    assert_eq!(e.kind(), io::ErrorKind::InvalidData);
                    errored = true;
                    break;
                }
            }
        }
        assert!(
            errored,
            "BodyReader::read did not error within the iteration cap"
        );
    }

    #[test]
    #[allow(clippy::never_loop)] // iteration cap is intentional — guards against hangs
    fn body_reader_chunked_returns_eof_on_zero_read() {
        // Prefetch supplies a valid chunk-size line (`5\r\n`) so the
        // header parses cleanly; the source then yields Ok(0) when we
        // try to read the 5 bytes of chunk data. Must error, not loop.
        let mut r = BodyReader::new(AlwaysZero, b"5\r\n", BodyKind::Chunked, UNLIMITED_BODY_SIZE);
        let mut buf = [0u8; 8];

        let mut errored = false;
        for _ in 0..16 {
            match r.read(&mut buf) {
                Ok(0) => panic!("BodyReader returned Ok(0) instead of EOF error"),
                Ok(n) => panic!("BodyReader returned Ok({n}) from a zero-yielding source"),
                Err(e) => {
                    assert_eq!(e.kind(), io::ErrorKind::InvalidData);
                    errored = true;
                    break;
                }
            }
        }
        assert!(
            errored,
            "BodyReader::read did not error within the iteration cap"
        );
    }

    #[test]
    #[allow(clippy::never_loop)] // iteration cap is intentional — guards against hangs
    fn body_reader_chunked_size_line_eof() {
        // Empty prefetch, empty source — chunked read should error
        // promptly when it tries to fetch the chunk-size line.
        let mut r = BodyReader::new(AlwaysZero, b"", BodyKind::Chunked, UNLIMITED_BODY_SIZE);
        let mut buf = [0u8; 8];

        let mut errored = false;
        for _ in 0..16 {
            match r.read(&mut buf) {
                Ok(0) => panic!("BodyReader returned Ok(0) instead of EOF error"),
                Ok(n) => panic!("BodyReader returned Ok({n}) from a zero-yielding source"),
                Err(e) => {
                    assert_eq!(e.kind(), io::ErrorKind::InvalidData);
                    errored = true;
                    break;
                }
            }
        }
        assert!(
            errored,
            "BodyReader::read did not error within the iteration cap"
        );
    }
}