microsandbox_network/engine/secrets/

handler.rs

//! Secret substitution handler for the TLS proxy.
//!
//! Scans decrypted plaintext for placeholder strings and replaces them
//! with real secret values, but only when the destination host is allowed.

use std::borrow::Cow;
use std::collections::{HashMap, HashSet};
use std::fmt;
use std::net::{IpAddr, SocketAddr};
use std::sync::Arc;

use base64::{Engine, engine::general_purpose::STANDARD as BASE64};
use httlib_hpack::{Decoder as HpackDecoder, Encoder as HpackEncoder};
use percent_encoding::percent_decode;

use super::config::SecretsConfigExt;
use super::hpack::check_header_block;
use crate::engine::http_deny::{classify_http_request, secret_http_forbidden_response};
use crate::netstack::shared::SharedState;
use crate::policy::{EgressEvaluation, HostnameSource, NetworkPolicy, Protocol};
use crate::secrets::config::{
    HostPattern, MAX_SECRET_PLACEHOLDER_BYTES, SecretEntry, SecretViolationAction, SecretsConfig,
};

//--------------------------------------------------------------------------------------------------
// Constants
//--------------------------------------------------------------------------------------------------

/// Maximum bytes to buffer while waiting for HTTP request headers.
const MAX_HTTP_HEADER_BYTES: usize = 64 * 1024;

/// Maximum fixed-length HTTP body to buffer for body substitution.
const MAX_HTTP_BODY_BUFFER_BYTES: usize = 16 * 1024 * 1024;

/// HTTP/2 client connection preface.
const HTTP2_PREFACE: &[u8] = b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n";

/// Header name retained across opaque writes for Basic-auth violation scans.
const AUTHORIZATION_HEADER_NAME: &[u8] = b"authorization:";

/// Maximum HTTP/2 frame payload the handler buffers at once.
/// This is the largest value representable in the protocol's 24-bit
/// frame-length field.
const MAX_HTTP2_FRAME_PAYLOAD_BYTES: usize = 0x00ff_ffff;

/// Maximum accumulated HTTP/2 HPACK header block.
const MAX_HTTP2_HEADER_BLOCK_BYTES: usize = 64 * 1024;

/// Maximum decoded HTTP/2 header bytes accepted after HPACK expansion.
const MAX_HTTP2_DECODED_HEADER_BYTES: usize = 64 * 1024;

/// Maximum decoded HTTP/2 header fields accepted in one HEADERS block.
const MAX_HTTP2_HEADER_FIELDS: usize = 1024;

/// Maximum concurrently open HTTP/2 request streams tracked by the secret handler.
const MAX_HTTP2_TRACKED_STREAMS: usize = 1024;

/// Conservative outbound HTTP/2 frame payload size. This is the protocol
/// default and is valid even before seeing the upstream peer's SETTINGS.
const HTTP2_OUTBOUND_FRAME_PAYLOAD_BYTES: usize = 16 * 1024;

const HTTP2_FRAME_DATA: u8 = 0x0;
const HTTP2_FRAME_HEADERS: u8 = 0x1;
const HTTP2_FRAME_PUSH_PROMISE: u8 = 0x5;
const HTTP2_FRAME_CONTINUATION: u8 = 0x9;

const HTTP2_FLAG_END_STREAM: u8 = 0x1;
const HTTP2_FLAG_END_HEADERS: u8 = 0x4;
const HTTP2_FLAG_PADDED: u8 = 0x8;
const HTTP2_FLAG_PRIORITY: u8 = 0x20;

//--------------------------------------------------------------------------------------------------
// Types
//--------------------------------------------------------------------------------------------------

/// Handles secret placeholder substitution in TLS-intercepted plaintext.
///
/// Created from [`SecretsConfig`] and the destination SNI. Determines which
/// secrets are eligible for this connection based on host matching.
pub struct SecretsHandler {
    /// Secrets eligible for substitution on this connection.
    eligible_for_substitution: Vec<EligibleSecret>,
    /// Secret placeholders that should trigger an effective blocking action.
    ineligible_for_substitution: Vec<IneligibleSecret>,
    /// Whether this connection is TLS-intercepted (not bypass).
    tls_intercepted: bool,
    /// TLS SNI this handler was created for.
    sni: String,
    /// Original guest destination for this connection.
    guest_dst: Option<SocketAddr>,
    /// Longest raw or encoded placeholder representation. Sizes the
    /// sliding-window tail used for cross-write violation detection.
    max_detection_window_len: usize,
    /// Longest active body-substitution placeholder. Sizes the chunked body
    /// substitution carry window.
    max_body_placeholder_len: usize,
    /// True when any configured placeholder exceeds the supported bound.
    placeholder_limit_exceeded: bool,
    /// Trailing bytes carried over from the previous `substitute` call so a
    /// placeholder split across TCP writes still trips the violation check.
    /// Capped at `max_detection_window_len - 1` bytes.
    prev_tail: Vec<u8>,
    /// HTTP framing state for the request stream. Tracks whether the next
    /// chunk should be parsed as a request start (headers) or treated as a
    /// continuation of the current request's body.
    http_state: HttpState,
    /// Authority validator for HTTP/1 `Host` and HTTP/2 `:authority` headers.
    http_authority: Option<HttpAuthorityValidator>,
    /// Whether a proven non-HTTP stream should bypass HTTP framing permanently.
    opaque: bool,
    /// Current HTTP/1 request metadata while processing body continuations.
    http1_request_summary: Option<RequestSummary>,
    /// Buffered HTTP bytes while waiting for complete headers or a complete
    /// body-rewriteable request.
    http_pending: Vec<u8>,
    /// Body-only tail for detecting eligible placeholders inside HTTP/1 bodies
    /// whose framing or encoding cannot be rewritten safely.
    unsupported_body_tail: Vec<u8>,
    /// HTTP/2 parser/rewriter state once an HTTP/2 preface is observed.
    http2_state: Option<Http2State>,
    /// Saturating count used to avoid answering the wrong pipelined request.
    http1_requests: u8,
    /// Whether the first request can receive a normal HTTP/1 response body.
    http1_response_allowed: bool,
    /// Set only by an actual HTTP/1 placeholder violation, not parse failures.
    http1_violation: bool,
}

/// HTTP request framing state for the guest→server byte stream.
#[derive(Debug, Clone)]
enum HttpState {
    /// Scanning for the start of a request. The next `\r\n\r\n` ends headers.
    AwaitingHeaders,
    /// Inside a fixed-length request body. `remaining` is the number of body
    /// bytes left per Content-Length.
    InBody { remaining: usize },
    /// Inside a chunked request body.
    InChunkedBody { state: ChunkedBodyState },
    /// Inside a chunked request body that is being decoded and re-encoded so
    /// body placeholders can be substituted safely.
    InChunkedRewriteBody { state: ChunkedRewriteState },
    /// Buffering a fixed-length body so body substitution can update
    /// `Content-Length` against the complete rewritten request.
    BufferingBody { remaining: usize },
}

/// Stateful chunked transfer parser for request bodies.
#[derive(Debug, Clone, Default)]
struct ChunkedBodyState {
    phase: ChunkedPhase,
    line: Vec<u8>,
    decoded_tail: Vec<u8>,
}

/// Stateful chunked transfer rewriter for request bodies.
#[derive(Debug, Clone, Default)]
struct ChunkedRewriteState {
    parser: ChunkedBodyState,
    substitution_tail: Vec<u8>,
}

/// Stateful HTTP/2 client-to-server frame parser.
struct Http2State {
    preface_seen: bool,
    buffer: Vec<u8>,
    header_block: Option<Http2HeaderBlock>,
    /// Highest client-initiated stream id seen so far. New client streams must
    /// use strictly increasing ids; a reused id is a protocol violation.
    highest_client_stream_id: u32,
    open_request_streams: HashSet<u32>,
    data_tails: HashMap<u32, Vec<u8>>,
    request_summaries: HashMap<u32, RequestSummary>,
    decoder: HpackDecoder<'static>,
    encoder: HpackEncoder<'static>,
}

/// Accumulated HEADERS/CONTINUATION block for one stream.
struct Http2HeaderBlock {
    stream_id: u32,
    end_stream: bool,
    block: Vec<u8>,
}

/// Parsed HTTP/2 frame view.
struct Http2Frame<'a> {
    kind: u8,
    flags: u8,
    stream_id: u32,
    payload: &'a [u8],
    raw: &'a [u8],
}

type Http2Headers = Vec<(Vec<u8>, Vec<u8>)>;

/// Current chunked-body parser phase.
#[derive(Debug, Clone, Default)]
enum ChunkedPhase {
    /// Reading a chunk-size line.
    #[default]
    SizeLine,
    /// Reading exactly `remaining` chunk-data bytes.
    Data { remaining: usize },
    /// Reading the CRLF after chunk data.
    DataCrlf { seen_cr: bool },
    /// Reading trailer lines until the empty line.
    TrailerLine,
}

/// DNS-pinned destination identity for a proxied connection.
struct SecretHostIdentity<'a> {
    guest_ip: IpAddr,
    shared: &'a SharedState,
}

/// Authority rule applied to inspected HTTP metadata.
#[derive(Clone)]
enum HttpAuthorityValidator {
    /// Require every HTTP authority-bearing field to match this TLS SNI.
    Sni(String),
    /// Require every HTTP authority-bearing field to be allowed by egress policy.
    Policy {
        guest_dst: SocketAddr,
        network_policy: Arc<NetworkPolicy>,
        shared: Arc<SharedState>,
        /// Secret eligibility and passthrough are connection-scoped. Keep their
        /// proven host identity even when network policy also permits another host.
        secret_host: Option<String>,
    },
}

/// Parsed HTTP/1 request metadata needed for validation and framing.
struct HttpRequestMetadata {
    host_headers: Vec<String>,
    target_authority: Option<String>,
}

/// Supported request transfer-encoding after strict validation.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
enum TransferEncoding {
    Chunked,
}

/// HTTP request framing decision for a complete header block.
struct RequestFraming {
    state: HttpState,
    body_in_request: usize,
    body_substitution_allowed: bool,
}

/// Output from processing one chunked-body plaintext fragment.
struct ChunkedRewriteResult {
    output: Vec<u8>,
    body_end: Option<usize>,
}

/// Event emitted by the chunked transfer parser.
enum ChunkedBodyEvent<'a> {
    SizeLine(&'a [u8]),
    Payload(&'a [u8]),
    ZeroChunk,
    TrailerLine(&'a [u8]),
}

/// A secret that passed host matching for this connection.
struct EligibleSecret {
    placeholder: String,
    /// Resolved plaintext, wiped on drop so per-connection copies do not
    /// linger in freed memory.
    value: zeroize::Zeroizing<String>,
    substitute_headers: bool,
    /// When non-empty, restrict header substitution to these field names.
    header_fields: Vec<String>,
    substitute_query: bool,
    substitute_body: bool,
    require_tls_identity: bool,
}

/// A secret whose placeholder is not permitted on this connection.
struct IneligibleSecret {
    env_var: String,
    placeholder: String,
    action: BlockingAction,
}

/// Details about a blocked secret placeholder.
struct SecretViolationReport {
    action: BlockingAction,
    env_var: String,
    placeholder: String,
    protocol: RequestProtocol,
    location: RequestLocation,
    match_form: PlaceholderMatchForm,
    method: Option<String>,
    path: Option<String>,
    host: Option<String>,
    http2_stream_id: Option<u32>,
}

/// Minimal request metadata safe to include in violation logs.
#[derive(Clone, Default)]
struct RequestSummary {
    method: Option<String>,
    path: Option<String>,
    host: Option<String>,
}

/// Blocking action to take when an ineligible placeholder is detected.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
enum BlockingAction {
    Block,
    #[default]
    BlockAndLog,
    BlockAndTerminate,
}

/// Request protocol where a violation was detected.
#[derive(Debug, Clone, Copy)]
enum RequestProtocol {
    Http1,
    Http2,
    Opaque,
}

/// Request location where a placeholder matched.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum RequestLocation {
    Header,
    Query,
    BasicAuth,
    Body,
    ChunkMetadata,
    Trailer,
    Unknown,
}

/// Representation that matched the configured placeholder.
#[derive(Debug, Clone, Copy)]
enum PlaceholderMatchForm {
    Raw,
    PercentDecoded,
    JsonUnescaped,
    BasicAuthDecoded,
}

//--------------------------------------------------------------------------------------------------
// Methods
//--------------------------------------------------------------------------------------------------

impl EligibleSecret {
    /// Returns true if any of the header-side substitution scopes is enabled
    /// (`headers` or `query`).
    fn wants_header_injection(&self) -> bool {
        self.substitute_headers || self.substitute_query
    }

    /// Returns true when this secret may be substituted in a header with the
    /// given field name.
    fn header_field_allowed(&self, name: &[u8]) -> bool {
        header_field_allowed(self.substitute_headers, &self.header_fields, name)
    }

    /// Returns true when the current header bytes contain this secret's
    /// placeholder in a header-substitution scope.
    fn may_substitute_in_headers(&self, headers: &[u8]) -> bool {
        if !self.wants_header_injection() {
            return false;
        }

        let needle = self.placeholder.as_bytes();
        if (self.substitute_headers || self.substitute_query) && contains_bytes(headers, needle) {
            return true;
        }

        // Search decoded Basic auth credentials, not the raw header value.
        if self.substitute_headers {
            return basic_auth_decoded_contains(
                String::from_utf8_lossy(headers).as_ref(),
                &self.placeholder,
            );
        }

        false
    }

    /// Substitute this secret's placeholder in the headers portion, scoped by
    /// the secret's `headers` / `basic_auth` / `query` flags.
    fn substitute_in_headers(&self, headers: &str) -> String {
        let mut result = String::with_capacity(headers.len());
        for (i, line) in headers.split("\r\n").enumerate() {
            if i > 0 {
                result.push_str("\r\n");
            }
            match self.substitute_in_header_line(line, i == 0) {
                Some(s) => result.push_str(&s),
                None => result.push_str(line),
            }
        }
        result
    }

    /// Substitute this secret's placeholder in a single header line. Returns
    /// `None` if the line is not in scope for any of the requested substitution
    /// modes.
    fn substitute_in_header_line(&self, line: &str, is_request_line: bool) -> Option<String> {
        if is_request_line {
            return self
                .substitute_query
                .then(|| substitute_query_in_request_line(line, &self.placeholder, &self.value))
                .flatten();
        }

        if !self.header_field_allowed(header_field_name(line.as_bytes())) {
            return None;
        }

        if is_authorization_header(line)
            && let Some(replaced) = self.substitute_basic_auth_header(line)
        {
            return Some(replaced);
        }
        Some(line.replace(&self.placeholder, &self.value))
    }

    /// Decode `Basic <base64>` credentials, substitute the placeholder in the
    /// decoded `user:password`, and return the re-encoded line. Returns `None`
    /// if the line isn't `Basic` scheme or the decoded credentials don't
    /// contain the placeholder. Non-Basic schemes (e.g. `Bearer`) are handled
    /// by `substitute_headers` instead.
    fn substitute_basic_auth_header(&self, line: &str) -> Option<String> {
        let decoded = decode_basic_credentials(line)?;
        if !decoded.contains(&self.placeholder) {
            return None;
        }
        let (name, _) = line.split_once(':')?;
        let replaced = decoded.replace(&self.placeholder, &self.value);
        Some(format!(
            "{name}: Basic {}",
            BASE64.encode(replaced.as_bytes())
        ))
    }
}

impl BlockingAction {
    fn from_violation_action(action: &SecretViolationAction) -> Option<Self> {
        match action {
            SecretViolationAction::Block => Some(Self::Block),
            SecretViolationAction::BlockAndLog => Some(Self::BlockAndLog),
            SecretViolationAction::BlockAndTerminate => Some(Self::BlockAndTerminate),
        }
    }

    fn into_violation_action(self) -> SecretViolationAction {
        match self {
            Self::Block => SecretViolationAction::Block,
            Self::BlockAndLog => SecretViolationAction::BlockAndLog,
            Self::BlockAndTerminate => SecretViolationAction::BlockAndTerminate,
        }
    }
}

impl fmt::Display for BlockingAction {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let value = match self {
            Self::Block => "block",
            Self::BlockAndLog => "block-and-log",
            Self::BlockAndTerminate => "block-and-terminate",
        };
        f.write_str(value)
    }
}

impl fmt::Display for RequestProtocol {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let value = match self {
            Self::Http1 => "http/1.1",
            Self::Http2 => "http/2",
            Self::Opaque => "opaque",
        };
        f.write_str(value)
    }
}

impl fmt::Display for RequestLocation {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let value = match self {
            Self::Header => "header",
            Self::Query => "query",
            Self::BasicAuth => "authorization_basic",
            Self::Body => "body",
            Self::ChunkMetadata => "chunk_metadata",
            Self::Trailer => "trailer",
            Self::Unknown => "unknown",
        };
        f.write_str(value)
    }
}

impl fmt::Display for PlaceholderMatchForm {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        let value = match self {
            Self::Raw => "raw",
            Self::PercentDecoded => "percent_decoded",
            Self::JsonUnescaped => "json_unescaped",
            Self::BasicAuthDecoded => "basic_auth_decoded",
        };
        f.write_str(value)
    }
}

impl Default for Http2State {
    fn default() -> Self {
        Self {
            preface_seen: false,
            buffer: Vec::new(),
            header_block: None,
            highest_client_stream_id: 0,
            open_request_streams: HashSet::new(),
            data_tails: HashMap::new(),
            request_summaries: HashMap::new(),
            decoder: HpackDecoder::with_dynamic_size(4096),
            encoder: HpackEncoder::with_dynamic_size(4096),
        }
    }
}

impl SecretsHandler {
    /// Create a handler for a specific connection.
    ///
    /// Filters secrets by host matching against the SNI. Only secrets
    /// whose `allowed_hosts` match `sni` will be substituted.
    /// `tls_intercepted` indicates whether this is a MITM connection
    /// (true) or a bypass/plain connection (false).
    pub fn new(config: &SecretsConfig, sni: &str, tls_intercepted: bool) -> Self {
        Self::new_inner(config, sni, tls_intercepted, None, None, false)
    }

    /// Create a handler for a TLS-intercepted connection.
    ///
    /// Host-scoped secrets require both an SNI match and a DNS cache binding
    /// from the original guest destination IP to the allowed host.
    pub fn new_tls_intercepted(
        config: &SecretsConfig,
        sni: &str,
        guest_ip: IpAddr,
        shared: &SharedState,
    ) -> Self {
        Self::new_inner(
            config,
            sni,
            true,
            Some(SecretHostIdentity { guest_ip, shared }),
            Some(HttpAuthorityValidator::Sni(sni.to_string())),
            false,
        )
    }

    /// TLS-intercepted handler for connections tunnelled via HTTP CONNECT.
    ///
    /// The SNI is authoritative: the proxy already verified it against the
    /// CONNECT authority, so no DNS-cache pin is required.
    pub(crate) fn new_tls_intercepted_via_connect(config: &SecretsConfig, sni: &str) -> Self {
        Self::new_inner(
            config,
            sni,
            true,
            None,
            Some(HttpAuthorityValidator::Sni(sni.to_string())),
            false,
        )
    }

    /// Create a handler for a plain-HTTP (non-TLS) connection.
    ///
    /// Only substitutes secrets that have opted in with `require_tls_identity(false)`.
    /// Host matching and DNS-cache binding are still enforced.
    pub fn new_plain_http(
        config: &SecretsConfig,
        host: &str,
        guest_ip: IpAddr,
        shared: &SharedState,
    ) -> Self {
        Self::new_inner(
            config,
            host,
            false,
            Some(SecretHostIdentity { guest_ip, shared }),
            Some(HttpAuthorityValidator::Sni(host.to_string())),
            false,
        )
    }

    /// Create a plain-HTTP handler that enforces egress policy for each HTTP authority.
    pub(crate) fn new_plain_http_policy(
        config: &SecretsConfig,
        host: &str,
        guest_dst: SocketAddr,
        network_policy: Arc<NetworkPolicy>,
        shared: Arc<SharedState>,
    ) -> Self {
        let identity = (!host.is_empty()).then_some(SecretHostIdentity {
            guest_ip: guest_dst.ip(),
            shared: shared.as_ref(),
        });
        Self::new_inner(
            config,
            host,
            false,
            identity,
            Some(HttpAuthorityValidator::Policy {
                guest_dst,
                network_policy,
                shared: shared.clone(),
                secret_host: config.has_host_scoped_secrets().then(|| host.to_string()),
            }),
            false,
        )
    }

    /// Handler for a plain-HTTP connection with no usable Host header.
    ///
    /// The host can't be proven, so secrets are blocked unless every one is
    /// host-agnostic (`HostPattern::Any`) — only then is substitution safe.
    pub fn new_plain_http_invalid_host(config: &SecretsConfig) -> Self {
        let host_scoped = config
            .secrets
            .iter()
            .any(|secret| secret.allowed_hosts.iter().any(|h| *h != HostPattern::Any));

        Self::new_inner(config, "", false, None, None, host_scoped)
    }

    /// Handler for HTTP metadata that must never receive substituted secrets.
    ///
    /// This is used for proxy-owned CONNECT headers. Placeholders there are
    /// treated as violations according to their configured action unless a
    /// passthrough policy explicitly allows forwarding the placeholder.
    pub(crate) fn new_plain_http_untrusted_metadata(config: &SecretsConfig) -> Self {
        Self::new_inner(config, "", false, None, None, true)
    }

    fn new_inner(
        config: &SecretsConfig,
        sni: &str,
        tls_intercepted: bool,
        identity: Option<SecretHostIdentity<'_>>,
        http_authority: Option<HttpAuthorityValidator>,
        force_ineligible: bool,
    ) -> Self {
        let mut eligible_for_substitution = Vec::new();
        let mut ineligible_for_substitution = Vec::new();
        let mut max_detection_window_len = 0;
        let mut max_body_placeholder_len = 0;
        let mut placeholder_limit_exceeded = false;

        for secret in &config.secrets {
            if secret.placeholder.len() > MAX_SECRET_PLACEHOLDER_BYTES {
                placeholder_limit_exceeded = true;
            }
            max_detection_window_len = max_detection_window_len.max(max_placeholder_detection_len(
                secret.placeholder.len().min(MAX_SECRET_PLACEHOLDER_BYTES),
            ));

            let host_allowed =
                !force_ineligible && secret_host_allowed(secret, sni, identity.as_ref());

            // A verified destination trusted with the credential may also receive
            // its placeholder unchanged outside enabled substitution locations.
            if host_allowed {
                if secret.substitution.body {
                    max_body_placeholder_len = max_body_placeholder_len
                        .max(secret.placeholder.len().min(MAX_SECRET_PLACEHOLDER_BYTES));
                }
                eligible_for_substitution.push(EligibleSecret {
                    placeholder: secret.placeholder.clone(),
                    value: secret.value.clone(),
                    substitute_headers: secret.substitution.headers,
                    header_fields: secret.substitution.header_fields.clone(),
                    substitute_query: secret.substitution.query,
                    substitute_body: secret.substitution.body,
                    require_tls_identity: secret.require_tls_identity,
                });
                if !secret.require_tls_identity || tls_intercepted {
                    continue;
                }
            }

            if secret
                .passthrough_hosts
                .iter()
                .any(|pattern| host_pattern_allowed(pattern, sni, identity.as_ref()))
            {
                continue;
            }

            // A per-secret blocking action overrides the global passthrough default.
            // Per-secret passthrough falls back to the global policy off its hosts.
            if secret.violation_action.is_none()
                && config.passthrough_hosts.as_ref().is_some_and(|hosts| {
                    hosts
                        .iter()
                        .any(|pattern| host_pattern_allowed(pattern, sni, identity.as_ref()))
                })
            {
                continue;
            }

            let action = secret
                .violation_action
                .as_ref()
                .unwrap_or(&config.violation_action);
            ineligible_for_substitution.push(IneligibleSecret {
                env_var: secret.env_var.clone(),
                placeholder: secret.placeholder.clone(),
                action: BlockingAction::from_violation_action(action).unwrap_or_default(),
            });
        }

        // Duplicate declarations must not revoke the placeholder permission
        // granted by a declaration eligible on this verified connection.
        ineligible_for_substitution.retain(|ineligible| {
            !eligible_for_substitution.iter().any(|eligible| {
                ineligible.placeholder == eligible.placeholder
                    && (!eligible.require_tls_identity || tls_intercepted)
            })
        });

        Self {
            eligible_for_substitution,
            ineligible_for_substitution,
            tls_intercepted,
            sni: sni.to_string(),
            guest_dst: None,
            max_detection_window_len,
            max_body_placeholder_len,
            placeholder_limit_exceeded,
            prev_tail: Vec::new(),
            http_state: HttpState::AwaitingHeaders,
            http_authority,
            opaque: false,
            http1_request_summary: None,
            http_pending: Vec::new(),
            unsupported_body_tail: Vec::new(),
            http2_state: None,
            http1_requests: 0,
            http1_response_allowed: false,
            http1_violation: false,
        }
    }

    /// Attach the original guest destination for structured violation logs.
    pub fn with_guest_dst(mut self, guest_dst: SocketAddr) -> Self {
        self.guest_dst = Some(guest_dst);
        self
    }

    /// Substitute secrets in plaintext data (guest → server direction).
    ///
    /// Splits the HTTP message on `\r\n\r\n` to scope substitution:
    /// - `headers`: substitutes in the header portion (before boundary)
    /// - `basic_auth`: substitutes in Authorization headers specifically
    /// - `query`: substitutes in the request line (first line, query portion)
    /// - `body`: substitutes in the body portion (after boundary)
    ///
    /// Returns the violation action if a placeholder is detected going to a
    /// disallowed host.
    pub fn substitute<'a>(
        &mut self,
        data: &'a [u8],
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        if self.placeholder_limit_exceeded {
            tracing::error!(
                "secret configuration rejected: placeholder exceeds {} bytes",
                MAX_SECRET_PLACEHOLDER_BYTES
            );
            return Err(SecretViolationAction::Block);
        }

        if self.opaque {
            return self.scan_opaque(data);
        }

        if self.http2_state.is_some() {
            return self.substitute_http2(data);
        }

        // Body bytes cannot start a new protocol, even when they resemble an
        // HTTP/2 preface. Consume them according to the established framing.
        match std::mem::replace(&mut self.http_state, HttpState::AwaitingHeaders) {
            HttpState::BufferingBody { remaining } => {
                return self.substitute_buffered_body(data, remaining);
            }
            HttpState::InBody { remaining } => {
                return self.substitute_body_chunk(data, remaining);
            }
            HttpState::InChunkedBody { state } => {
                return self.substitute_chunked_body_chunk(data, state);
            }
            HttpState::InChunkedRewriteBody { state } => {
                return self.substitute_chunked_rewrite_body_chunk(data, state);
            }
            HttpState::AwaitingHeaders => {}
        }

        if self.http_pending.is_empty() {
            if has_complete_http2_preface(data) {
                self.http2_state = Some(Http2State::default());
                return self.substitute_http2(data);
            }
            if is_http2_preface_prefix(data) {
                self.http_pending.extend_from_slice(data);
                return Ok(Cow::Owned(Vec::new()));
            }
        } else {
            let mut pending_prefix = Vec::with_capacity(self.http_pending.len() + data.len());
            pending_prefix.extend_from_slice(&self.http_pending);
            pending_prefix.extend_from_slice(data);
            if has_complete_http2_preface(&pending_prefix) {
                self.http_pending.clear();
                self.http2_state = Some(Http2State::default());
                return self.substitute_http2(&pending_prefix);
            }
            if is_http2_preface_prefix(&pending_prefix) {
                self.http_pending = pending_prefix;
                return Ok(Cow::Owned(Vec::new()));
            }
        }

        if !self.http_pending.is_empty() {
            self.http_pending.extend_from_slice(data);
            let header_boundary = find_header_boundary(&self.http_pending);
            if http_request_line_has_binary_control(&self.http_pending) {
                let pending = std::mem::take(&mut self.http_pending);
                let output = self.scan_opaque(&pending)?.into_owned();
                return Ok(Cow::Owned(output));
            }
            if self.http_pending.len() > MAX_HTTP_HEADER_BYTES {
                return Err(SecretViolationAction::Block);
            }
            if header_boundary.is_none() {
                if first_line_is_not_http_request(&self.http_pending)
                    || !looks_like_http_request_prefix(&self.http_pending)
                {
                    let pending = std::mem::take(&mut self.http_pending);
                    let output = self.substitute_headers(&pending)?.into_owned();
                    return Ok(Cow::Owned(output));
                }
                return Ok(Cow::Owned(Vec::new()));
            }

            let pending = std::mem::take(&mut self.http_pending);
            let output = self.substitute_headers(&pending)?.into_owned();
            return Ok(Cow::Owned(output));
        }

        if http_request_line_has_binary_control(data) {
            return self.scan_opaque(data);
        }

        if find_header_boundary(data).is_none()
            && looks_like_http_request_prefix(data)
            && !first_line_is_not_http_request(data)
        {
            if data.len() > MAX_HTTP_HEADER_BYTES {
                return Err(SecretViolationAction::Block);
            }
            self.http_pending.extend_from_slice(data);
            return Ok(Cow::Owned(Vec::new()));
        }

        self.substitute_headers(data)
    }

    /// Build a secret-policy denial only for the first recognized HTTP/1 request.
    /// The relay must also ensure no upstream response has reached the guest.
    pub(crate) fn http1_violation_response(&self, message: &str) -> Option<Vec<u8>> {
        (self.http1_response_allowed && self.http1_violation)
            .then(|| secret_http_forbidden_response(message, &self.sni))
    }

    fn scan_opaque<'a>(&mut self, data: &'a [u8]) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        // Fail closed when invalid bytes still resemble an HTTP request that
        // requires authority validation. Conclusively opaque streams rely on
        // the proxy's connection-level placeholder policy.
        if !self.opaque && self.http_authority.is_some() && opaque_prefix_might_be_http(data) {
            return Err(SecretViolationAction::Block);
        }
        self.opaque = true;
        let report = detect_blocking_action_with_tail(
            &self.ineligible_for_substitution,
            &self.prev_tail,
            data,
            "",
            RequestProtocol::Opaque,
            RequestLocation::Unknown,
            None,
        );
        self.apply_blocking_action(report)?;
        self.update_opaque_tail(data);
        Ok(Cow::Borrowed(data))
    }

    fn update_opaque_tail(&mut self, data: &[u8]) {
        let mut scan = Vec::with_capacity(self.prev_tail.len() + data.len());
        scan.extend_from_slice(&self.prev_tail);
        scan.extend_from_slice(data);

        let base_len = self
            .max_detection_window_len
            .max(AUTHORIZATION_HEADER_NAME.len() + 2)
            .saturating_sub(1);
        let authorization_line = scan
            .windows(AUTHORIZATION_HEADER_NAME.len())
            .rposition(|window| window.eq_ignore_ascii_case(AUTHORIZATION_HEADER_NAME))
            .and_then(|start| {
                let line = &scan[start..];
                (!line.windows(2).any(|window| window == b"\r\n")).then_some(line)
            });

        if let Some(line) = authorization_line
            && line.len() > MAX_HTTP_HEADER_BYTES
            && let Some(encoded) = opaque_basic_auth_payload(line)
        {
            let mut suffix_start = encoded.len().saturating_sub(base_len);
            suffix_start -= suffix_start % 4;
            self.prev_tail.clear();
            self.prev_tail.extend_from_slice(AUTHORIZATION_HEADER_NAME);
            self.prev_tail.extend_from_slice(b" Basic ");
            self.prev_tail.extend_from_slice(&encoded[suffix_start..]);
            return;
        }

        let tail_len = authorization_line
            .filter(|line| line.len() <= MAX_HTTP_HEADER_BYTES)
            .map_or(base_len, <[u8]>::len);
        update_tail_buffer(&mut self.prev_tail, data, tail_len.max(base_len));
    }

    fn substitute_http2<'a>(
        &mut self,
        data: &[u8],
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        let mut state = self.http2_state.take().unwrap_or_default();
        let output = state.process(self, data)?;
        self.http2_state = Some(state);
        Ok(Cow::Owned(output))
    }

    fn substitute_headers<'a>(
        &mut self,
        data: &'a [u8],
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        self.http1_requests = self.http1_requests.saturating_add(1);
        self.http1_response_allowed =
            self.http1_requests == 1 && classify_http_request(data) == Some(true);
        self.substitute_ready(data)
    }

    fn substitute_ready<'a>(
        &mut self,
        data: &'a [u8],
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        // Split raw bytes at the header boundary BEFORE converting to owned strings.
        // This avoids position shifts from from_utf8_lossy replacement chars.
        let boundary = find_header_boundary(data);
        let (header_bytes, after_headers) = match boundary {
            Some(pos) => (&data[..pos], &data[pos..]),
            None => (data, &[] as &[u8]),
        };

        // A single chunk may carry headers + body + the start of the next
        // pipelined request. Compute how many post-boundary bytes belong to
        // THIS request; the rest is spillover that gets its own recursive
        // pass through `substitute()` so its headers are substituted and
        // its violations are detected.
        let mut body_substitution_allowed = false;
        let (body_bytes, spillover) = if boundary.is_some() {
            let header_text = String::from_utf8_lossy(header_bytes);
            let request_summary = http1_request_summary(header_text.as_ref());
            if let Some(validator) = self.http_authority.as_ref()
                && let Some(metadata) = parse_http_request_metadata(header_bytes)?
            {
                validate_http1_authority(&metadata, validator)?;
            }

            let transfer_encoding = parse_transfer_encoding(header_text.as_ref())?;
            if transfer_encoding.is_some() && parse_content_length(header_text.as_ref())?.is_some()
            {
                return Err(SecretViolationAction::Block);
            }

            if transfer_encoding == Some(TransferEncoding::Chunked) {
                return self.substitute_chunked_ready(
                    data,
                    header_bytes,
                    after_headers,
                    header_text.as_ref(),
                );
            }

            let framing = next_state_after_headers(header_text.as_ref(), after_headers)?;
            if self.needs_body_substitution()
                && framing.body_substitution_allowed
                && content_length_exceeds_buffer_limit(header_text.as_ref())?
            {
                return Err(SecretViolationAction::Block);
            }
            if self.needs_body_substitution()
                && framing.body_substitution_allowed
                && let HttpState::InBody { remaining } = &framing.state
            {
                self.http_pending.extend_from_slice(data);
                self.http1_request_summary = Some(request_summary);
                self.http_state = HttpState::BufferingBody {
                    remaining: *remaining,
                };
                return Ok(Cow::Owned(Vec::new()));
            }

            body_substitution_allowed = framing.body_substitution_allowed;
            self.http_state = framing.state;
            self.http1_request_summary = if matches!(self.http_state, HttpState::InBody { .. }) {
                Some(request_summary)
            } else {
                None
            };
            after_headers.split_at(framing.body_in_request)
        } else {
            (after_headers, &[] as &[u8])
        };

        // Everything from `data` belonging to this request, headers and body.
        let this_request = &data[..header_bytes.len() + body_bytes.len()];

        // Check for disallowed placeholders before forwarding or substituting data.
        self.apply_blocking_action(self.detect_blocking_action(
            this_request,
            String::from_utf8_lossy(header_bytes).as_ref(),
            RequestLocation::Unknown,
        ))?;
        if !body_substitution_allowed {
            self.block_unsupported_body_placeholder(&self.unsupported_body_tail, body_bytes)?;
            if matches!(self.http_state, HttpState::InBody { .. }) {
                update_tail_buffer(
                    &mut self.unsupported_body_tail,
                    body_bytes,
                    self.max_body_placeholder_len.saturating_sub(1),
                );
            } else {
                self.unsupported_body_tail.clear();
            }
        } else {
            self.unsupported_body_tail.clear();
        }
        if matches!(self.http_state, HttpState::InBody { .. }) {
            self.update_tail(body_bytes);
        } else {
            // Do not carry a completed request's bytes into the next request's
            // location classification.
            self.prev_tail.clear();
        }

        if self.eligible_for_substitution.is_empty() {
            // No substitution needed; pass this request through and let the
            // recursive call handle the spillover (if any).
            return self.append_pipelined_spillover(data, this_request, spillover);
        }

        // Start with borrowed bytes; allocate only when a substitution is needed.
        let mut header_str = None;
        let mut body = None;

        for secret in &self.eligible_for_substitution {
            // Skip secrets that require TLS identity on non-intercepted connections.
            if secret.require_tls_identity && !self.tls_intercepted {
                continue;
            }

            // Header substitution still uses string helpers after a scoped match.
            if secret.may_substitute_in_headers(header_bytes) {
                let current = header_str
                    .get_or_insert_with(|| String::from_utf8_lossy(header_bytes).into_owned());
                *current = secret.substitute_in_headers(current);
            }

            // Body substitution works on bytes so encoded payloads stay valid.
            if body_substitution_allowed && secret.substitute_body {
                let source = body.as_deref().unwrap_or(body_bytes);
                if let Some(replaced) = replace_bytes(
                    source,
                    secret.placeholder.as_bytes(),
                    secret.value.as_bytes(),
                ) {
                    body = Some(replaced);
                }
            }
        }

        let header_changed = header_str
            .as_ref()
            .is_some_and(|headers| headers.as_bytes() != header_bytes);
        let body_changed = body.is_some();

        // No header or body replacement was produced. Forward this request
        // unchanged and recurse on the spillover.
        if !header_changed && !body_changed {
            return self.append_pipelined_spillover(data, this_request, spillover);
        }

        let header_len = header_str
            .as_ref()
            .map_or(header_bytes.len(), |headers| headers.len());
        let body_len = body.as_ref().map_or(body_bytes.len(), Vec::len);
        let mut output = Vec::with_capacity(header_len + body_len + spillover.len());

        let body_bytes_out = body.as_deref().unwrap_or(body_bytes);
        // Update Content-Length only when body substitution changed the size.
        if body_changed && body_bytes_out.len() != body_bytes.len() {
            let headers = match header_str {
                Some(headers) => update_content_length(&headers, body_bytes_out.len()),
                None => update_content_length(
                    String::from_utf8_lossy(header_bytes).as_ref(),
                    body_bytes_out.len(),
                ),
            };
            output.extend_from_slice(headers.as_bytes());
        } else if let Some(headers) = header_str {
            output.extend_from_slice(headers.as_bytes());
        } else {
            output.extend_from_slice(header_bytes);
        }

        output.extend_from_slice(body_bytes_out);

        if !spillover.is_empty() {
            let next_out = self.substitute(spillover)?;
            output.extend_from_slice(next_out.as_ref());
        }
        Ok(Cow::Owned(output))
    }

    fn substitute_buffered_body<'a>(
        &mut self,
        data: &'a [u8],
        remaining: usize,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        let take = remaining.min(data.len());
        self.http_pending.extend_from_slice(&data[..take]);

        if take < remaining {
            self.http_state = HttpState::BufferingBody {
                remaining: remaining - take,
            };
            return Ok(Cow::Owned(Vec::new()));
        }

        self.http_state = HttpState::AwaitingHeaders;
        let request = std::mem::take(&mut self.http_pending);
        let mut output = self.substitute_ready(&request)?.into_owned();

        if data.len() > take {
            let spillover = self.substitute(&data[take..])?;
            output.extend_from_slice(spillover.as_ref());
        }

        Ok(Cow::Owned(output))
    }

    /// Forward `this_request` (an unchanged subslice of `parent`) and
    /// recursively `substitute()` the `spillover` (the start of a
    /// pipelined next request). When both halves pass through unchanged,
    /// returns `Cow::Borrowed(parent)` for zero-copy.
    fn append_pipelined_spillover<'a>(
        &mut self,
        parent: &'a [u8],
        this_request: &'a [u8],
        spillover: &'a [u8],
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        if spillover.is_empty() {
            return Ok(Cow::Borrowed(parent));
        }
        let next_out = self.substitute(spillover)?;
        if let Cow::Borrowed(b) = &next_out
            && std::ptr::eq(b.as_ptr(), spillover.as_ptr())
            && b.len() == spillover.len()
        {
            // Spillover passed through unchanged; both halves are contiguous
            // subslices of `parent`, so the whole parent can be returned
            // borrowed.
            return Ok(Cow::Borrowed(parent));
        }
        let next_bytes = next_out.as_ref();
        let mut out = Vec::with_capacity(this_request.len() + next_bytes.len());
        out.extend_from_slice(this_request);
        out.extend_from_slice(next_bytes);
        Ok(Cow::Owned(out))
    }

    /// Handle a chunked request whose headers are complete in `parent`.
    fn substitute_chunked_ready<'a>(
        &mut self,
        parent: &'a [u8],
        header_bytes: &'a [u8],
        after_headers: &'a [u8],
        headers: &str,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        if self.needs_body_substitution() && !has_non_identity_content_encoding(headers) {
            return self.substitute_chunked_rewrite_ready(header_bytes, after_headers, headers);
        }

        // Chunked parsing below owns every post-header byte. Scan the complete
        // header block independently so its bytes cannot contaminate payload or
        // framing-metadata detection across a later network read.
        self.http1_request_summary = Some(http1_request_summary(headers));
        self.apply_blocking_action(self.detect_http1_fragment_blocking_action(
            &[],
            header_bytes,
            headers,
            RequestLocation::Unknown,
        ))?;
        self.prev_tail.clear();

        let mut state = ChunkedBodyState::default();
        let body_end =
            self.consume_chunked_body_with_violation_detection(&mut state, after_headers)?;
        let (body_part, spillover) = match body_end {
            Some(end) => after_headers.split_at(end),
            None => (after_headers, &[] as &[u8]),
        };
        let this_request = &parent[..header_bytes.len() + body_part.len()];

        self.http_state = if body_end.is_some() {
            self.http1_request_summary = None;
            HttpState::AwaitingHeaders
        } else {
            HttpState::InChunkedBody { state }
        };

        if let Some(headers) = self.substitute_header_bytes(header_bytes) {
            let mut output = Vec::with_capacity(headers.len() + body_part.len() + spillover.len());
            output.extend_from_slice(headers.as_bytes());
            output.extend_from_slice(body_part);
            if !spillover.is_empty() {
                let next_out = self.substitute(spillover)?;
                output.extend_from_slice(next_out.as_ref());
            }
            return Ok(Cow::Owned(output));
        }

        self.append_pipelined_spillover(parent, this_request, spillover)
    }

    /// Handle a chunked request that needs body substitution.
    fn substitute_chunked_rewrite_ready<'a>(
        &mut self,
        header_bytes: &'a [u8],
        after_headers: &'a [u8],
        headers: &str,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        // Keep request headers and chunked framing in separate detector
        // domains. The parser events below scan payload and metadata exactly
        // once using their own state.
        self.http1_request_summary = Some(http1_request_summary(headers));
        self.apply_blocking_action(self.detect_http1_fragment_blocking_action(
            &[],
            header_bytes,
            headers,
            RequestLocation::Unknown,
        ))?;
        self.prev_tail.clear();

        let mut state = ChunkedRewriteState::default();
        let rewrite = self.rewrite_chunked_body_part(&mut state, after_headers)?;
        let spillover = match rewrite.body_end {
            Some(end) => &after_headers[end..],
            None => &[] as &[u8],
        };

        self.http_state = if rewrite.body_end.is_some() {
            self.http1_request_summary = None;
            HttpState::AwaitingHeaders
        } else {
            HttpState::InChunkedRewriteBody { state }
        };

        let header_len = header_bytes.len();
        let header_out = self.substitute_header_bytes(header_bytes);
        let mut output = Vec::with_capacity(
            header_out
                .as_ref()
                .map_or(header_len, |headers| headers.len())
                + rewrite.output.len()
                + spillover.len(),
        );
        if let Some(headers) = header_out {
            output.extend_from_slice(headers.as_bytes());
        } else {
            output.extend_from_slice(header_bytes);
        }
        output.extend_from_slice(&rewrite.output);

        if !spillover.is_empty() {
            let next_out = self.substitute(spillover)?;
            output.extend_from_slice(next_out.as_ref());
        }

        Ok(Cow::Owned(output))
    }

    /// Handle a chunk that is the continuation of the current request's
    /// body (no headers present at the start). The body bytes are
    /// forwarded as-is after a violation scan. If the body ends inside
    /// this chunk and the remaining bytes are a pipelined next request,
    /// they are recursively dispatched through `substitute()` so their
    /// headers are substituted and their violations are detected.
    ///
    /// Body substitution across chunks is unsupported (would require
    /// rewriting Content-Length in already-forwarded headers).
    fn substitute_body_chunk<'a>(
        &mut self,
        data: &'a [u8],
        remaining: usize,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        // Determine where this request's body ends inside the chunk.
        //
        // Content-Length framing splits at `remaining`. Trailing bytes are a
        // pipelined next request.
        let body_end = (data.len() >= remaining).then_some(remaining);
        let (body_part, spillover) = match body_end {
            Some(end) => data.split_at(end),
            None => (data, &[] as &[u8]),
        };

        self.block_unsupported_body_placeholder(&self.unsupported_body_tail, body_part)?;
        self.apply_blocking_action(self.detect_blocking_action(
            body_part,
            "",
            RequestLocation::Body,
        ))?;
        if body_end.is_some() {
            self.prev_tail.clear();
        } else {
            self.update_tail(body_part);
        }

        // Advance framing state. If the body completes within this chunk,
        // the spillover below is the start of a fresh request.
        self.http_state = match body_end {
            Some(_) => {
                self.http1_request_summary = None;
                self.unsupported_body_tail.clear();
                HttpState::AwaitingHeaders
            }
            None => {
                update_tail_buffer(
                    &mut self.unsupported_body_tail,
                    body_part,
                    self.max_body_placeholder_len.saturating_sub(1),
                );
                HttpState::InBody {
                    remaining: remaining - body_part.len(),
                }
            }
        };

        self.append_pipelined_spillover(data, body_part, spillover)
    }

    /// Handle continuation bytes for a chunked request body.
    fn substitute_chunked_body_chunk<'a>(
        &mut self,
        data: &'a [u8],
        mut state: ChunkedBodyState,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        let body_end = self.consume_chunked_body_with_violation_detection(&mut state, data)?;
        let (body_part, spillover) = match body_end {
            Some(end) => data.split_at(end),
            None => (data, &[] as &[u8]),
        };

        self.http_state = if body_end.is_some() {
            self.http1_request_summary = None;
            HttpState::AwaitingHeaders
        } else {
            HttpState::InChunkedBody { state }
        };

        self.append_pipelined_spillover(data, body_part, spillover)
    }

    /// Handle continuation bytes for a chunked request body that is being
    /// decoded and re-encoded for body substitution.
    fn substitute_chunked_rewrite_body_chunk<'a>(
        &mut self,
        data: &'a [u8],
        mut state: ChunkedRewriteState,
    ) -> Result<Cow<'a, [u8]>, SecretViolationAction> {
        let rewrite = self.rewrite_chunked_body_part(&mut state, data)?;
        let spillover = match rewrite.body_end {
            Some(end) => &data[end..],
            None => &[] as &[u8],
        };

        self.http_state = if rewrite.body_end.is_some() {
            self.http1_request_summary = None;
            HttpState::AwaitingHeaders
        } else {
            HttpState::InChunkedRewriteBody { state }
        };

        let mut output = rewrite.output;
        if !spillover.is_empty() {
            let next_out = self.substitute(spillover)?;
            output.extend_from_slice(next_out.as_ref());
        }

        Ok(Cow::Owned(output))
    }

    /// Returns true if this connection needs no secret substitution or violation detection.
    pub fn is_empty(&self) -> bool {
        self.http_authority.is_none()
            && self.http_pending.is_empty()
            && self.unsupported_body_tail.is_empty()
            && self.http1_request_summary.is_none()
            && self.http2_state.is_none()
            && matches!(self.http_state, HttpState::AwaitingHeaders)
            && self.eligible_for_substitution.is_empty()
            && self.ineligible_for_substitution.is_empty()
    }

    fn needs_body_substitution(&self) -> bool {
        self.eligible_for_substitution.iter().any(|secret| {
            secret.substitute_body && (!secret.require_tls_identity || self.tls_intercepted)
        })
    }

    fn block_unsupported_body_placeholder(
        &self,
        prev_tail: &[u8],
        data: &[u8],
    ) -> Result<(), SecretViolationAction> {
        if self.contains_eligible_body_placeholder(prev_tail, data) {
            tracing::warn!(
                "secret substitution in this request body is unsupported; blocking placeholder"
            );
            return Err(SecretViolationAction::Block);
        }
        Ok(())
    }

    fn contains_eligible_body_placeholder(&self, prev_tail: &[u8], data: &[u8]) -> bool {
        if !self.needs_body_substitution() {
            return false;
        }

        let scan_buf: Cow<[u8]> = if prev_tail.is_empty() {
            Cow::Borrowed(data)
        } else {
            let mut stitched = Vec::with_capacity(prev_tail.len() + data.len());
            stitched.extend_from_slice(prev_tail);
            stitched.extend_from_slice(data);
            Cow::Owned(stitched)
        };
        let scan = scan_buf.as_ref();
        self.eligible_for_substitution.iter().any(|secret| {
            secret.substitute_body
                && !secret.placeholder.is_empty()
                && (!secret.require_tls_identity || self.tls_intercepted)
                && contains_bytes(scan, secret.placeholder.as_bytes())
        })
    }

    fn substitute_http2_headers(&self, headers: &mut [(Vec<u8>, Vec<u8>)]) {
        for secret in &self.eligible_for_substitution {
            if secret.require_tls_identity && !self.tls_intercepted {
                continue;
            }

            for (name, value) in headers.iter_mut() {
                let is_pseudo = name.starts_with(b":");
                let header_allowed = !is_pseudo && secret.header_field_allowed(name);

                if name.eq_ignore_ascii_case(b":path")
                    && secret.substitute_query
                    && let Ok(path) = std::str::from_utf8(value)
                    && let Some(replaced) =
                        substitute_query_in_target(path, &secret.placeholder, &secret.value)
                {
                    *value = replaced.into_bytes();
                }

                if header_allowed
                    && name.eq_ignore_ascii_case(b"authorization")
                    && let Ok(header_value) = std::str::from_utf8(value)
                    && let Some(replaced) = substitute_basic_auth_value(
                        header_value,
                        &secret.placeholder,
                        &secret.value,
                    )
                {
                    *value = replaced.into_bytes();
                }

                if header_allowed && contains_bytes(value, secret.placeholder.as_bytes()) {
                    let replaced =
                        String::from_utf8_lossy(value).replace(&secret.placeholder, &secret.value);
                    *value = replaced.into_bytes();
                }
            }
        }
    }

    fn substitute_header_bytes(&self, header_bytes: &[u8]) -> Option<String> {
        let mut header_str: Option<String> = None;
        for secret in &self.eligible_for_substitution {
            if secret.require_tls_identity && !self.tls_intercepted {
                continue;
            }
            if secret.may_substitute_in_headers(header_bytes) {
                let current = header_str
                    .get_or_insert_with(|| String::from_utf8_lossy(header_bytes).into_owned());
                *current = secret.substitute_in_headers(current);
            }
        }

        header_str.filter(|headers| headers.as_bytes() != header_bytes)
    }

    fn consume_chunked_body_with_violation_detection(
        &mut self,
        state: &mut ChunkedBodyState,
        data: &[u8],
    ) -> Result<Option<usize>, SecretViolationAction> {
        let mut decoded_tail = std::mem::take(&mut state.decoded_tail);
        let body_end = process_chunked_body(state, data, |event| {
            match event {
                ChunkedBodyEvent::SizeLine(line) => {
                    self.apply_chunked_metadata_policy(line, RequestLocation::ChunkMetadata)?;
                }
                ChunkedBodyEvent::Payload(payload) => {
                    self.block_unsupported_body_placeholder(&decoded_tail, payload)?;
                    self.apply_blocking_action(self.detect_http1_fragment_blocking_action(
                        &decoded_tail,
                        payload,
                        "",
                        RequestLocation::Body,
                    ))?;
                    update_tail_buffer(
                        &mut decoded_tail,
                        payload,
                        self.max_detection_window_len.saturating_sub(1),
                    );
                }
                ChunkedBodyEvent::ZeroChunk => {}
                ChunkedBodyEvent::TrailerLine(line) => {
                    self.apply_chunked_metadata_policy(line, RequestLocation::Trailer)?;
                }
            }
            Ok(())
        });
        state.decoded_tail = decoded_tail;
        body_end
    }

    fn rewrite_chunked_body_part(
        &mut self,
        state: &mut ChunkedRewriteState,
        data: &[u8],
    ) -> Result<ChunkedRewriteResult, SecretViolationAction> {
        let mut output = Vec::new();
        let mut decoded_tail = std::mem::take(&mut state.parser.decoded_tail);
        let mut substitution_tail = std::mem::take(&mut state.substitution_tail);

        let body_end = process_chunked_body(&mut state.parser, data, |event| {
            match event {
                ChunkedBodyEvent::SizeLine(line) => {
                    self.apply_chunked_metadata_policy(line, RequestLocation::ChunkMetadata)?;
                }
                ChunkedBodyEvent::Payload(payload) => {
                    self.apply_blocking_action(self.detect_http1_fragment_blocking_action(
                        &decoded_tail,
                        payload,
                        "",
                        RequestLocation::Body,
                    ))?;
                    update_tail_buffer(
                        &mut decoded_tail,
                        payload,
                        self.max_detection_window_len.saturating_sub(1),
                    );
                    self.append_rewritten_chunked_payload(
                        &mut substitution_tail,
                        payload,
                        &mut output,
                    );
                }
                ChunkedBodyEvent::ZeroChunk => {
                    self.flush_rewritten_chunked_payload(&mut substitution_tail, &mut output);
                    output.extend_from_slice(b"0\r\n");
                }
                ChunkedBodyEvent::TrailerLine(trailer_line) => {
                    self.apply_chunked_metadata_policy(trailer_line, RequestLocation::Trailer)?;
                    output.extend_from_slice(trailer_line);
                }
            }
            Ok(())
        })?;

        state.parser.decoded_tail = decoded_tail;
        state.substitution_tail = substitution_tail;

        Ok(ChunkedRewriteResult { output, body_end })
    }

    fn append_rewritten_chunked_payload(
        &self,
        substitution_tail: &mut Vec<u8>,
        payload: &[u8],
        output: &mut Vec<u8>,
    ) {
        substitution_tail.extend_from_slice(payload);
        let carry_len = self.max_body_placeholder_len.saturating_sub(1);
        self.append_rewritten_chunked_prefix(substitution_tail, carry_len, output);
    }

    fn flush_rewritten_chunked_payload(
        &self,
        substitution_tail: &mut Vec<u8>,
        output: &mut Vec<u8>,
    ) {
        self.append_rewritten_chunked_prefix(substitution_tail, 0, output);
    }

    fn append_rewritten_chunked_prefix(
        &self,
        substitution_tail: &mut Vec<u8>,
        keep_len: usize,
        output: &mut Vec<u8>,
    ) {
        let safe_len = substitution_tail.len().saturating_sub(keep_len);
        if safe_len == 0 {
            return;
        }

        let mut cursor = 0;
        let mut chunk_payload = Vec::with_capacity(safe_len);
        while cursor < safe_len {
            if let Some(secret) = self.matching_body_secret_at(&substitution_tail[cursor..]) {
                chunk_payload.extend_from_slice(secret.value.as_bytes());
                cursor += secret.placeholder.len();
            } else {
                chunk_payload.push(substitution_tail[cursor]);
                cursor += 1;
            }
        }

        let kept = substitution_tail.split_off(cursor);
        *substitution_tail = kept;
        append_chunk(output, &chunk_payload);
    }

    fn matching_body_secret_at(&self, data: &[u8]) -> Option<&EligibleSecret> {
        self.eligible_for_substitution.iter().find(|secret| {
            secret.substitute_body
                && !secret.placeholder.is_empty()
                && (!secret.require_tls_identity || self.tls_intercepted)
                && data.starts_with(secret.placeholder.as_bytes())
        })
    }

    fn apply_blocking_action(
        &mut self,
        report: Option<SecretViolationReport>,
    ) -> Result<(), SecretViolationAction> {
        let Some(report) = report else {
            return Ok(());
        };

        let action = report.action;
        self.http1_violation = matches!(report.protocol, RequestProtocol::Http1)
            && matches!(report.method.as_deref(), Some(method) if method != "HEAD" && method != "CONNECT");

        self.log_violation(&report);
        Err(action.into_violation_action())
    }

    fn log_violation(&self, report: &SecretViolationReport) {
        if matches!(report.action, BlockingAction::Block) {
            return;
        }

        let host = report.host.as_deref().unwrap_or("");
        let method = report.method.as_deref().unwrap_or("");
        let path = report.path.as_deref().unwrap_or("");
        let guest_dst = self
            .guest_dst
            .map(|dst| dst.to_string())
            .unwrap_or_default();
        let http2_stream_id = report
            .http2_stream_id
            .map(|id| id.to_string())
            .unwrap_or_default();

        match report.action {
            BlockingAction::Block => {}
            BlockingAction::BlockAndLog => tracing::warn!(
                action = %report.action,
                secret_env_var = %report.env_var,
                placeholder = %report.placeholder,
                protocol = %report.protocol,
                sni = %self.sni,
                host = %host,
                method = %method,
                path = %path,
                location = %report.location,
                match_form = %report.match_form,
                guest_dst = %guest_dst,
                http2_stream_id = %http2_stream_id,
                "secret violation: placeholder detected where substitution or passthrough is not permitted"
            ),
            BlockingAction::BlockAndTerminate => tracing::error!(
                action = %report.action,
                secret_env_var = %report.env_var,
                placeholder = %report.placeholder,
                protocol = %report.protocol,
                sni = %self.sni,
                host = %host,
                method = %method,
                path = %path,
                location = %report.location,
                match_form = %report.match_form,
                guest_dst = %guest_dst,
                http2_stream_id = %http2_stream_id,
                "secret violation: placeholder detected where substitution or passthrough is not permitted - terminating"
            ),
        }
    }

    /// Returns the strongest blocking action for any placeholder appearing in data
    /// for a host that isn't allowed to receive either the real secret or the placeholder.
    ///
    /// Scans the raw bytes (stitched with the previous call's tail for
    /// cross-write detection), plus URL- and JSON-decoded variants for
    /// encoded-placeholder bypass attempts, plus base64-decoded Basic auth
    /// credentials.
    fn detect_blocking_action(
        &self,
        data: &[u8],
        headers: &str,
        location_hint: RequestLocation,
    ) -> Option<SecretViolationReport> {
        self.detect_http1_fragment_blocking_action(&self.prev_tail, data, headers, location_hint)
    }

    /// Detect a violation inside one semantically scoped HTTP/1 fragment.
    /// The caller supplies only a tail from the same logical byte stream.
    fn detect_http1_fragment_blocking_action(
        &self,
        prev_tail: &[u8],
        data: &[u8],
        headers: &str,
        location_hint: RequestLocation,
    ) -> Option<SecretViolationReport> {
        let mut report = detect_blocking_action_with_tail(
            &self.ineligible_for_substitution,
            prev_tail,
            data,
            headers,
            RequestProtocol::Http1,
            location_hint,
            None,
        );
        if let Some(report) = &mut report
            && let Some(summary) = &self.http1_request_summary
        {
            report.apply_request_summary(summary);
        }
        report
    }

    /// Enforce placeholder policy for chunk extensions and trailers.
    ///
    /// These locations are parsed as complete bounded lines, so they need no
    /// sliding tail. Trailer text is supplied as header context solely to
    /// retain encoded Basic-auth detection; the explicit location keeps it
    /// outside the ordinary substitutable header section.
    fn apply_chunked_metadata_policy(
        &mut self,
        line: &[u8],
        location: RequestLocation,
    ) -> Result<(), SecretViolationAction> {
        debug_assert!(matches!(
            location,
            RequestLocation::ChunkMetadata | RequestLocation::Trailer
        ));
        let headers = if location == RequestLocation::Trailer {
            std::str::from_utf8(line).unwrap_or_default()
        } else {
            ""
        };
        self.apply_blocking_action(self.detect_http1_fragment_blocking_action(
            &[],
            line,
            headers,
            location,
        ))
    }

    /// Update the sliding-window tail with the trailing bytes of `data`, so
    /// the next `substitute` call can detect placeholders split across the
    /// boundary.
    fn update_tail(&mut self, data: &[u8]) {
        update_tail_buffer(
            &mut self.prev_tail,
            data,
            self.max_detection_window_len.saturating_sub(1),
        );
    }
}

impl Http2State {
    fn process(
        &mut self,
        handler: &mut SecretsHandler,
        data: &[u8],
    ) -> Result<Vec<u8>, SecretViolationAction> {
        self.buffer.extend_from_slice(data);
        let mut output = Vec::new();

        if !self.preface_seen {
            if self.buffer.len() < HTTP2_PREFACE.len() {
                return Ok(output);
            }
            if !self.buffer.starts_with(HTTP2_PREFACE) {
                return Err(SecretViolationAction::Block);
            }
            output.extend_from_slice(HTTP2_PREFACE);
            self.buffer.drain(..HTTP2_PREFACE.len());
            self.preface_seen = true;
        }

        loop {
            if self.buffer.len() < 9 {
                break;
            }

            let frame_len = http2_frame_payload_len(&self.buffer[..9]);
            if frame_len > MAX_HTTP2_FRAME_PAYLOAD_BYTES {
                return Err(SecretViolationAction::Block);
            }
            let full_len = 9 + frame_len;
            if self.buffer.len() < full_len {
                break;
            }

            let frame = self.buffer[..full_len].to_vec();
            self.buffer.drain(..full_len);
            self.process_frame(handler, &frame, &mut output)?;
        }

        Ok(output)
    }

    fn process_frame(
        &mut self,
        handler: &mut SecretsHandler,
        raw: &[u8],
        output: &mut Vec<u8>,
    ) -> Result<(), SecretViolationAction> {
        let frame = parse_http2_frame(raw)?;

        if self.header_block.is_some() && frame.kind != HTTP2_FRAME_CONTINUATION {
            return Err(SecretViolationAction::Block);
        }

        match frame.kind {
            HTTP2_FRAME_HEADERS => self.process_headers_frame(handler, frame, output),
            HTTP2_FRAME_CONTINUATION => self.process_continuation_frame(handler, frame, output),
            HTTP2_FRAME_DATA => self.process_data_frame(handler, frame, output),
            HTTP2_FRAME_PUSH_PROMISE => Err(SecretViolationAction::Block),
            _ => {
                output.extend_from_slice(frame.raw);
                Ok(())
            }
        }
    }

    fn process_headers_frame(
        &mut self,
        handler: &mut SecretsHandler,
        frame: Http2Frame<'_>,
        output: &mut Vec<u8>,
    ) -> Result<(), SecretViolationAction> {
        if frame.stream_id == 0 || frame.stream_id.is_multiple_of(2) || self.header_block.is_some()
        {
            return Err(SecretViolationAction::Block);
        }

        let fragment = http2_headers_fragment(frame.flags, frame.payload)?;
        if fragment.len() > MAX_HTTP2_HEADER_BLOCK_BYTES {
            return Err(SecretViolationAction::Block);
        }

        let block = Http2HeaderBlock {
            stream_id: frame.stream_id,
            end_stream: frame.flags & HTTP2_FLAG_END_STREAM != 0,
            block: fragment.to_vec(),
        };

        if frame.flags & HTTP2_FLAG_END_HEADERS != 0 {
            self.finish_header_block(handler, block, output)
        } else {
            self.header_block = Some(block);
            Ok(())
        }
    }

    fn process_continuation_frame(
        &mut self,
        handler: &mut SecretsHandler,
        frame: Http2Frame<'_>,
        output: &mut Vec<u8>,
    ) -> Result<(), SecretViolationAction> {
        let Some(mut block) = self.header_block.take() else {
            return Err(SecretViolationAction::Block);
        };
        if frame.stream_id == 0 || frame.stream_id != block.stream_id {
            return Err(SecretViolationAction::Block);
        }

        block.block.extend_from_slice(frame.payload);
        if block.block.len() > MAX_HTTP2_HEADER_BLOCK_BYTES {
            return Err(SecretViolationAction::Block);
        }

        if frame.flags & HTTP2_FLAG_END_HEADERS != 0 {
            self.finish_header_block(handler, block, output)
        } else {
            self.header_block = Some(block);
            Ok(())
        }
    }

    fn process_data_frame(
        &mut self,
        handler: &mut SecretsHandler,
        frame: Http2Frame<'_>,
        output: &mut Vec<u8>,
    ) -> Result<(), SecretViolationAction> {
        if frame.stream_id == 0 || !self.open_request_streams.contains(&frame.stream_id) {
            return Err(SecretViolationAction::Block);
        }

        let data = http2_data_payload(frame.flags, frame.payload)?;
        let tail = self.data_tails.entry(frame.stream_id).or_default();
        if handler.contains_eligible_body_placeholder(tail, data) {
            tracing::warn!(
                "secret substitution in HTTP/2 DATA frames is unsupported; blocking placeholder"
            );
            return Err(SecretViolationAction::Block);
        }
        let mut report = detect_blocking_action_with_tail(
            &handler.ineligible_for_substitution,
            tail,
            data,
            "",
            RequestProtocol::Http2,
            RequestLocation::Body,
            Some(frame.stream_id),
        );
        if let Some(report) = &mut report
            && let Some(summary) = self.request_summaries.get(&frame.stream_id)
        {
            report.apply_request_summary(summary);
        }
        handler.apply_blocking_action(report)?;
        update_tail_buffer(
            tail,
            data,
            handler.max_detection_window_len.saturating_sub(1),
        );
        if frame.flags & HTTP2_FLAG_END_STREAM != 0 {
            self.data_tails.remove(&frame.stream_id);
            self.open_request_streams.remove(&frame.stream_id);
            self.request_summaries.remove(&frame.stream_id);
        }
        output.extend_from_slice(frame.raw);
        Ok(())
    }

    fn finish_header_block(
        &mut self,
        handler: &mut SecretsHandler,
        block: Http2HeaderBlock,
        output: &mut Vec<u8>,
    ) -> Result<(), SecretViolationAction> {
        let mut headers = self.decode_headers(&block.block)?;
        let is_initial_request = !self.open_request_streams.contains(&block.stream_id);
        if is_initial_request {
            // Client-initiated HTTP/2 stream ids must strictly increase. A
            // reused id would let a previously completed stream be presented
            // as a fresh request, so fail closed before substitution runs.
            if block.stream_id <= self.highest_client_stream_id {
                return Err(SecretViolationAction::Block);
            }
            if self.open_request_streams.len() >= MAX_HTTP2_TRACKED_STREAMS {
                return Err(SecretViolationAction::Block);
            }
            self.highest_client_stream_id = block.stream_id;
            self.open_request_streams.insert(block.stream_id);
        } else if !block.end_stream {
            return Err(SecretViolationAction::Block);
        }

        if let Some(validator) = handler.http_authority.as_ref() {
            validate_http2_authority(&headers, validator, is_initial_request)?;
        }

        let detection_bytes = http2_header_detection_bytes(&headers);
        let detection_text = String::from_utf8_lossy(&detection_bytes);
        let request_summary = http2_request_summary(detection_text.as_ref());
        if is_initial_request {
            handler.apply_blocking_action(detect_http2_header_blocking_action(
                &handler.ineligible_for_substitution,
                &headers,
                &request_summary,
                block.stream_id,
            ))?;
            handler.substitute_http2_headers(&mut headers);
        } else {
            // Trailers are never substitution targets, in either HTTP version.
            let summary = self
                .request_summaries
                .get(&block.stream_id)
                .unwrap_or(&request_summary);

            handler.apply_blocking_action(detect_blocking_action_in_fragments(
                &handler.ineligible_for_substitution,
                &[(&detection_bytes, RequestLocation::Trailer)],
                RequestProtocol::Http2,
                summary,
                Some(block.stream_id),
            ))?;
        }

        let encoded = self.encode_headers(&headers)?;
        append_http2_header_frames(output, block.stream_id, block.end_stream, &encoded)?;
        if block.end_stream {
            self.data_tails.remove(&block.stream_id);
            self.open_request_streams.remove(&block.stream_id);
            self.request_summaries.remove(&block.stream_id);
        } else {
            self.request_summaries
                .insert(block.stream_id, request_summary);
        }
        Ok(())
    }

    fn decode_headers(&mut self, block: &[u8]) -> Result<Http2Headers, SecretViolationAction> {
        // `httlib-hpack` panics on a truncated representation instead of
        // returning an error, so it only gets structurally complete blocks.
        check_header_block(block).map_err(|err| {
            tracing::debug!(error = %err, "rejecting guest HTTP/2 header block");
            SecretViolationAction::Block
        })?;
        let mut block = block.to_vec();
        let mut headers = Vec::new();
        let mut decoded_bytes = 0usize;

        while !block.is_empty() {
            let before_len = block.len();
            let mut decoded = Vec::with_capacity(1);
            self.decoder
                .decode_exact(&mut block, &mut decoded)
                .map_err(|_| SecretViolationAction::Block)?;
            if decoded.is_empty() {
                if block.len() == before_len {
                    return Err(SecretViolationAction::Block);
                }
                continue;
            }

            if headers.len() >= MAX_HTTP2_HEADER_FIELDS {
                return Err(SecretViolationAction::Block);
            }
            let (name, value, _flags) = decoded.pop().expect("decoded one header");
            decoded_bytes = decoded_bytes
                .checked_add(name.len())
                .and_then(|len| len.checked_add(value.len()))
                .and_then(|len| len.checked_add(4))
                .ok_or(SecretViolationAction::Block)?;
            if decoded_bytes > MAX_HTTP2_DECODED_HEADER_BYTES {
                return Err(SecretViolationAction::Block);
            }

            headers.push((name, value));
        }

        Ok(headers)
    }

    fn encode_headers(
        &mut self,
        headers: &[(Vec<u8>, Vec<u8>)],
    ) -> Result<Vec<u8>, SecretViolationAction> {
        let mut encoded = Vec::new();
        for (name, value) in headers {
            self.encoder
                .encode(
                    (name.clone(), value.clone(), HpackEncoder::NEVER_INDEXED),
                    &mut encoded,
                )
                .map_err(|_| SecretViolationAction::Block)?;
        }
        Ok(encoded)
    }
}

//--------------------------------------------------------------------------------------------------
// Functions
//--------------------------------------------------------------------------------------------------

/// Returns true when `name` is an allowed header field name.
///
/// `headers_enabled` gates all header substitution; an empty `header_fields`
/// allowlist means every field name is allowed.
fn header_field_allowed(headers_enabled: bool, header_fields: &[String], name: &[u8]) -> bool {
    headers_enabled
        && (header_fields.is_empty()
            || header_fields
                .iter()
                .any(|field| name.eq_ignore_ascii_case(field.as_bytes())))
}

/// Returns the field-name portion of a header line.
fn header_field_name(line: &[u8]) -> &[u8] {
    match line.iter().position(|byte| *byte == b':') {
        Some(end) => &line[..end],
        None => line,
    }
}

/// Returns true if `line` starts with the `Authorization:` header name
/// (case-insensitive).
fn is_authorization_header(line: &str) -> bool {
    line.as_bytes()
        .get(..AUTHORIZATION_HEADER_NAME.len())
        .is_some_and(|bytes| bytes.eq_ignore_ascii_case(AUTHORIZATION_HEADER_NAME))
}

fn is_http2_preface_prefix(data: &[u8]) -> bool {
    !data.is_empty()
        && if data.len() <= HTTP2_PREFACE.len() {
            HTTP2_PREFACE.starts_with(data)
        } else {
            data.starts_with(HTTP2_PREFACE)
        }
}

fn has_complete_http2_preface(data: &[u8]) -> bool {
    data.len() >= HTTP2_PREFACE.len() && data.starts_with(HTTP2_PREFACE)
}

fn http2_frame_payload_len(header: &[u8]) -> usize {
    ((header[0] as usize) << 16) | ((header[1] as usize) << 8) | header[2] as usize
}

fn parse_http2_frame(raw: &[u8]) -> Result<Http2Frame<'_>, SecretViolationAction> {
    if raw.len() < 9 {
        return Err(SecretViolationAction::Block);
    }
    let len = http2_frame_payload_len(raw);
    if raw.len() != 9 + len {
        return Err(SecretViolationAction::Block);
    }

    let stream_id = u32::from_be_bytes([raw[5], raw[6], raw[7], raw[8]]) & 0x7fff_ffff;
    Ok(Http2Frame {
        kind: raw[3],
        flags: raw[4],
        stream_id,
        payload: &raw[9..],
        raw,
    })
}

fn http2_headers_fragment(flags: u8, payload: &[u8]) -> Result<&[u8], SecretViolationAction> {
    let mut start = 0;
    let pad_len = if flags & HTTP2_FLAG_PADDED != 0 {
        let Some(pad_len) = payload.first() else {
            return Err(SecretViolationAction::Block);
        };
        start = 1;
        *pad_len as usize
    } else {
        0
    };

    if flags & HTTP2_FLAG_PRIORITY != 0 {
        start += 5;
    }
    if payload.len() < start + pad_len {
        return Err(SecretViolationAction::Block);
    }

    Ok(&payload[start..payload.len() - pad_len])
}

fn http2_data_payload(flags: u8, payload: &[u8]) -> Result<&[u8], SecretViolationAction> {
    if flags & HTTP2_FLAG_PADDED == 0 {
        return Ok(payload);
    }

    let Some(pad_len) = payload.first() else {
        return Err(SecretViolationAction::Block);
    };
    let pad_len = *pad_len as usize;
    if payload.len() < 1 + pad_len {
        return Err(SecretViolationAction::Block);
    }

    Ok(&payload[1..payload.len() - pad_len])
}

fn append_http2_header_frames(
    output: &mut Vec<u8>,
    stream_id: u32,
    end_stream: bool,
    block: &[u8],
) -> Result<(), SecretViolationAction> {
    let mut first = true;
    let mut offset = 0;

    while first || offset < block.len() {
        let remaining = block.len().saturating_sub(offset);
        let take = remaining.min(HTTP2_OUTBOUND_FRAME_PAYLOAD_BYTES);
        let payload = &block[offset..offset + take];
        offset += take;

        let kind = if first {
            HTTP2_FRAME_HEADERS
        } else {
            HTTP2_FRAME_CONTINUATION
        };
        let mut flags = 0;
        if offset == block.len() {
            flags |= HTTP2_FLAG_END_HEADERS;
        }
        if first && end_stream {
            flags |= HTTP2_FLAG_END_STREAM;
        }

        append_http2_frame(output, kind, flags, stream_id, payload)?;
        first = false;
    }

    Ok(())
}

fn append_http2_frame(
    output: &mut Vec<u8>,
    kind: u8,
    flags: u8,
    stream_id: u32,
    payload: &[u8],
) -> Result<(), SecretViolationAction> {
    if payload.len() > 0x00ff_ffff || stream_id & 0x8000_0000 != 0 {
        return Err(SecretViolationAction::Block);
    }

    output.push(((payload.len() >> 16) & 0xff) as u8);
    output.push(((payload.len() >> 8) & 0xff) as u8);
    output.push((payload.len() & 0xff) as u8);
    output.push(kind);
    output.push(flags);
    output.extend_from_slice(&stream_id.to_be_bytes());
    output.extend_from_slice(payload);
    Ok(())
}

fn validate_http1_authority(
    metadata: &HttpRequestMetadata,
    validator: &HttpAuthorityValidator,
) -> Result<(), SecretViolationAction> {
    if metadata.host_headers.len() != 1 {
        return Err(SecretViolationAction::Block);
    }

    for authority in metadata
        .host_headers
        .iter()
        .chain(metadata.target_authority.iter())
    {
        validate_authority(authority, validator)?;
    }

    Ok(())
}

fn validate_http2_authority(
    headers: &[(Vec<u8>, Vec<u8>)],
    validator: &HttpAuthorityValidator,
    require_authority: bool,
) -> Result<(), SecretViolationAction> {
    let mut authority_count = 0usize;

    for (name, value) in headers {
        if name.eq_ignore_ascii_case(b":authority") {
            authority_count += 1;
            let authority = String::from_utf8_lossy(value);
            validate_authority(authority.as_ref(), validator)?;
        } else if name.eq_ignore_ascii_case(b"host") {
            let host = String::from_utf8_lossy(value);
            validate_authority(host.as_ref(), validator)?;
        }
    }

    if require_authority && authority_count != 1 {
        return Err(SecretViolationAction::Block);
    }

    Ok(())
}

fn validate_authority(
    authority: &str,
    validator: &HttpAuthorityValidator,
) -> Result<(), SecretViolationAction> {
    match validator {
        HttpAuthorityValidator::Sni(sni) => authority_matches_sni(authority, sni)
            .then_some(())
            .ok_or(SecretViolationAction::Block),
        HttpAuthorityValidator::Policy {
            guest_dst,
            network_policy,
            shared,
            secret_host,
        } => {
            // A network allow does not authorize using a secret selected for a
            // different host (including placeholder passthrough exemptions).
            if secret_host
                .as_ref()
                .is_some_and(|host| !authority_matches_sni(authority, host))
            {
                return Err(SecretViolationAction::Block);
            }
            let Some(hostname) = authority_hostname(authority) else {
                return Err(SecretViolationAction::Block);
            };
            let hostname = hostname.to_ascii_lowercase();
            let authority_dst = SocketAddr::new(guest_dst.ip(), guest_dst.port());
            match network_policy.evaluate_egress_with_source(
                authority_dst,
                Protocol::Tcp,
                shared,
                HostnameSource::Sni(&hostname),
            ) {
                EgressEvaluation::Allow => Ok(()),
                EgressEvaluation::Deny | EgressEvaluation::DeferUntilHostname => {
                    Err(SecretViolationAction::Block)
                }
            }
        }
    }
}

fn http2_header_detection_bytes(headers: &[(Vec<u8>, Vec<u8>)]) -> Vec<u8> {
    let len = headers
        .iter()
        .map(|(name, value)| name.len() + value.len() + 4)
        .sum();
    let mut out = Vec::with_capacity(len);
    for (name, value) in headers {
        out.extend_from_slice(name);
        out.extend_from_slice(b": ");
        out.extend_from_slice(value);
        out.extend_from_slice(b"\r\n");
    }
    out
}

fn parse_http_request_metadata(
    header_bytes: &[u8],
) -> Result<Option<HttpRequestMetadata>, SecretViolationAction> {
    let headers = std::str::from_utf8(header_bytes).map_err(|_| SecretViolationAction::Block)?;
    let mut lines = headers.split("\r\n").skip_while(|line| line.is_empty());
    let Some(request_line) = lines.next() else {
        return Ok(None);
    };

    let Some((method, target, version)) = split_http_request_line(request_line) else {
        return Err(SecretViolationAction::Block);
    };
    if version == "HTTP/2.0" {
        return Err(SecretViolationAction::Block);
    }
    if !version.starts_with("HTTP/1.") {
        return Err(SecretViolationAction::Block);
    }

    let target_authority = request_target_authority(method, target)?;
    let mut host_headers = Vec::new();
    for line in lines.take_while(|line| !line.is_empty()) {
        let Some((name, value)) = line.split_once(':') else {
            return Err(SecretViolationAction::Block);
        };
        if name.is_empty() || !name.bytes().all(is_http_token_byte) {
            return Err(SecretViolationAction::Block);
        }
        let value = value.trim();

        if name.eq_ignore_ascii_case("host") {
            host_headers.push(value.to_string());
        }
    }

    if host_headers.is_empty() {
        return Err(SecretViolationAction::Block);
    }

    Ok(Some(HttpRequestMetadata {
        host_headers,
        target_authority,
    }))
}

fn http_request_version(request_line: &str) -> Option<&str> {
    split_http_request_line(request_line).map(|(_, _, version)| version)
}

fn split_http_request_line(request_line: &str) -> Option<(&str, &str, &str)> {
    let mut parts = request_line.split_whitespace();
    let method = parts.next()?;
    let target = parts.next()?;
    let version = parts.next()?;
    if parts.next().is_some() || !method.bytes().all(is_http_token_byte) {
        return None;
    }
    Some((method, target, version))
}

fn request_target_authority(
    method: &str,
    target: &str,
) -> Result<Option<String>, SecretViolationAction> {
    if target.starts_with('/') || target == "*" {
        return Ok(None);
    }

    if let Some(authority) = absolute_form_authority(target)? {
        return Ok(Some(authority.to_string()));
    }

    if method.eq_ignore_ascii_case("CONNECT") {
        if target.is_empty() || target.contains('/') || target.contains('@') {
            return Err(SecretViolationAction::Block);
        }
        return Ok(Some(target.to_string()));
    }

    Err(SecretViolationAction::Block)
}

fn absolute_form_authority(target: &str) -> Result<Option<&str>, SecretViolationAction> {
    let Some((scheme, rest)) = target.split_once("://") else {
        return Ok(None);
    };
    if !scheme.eq_ignore_ascii_case("http") && !scheme.eq_ignore_ascii_case("https") {
        return Err(SecretViolationAction::Block);
    }

    let authority_end = rest.find(['/', '?', '#']).unwrap_or(rest.len());
    let authority = &rest[..authority_end];
    if authority.is_empty() || authority.contains('@') {
        return Err(SecretViolationAction::Block);
    }
    Ok(Some(authority))
}

fn redacted_request_path(target: &str) -> String {
    let without_query = target.split_once('?').map_or(target, |(path, _)| path);
    if let Some(scheme_end) = without_query.find("://") {
        let after_scheme = &without_query[scheme_end + 3..];
        if let Some(path_start) = after_scheme.find('/') {
            return after_scheme[path_start..].to_string();
        }
        return "/".to_string();
    }
    without_query.to_string()
}

fn request_summary(headers: &str, protocol: RequestProtocol) -> RequestSummary {
    match protocol {
        RequestProtocol::Http1 => http1_request_summary(headers),
        RequestProtocol::Http2 => http2_request_summary(headers),
        RequestProtocol::Opaque => RequestSummary::default(),
    }
}

fn http1_request_summary(headers: &str) -> RequestSummary {
    let mut lines = headers.split("\r\n").skip_while(|line| line.is_empty());
    let Some(request_line) = lines.next() else {
        return RequestSummary::default();
    };
    let Some((method, target, _version)) = split_http_request_line(request_line) else {
        return RequestSummary::default();
    };

    let host = lines
        .take_while(|line| !line.is_empty())
        .filter_map(|line| line.split_once(':'))
        .find_map(|(name, value)| name.eq_ignore_ascii_case("host").then(|| value.trim()));

    RequestSummary {
        method: Some(method.to_string()),
        path: Some(redacted_request_path(target)),
        host: host.map(ToOwned::to_owned),
    }
}

fn http2_request_summary(headers: &str) -> RequestSummary {
    let mut summary = RequestSummary::default();
    for line in headers.split("\r\n").filter(|line| !line.is_empty()) {
        if let Some(value) = line.strip_prefix(":method: ") {
            summary.method = Some(value.to_string());
        } else if let Some(value) = line.strip_prefix(":path: ") {
            summary.path = Some(redacted_request_path(value));
        } else if let Some(value) = line.strip_prefix(":authority: ") {
            summary.host = Some(value.trim().to_string());
        }
    }
    summary
}

pub(crate) fn looks_like_http_request_prefix(data: &[u8]) -> bool {
    if data.is_empty() || b"PRI * HTTP/2.0\r\n\r\nSM\r\n\r\n".starts_with(data) {
        return true;
    }

    let data = skip_leading_empty_http_lines(data);
    if data.is_empty() {
        return true;
    }

    if http_request_line_has_binary_control(data) {
        return false;
    }

    let method_end = data.iter().position(|byte| matches!(byte, b' ' | b'\t'));
    let method = match method_end {
        Some(end) => &data[..end],
        None => data,
    };

    if method.is_empty() || !method.iter().copied().all(is_http_token_byte) {
        return false;
    }

    let Some(tab) = method_end.filter(|end| data[*end] == b'\t') else {
        return true;
    };
    let target = &data[tab + 1..];
    let target = &target[..target
        .iter()
        .position(u8::is_ascii_whitespace)
        .unwrap_or(target.len())];
    target.is_empty()
        || target.starts_with(b"/")
        || target.starts_with(b"*")
        || method.eq_ignore_ascii_case(b"CONNECT")
        || [b"http://".as_slice(), b"https://".as_slice()]
            .iter()
            .any(|scheme| {
                let overlap = target.len().min(scheme.len());
                target[..overlap].eq_ignore_ascii_case(&scheme[..overlap])
            })
}

fn http_request_line_has_binary_control(data: &[u8]) -> bool {
    let data = skip_leading_empty_http_lines(data);
    let request_line_end = data
        .iter()
        .position(|byte| matches!(byte, b'\r' | b'\n'))
        .unwrap_or(data.len());
    data[..request_line_end]
        .iter()
        .any(|byte| byte.is_ascii_control() && !byte.is_ascii_whitespace())
}

fn opaque_prefix_might_be_http(data: &[u8]) -> bool {
    let data = skip_leading_empty_http_lines(data);
    let line_end = data
        .iter()
        .position(|byte| matches!(byte, b'\r' | b'\n'))
        .unwrap_or(data.len());
    let line = &data[..line_end];
    let delimiter = line
        .iter()
        .position(|byte| *byte == b' ' || (!byte.is_ascii_whitespace() && byte.is_ascii_control()))
        .unwrap_or(line.len());
    let method = &line[..delimiter];
    let has_binary_control = line
        .iter()
        .any(|byte| byte.is_ascii_control() && !byte.is_ascii_whitespace());

    (has_binary_control
        && !method.is_empty()
        && [
            b"CONNECT".as_slice(),
            b"DELETE".as_slice(),
            b"GET".as_slice(),
            b"HEAD".as_slice(),
            b"OPTIONS".as_slice(),
            b"PATCH".as_slice(),
            b"POST".as_slice(),
            b"PUT".as_slice(),
            b"TRACE".as_slice(),
        ]
        .contains(&method))
        || line
            .windows(5)
            .any(|window| window.eq_ignore_ascii_case(b"HTTP/"))
}

pub(crate) fn first_line_is_not_http_request(data: &[u8]) -> bool {
    let data = skip_leading_empty_http_lines(data);
    let Some(line_end) = data.windows(2).position(|window| window == b"\r\n") else {
        return false;
    };
    let line = String::from_utf8_lossy(&data[..line_end]);
    http_request_version(line.as_ref()).is_none()
}

pub(crate) fn skip_leading_empty_http_lines(mut data: &[u8]) -> &[u8] {
    while data.starts_with(b"\r\n") {
        data = &data[2..];
    }
    data
}

fn is_http_token_byte(byte: u8) -> bool {
    matches!(
        byte,
        b'!' | b'#'
            | b'$'
            | b'%'
            | b'&'
            | b'\''
            | b'*'
            | b'+'
            | b'-'
            | b'.'
            | b'^'
            | b'_'
            | b'`'
            | b'|'
            | b'~'
            | b'0'..=b'9'
            | b'A'..=b'Z'
            | b'a'..=b'z'
    )
}

fn authority_matches_sni(authority: &str, sni: &str) -> bool {
    authority_hostname(authority).is_some_and(|hostname| {
        if let Ok(address) = sni.parse::<IpAddr>() {
            return hostname.parse::<IpAddr>().is_ok_and(|host| host == address);
        }
        hostname.eq_ignore_ascii_case(sni.trim_end_matches('.'))
    })
}

fn authority_hostname(authority: &str) -> Option<&str> {
    let authority = authority.trim().trim_end_matches('.');
    if authority.is_empty() {
        return None;
    }

    if let Some(rest) = authority.strip_prefix('[') {
        let (host, _port) = rest.split_once(']')?;
        return Some(host.trim_end_matches('.'));
    }

    match authority.rsplit_once(':') {
        Some((host, port)) if !host.contains(':') && port.parse::<u16>().is_ok() => {
            Some(host.trim_end_matches('.'))
        }
        _ => Some(authority),
    }
}

fn secret_host_allowed(
    secret: &SecretEntry,
    sni: &str,
    identity: Option<&SecretHostIdentity<'_>>,
) -> bool {
    secret
        .allowed_hosts
        .iter()
        .any(|pattern| host_pattern_allowed(pattern, sni, identity))
}

fn host_pattern_allowed(
    pattern: &HostPattern,
    sni: &str,
    identity: Option<&SecretHostIdentity<'_>>,
) -> bool {
    if !pattern.matches(sni) {
        return false;
    }
    if matches!(pattern, HostPattern::Any) {
        return true;
    }
    let Some(identity) = identity else {
        return true;
    };

    host_alias_matches(pattern, sni, identity)
        || identity
            .shared
            .any_resolved_hostname(identity.guest_ip, |hostname| pattern.matches(hostname))
}

fn host_alias_matches(pattern: &HostPattern, sni: &str, identity: &SecretHostIdentity<'_>) -> bool {
    if !sni.eq_ignore_ascii_case(crate::HOST_ALIAS) || !pattern.matches(crate::HOST_ALIAS) {
        return false;
    }

    identity
        .shared
        .gateway_ipv4()
        .is_some_and(|ip| identity.guest_ip == IpAddr::V4(ip))
        || identity
            .shared
            .gateway_ipv6()
            .is_some_and(|ip| identity.guest_ip == IpAddr::V6(ip))
}

/// Decode the credentials of a `Basic` `Authorization` header line. Returns
/// `None` if the line is not `Basic`-scheme or the payload is not valid
/// base64 / UTF-8.
fn decode_basic_credentials(line: &str) -> Option<String> {
    let (_, raw_value) = line.split_once(':')?;
    let (scheme, encoded) = split_auth_scheme(raw_value.trim_start())?;
    if !scheme.eq_ignore_ascii_case("basic") {
        return None;
    }
    let bytes = BASE64.decode(encoded.trim()).ok()?;
    String::from_utf8(bytes).ok()
}

fn opaque_basic_auth_payload(line: &[u8]) -> Option<&[u8]> {
    let value = line
        .get(AUTHORIZATION_HEADER_NAME.len()..)?
        .trim_ascii_start();
    let scheme_end = value.iter().position(|byte| byte.is_ascii_whitespace())?;
    let (scheme, encoded) = value.split_at(scheme_end);
    if !scheme.eq_ignore_ascii_case(b"basic") {
        return None;
    }
    let encoded = encoded.trim_ascii_start();
    (!encoded.is_empty()
        && encoded
            .iter()
            .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'+' | b'/' | b'=')))
    .then_some(encoded)
}

/// Split an `Authorization` header value into `(scheme, rest)` at the first
/// whitespace. Returns `None` if no whitespace separator is found.
fn split_auth_scheme(header_value: &str) -> Option<(&str, &str)> {
    let split_at = header_value.find(char::is_whitespace)?;
    let (scheme, rest) = header_value.split_at(split_at);
    Some((scheme, rest.trim_start()))
}

fn substitute_query_in_request_line(line: &str, placeholder: &str, value: &str) -> Option<String> {
    if placeholder.is_empty() {
        return None;
    }

    let method_end = line.find(' ')?;
    let target_start = method_end + 1;
    let version_start = line[target_start..].rfind(' ')? + target_start;
    if version_start <= target_start {
        return None;
    }

    let target = &line[target_start..version_start];
    let query_start = target.find('?')? + 1;
    let query = &target[query_start..];
    if !query.contains(placeholder) {
        return None;
    }

    let mut result = String::with_capacity(line.len());
    result.push_str(&line[..target_start + query_start]);
    result.push_str(&query.replace(placeholder, value));
    result.push_str(&line[version_start..]);
    Some(result)
}

fn substitute_query_in_target(target: &str, placeholder: &str, value: &str) -> Option<String> {
    if placeholder.is_empty() {
        return None;
    }

    let query_start = target.find('?')? + 1;
    let query = &target[query_start..];
    if !query.contains(placeholder) {
        return None;
    }

    let mut result = String::with_capacity(target.len());
    result.push_str(&target[..query_start]);
    result.push_str(&query.replace(placeholder, value));
    Some(result)
}

fn substitute_basic_auth_value(
    header_value: &str,
    placeholder: &str,
    value: &str,
) -> Option<String> {
    let (scheme, encoded) = split_auth_scheme(header_value.trim_start())?;
    if !scheme.eq_ignore_ascii_case("basic") {
        return None;
    }
    let bytes = BASE64.decode(encoded.trim()).ok()?;
    let decoded = String::from_utf8(bytes).ok()?;
    if !decoded.contains(placeholder) {
        return None;
    }
    let replaced = decoded.replace(placeholder, value);
    Some(format!("Basic {}", BASE64.encode(replaced.as_bytes())))
}

/// Returns true if any `Authorization: Basic` line in `headers` decodes to
/// credentials containing `placeholder`.
fn basic_auth_decoded_contains(headers: &str, placeholder: &str) -> bool {
    decoded_basic_auth_credentials(headers)
        .iter()
        .any(|decoded| decoded.contains(placeholder))
}

/// Decode all Basic authorization credentials in an HTTP header block.
fn decoded_basic_auth_credentials(headers: &str) -> Vec<String> {
    headers
        .split("\r\n")
        .filter(|line| is_authorization_header(line))
        .filter_map(decode_basic_credentials)
        .collect()
}

/// Byte-slice substring check.
fn contains_bytes(haystack: &[u8], needle: &[u8]) -> bool {
    if needle.is_empty() || haystack.len() < needle.len() {
        return false;
    }
    haystack.windows(needle.len()).any(|w| w == needle)
}

/// Longest representation the violation detector may need to carry across
/// write boundaries for a placeholder. Percent encoding can expand one byte
/// to `%XX`; JSON unicode escaping can expand one byte to `\u00XX`.
fn max_placeholder_detection_len(placeholder_len: usize) -> usize {
    placeholder_len.saturating_mul(6)
}

/// Compute the framing state for the next chunk and how many of the
/// post-boundary bytes belong to THIS request's body. `body_in_chunk` is
/// the number of bytes that followed `\r\n\r\n` in this chunk; the
/// returned `body_in_request` is at most `body_in_chunk`, and any
/// remaining bytes are spillover from a pipelined next request.
fn next_state_after_headers(
    headers: &str,
    body_bytes: &[u8],
) -> Result<RequestFraming, SecretViolationAction> {
    let body_in_chunk = body_bytes.len();
    let body_substitution_allowed = !has_non_identity_content_encoding(headers);
    let transfer_encoding = parse_transfer_encoding(headers)?;
    let content_length = parse_content_length(headers)?;
    if transfer_encoding.is_some() && content_length.is_some() {
        return Err(SecretViolationAction::Block);
    }

    if transfer_encoding == Some(TransferEncoding::Chunked) {
        let mut chunked_state = ChunkedBodyState::default();
        let (state, body_in_request) = match consume_chunked_body(&mut chunked_state, body_bytes)? {
            Some(end) => (HttpState::AwaitingHeaders, end),
            _ => (
                HttpState::InChunkedBody {
                    state: chunked_state,
                },
                body_in_chunk,
            ),
        };
        return Ok(RequestFraming {
            state,
            body_in_request,
            body_substitution_allowed: false,
        });
    }
    match content_length {
        Some(cl) if body_in_chunk >= cl => Ok(RequestFraming {
            state: HttpState::AwaitingHeaders,
            body_in_request: cl,
            body_substitution_allowed,
        }),
        Some(cl) => Ok(RequestFraming {
            state: HttpState::InBody {
                remaining: cl - body_in_chunk,
            },
            body_in_request: body_in_chunk,
            body_substitution_allowed,
        }),
        // Per RFC 9112 §6.3 case 6, a request with neither `Content-Length`
        // nor `Transfer-Encoding` has a zero-length body. Any trailing
        // bytes are the start of a pipelined next request.
        None => Ok(RequestFraming {
            state: HttpState::AwaitingHeaders,
            body_in_request: 0,
            body_substitution_allowed: false,
        }),
    }
}

/// Parse a `Content-Length:` value from the headers block. Case-insensitive
/// header name match; rejects malformed or conflicting values.
fn parse_content_length(headers: &str) -> Result<Option<usize>, SecretViolationAction> {
    let mut content_length = None;
    for line in headers.split("\r\n") {
        let Some((name, value)) = line.split_once(':') else {
            continue;
        };
        if name.eq_ignore_ascii_case("content-length") {
            let parsed = value
                .trim()
                .parse::<usize>()
                .map_err(|_| SecretViolationAction::Block)?;
            if content_length.is_some_and(|existing| existing != parsed) {
                return Err(SecretViolationAction::Block);
            }
            content_length = Some(parsed);
        }
    }
    Ok(content_length)
}

fn content_length_exceeds_buffer_limit(headers: &str) -> Result<bool, SecretViolationAction> {
    Ok(parse_content_length(headers)?.is_some_and(|len| len > MAX_HTTP_BODY_BUFFER_BYTES))
}

/// Parse `Transfer-Encoding` for encodings the body rewriter can safely handle.
fn parse_transfer_encoding(
    headers: &str,
) -> Result<Option<TransferEncoding>, SecretViolationAction> {
    let mut saw_chunked = false;
    for line in headers.split("\r\n") {
        let Some((name, value)) = line.split_once(':') else {
            continue;
        };
        if !name.eq_ignore_ascii_case("transfer-encoding") {
            continue;
        }

        for coding in value.split(',') {
            let coding = coding.trim();
            let coding_name = coding
                .split_once(';')
                .map_or(coding, |(name, _)| name)
                .trim();
            if coding_name.is_empty() || !coding_name.eq_ignore_ascii_case("chunked") {
                return Err(SecretViolationAction::Block);
            }
            if saw_chunked {
                return Err(SecretViolationAction::Block);
            }
            saw_chunked = true;
        }
    }
    Ok(saw_chunked.then_some(TransferEncoding::Chunked))
}

/// True when the request body is encoded and cannot be rewritten byte-for-byte.
fn has_non_identity_content_encoding(headers: &str) -> bool {
    for line in headers.split("\r\n") {
        let Some((name, value)) = line.split_once(':') else {
            continue;
        };
        if !name.eq_ignore_ascii_case("content-encoding") {
            continue;
        }
        if value
            .split(',')
            .any(|encoding| !encoding.trim().eq_ignore_ascii_case("identity"))
        {
            return true;
        }
    }
    false
}

/// Replace all occurrences of `needle` in `haystack`.
///
/// Returns `None` when no replacement is needed so callers can preserve the
/// original byte slice without rebuilding arbitrary binary payloads.
fn replace_bytes(haystack: &[u8], needle: &[u8], replacement: &[u8]) -> Option<Vec<u8>> {
    if !contains_bytes(haystack, needle) {
        return None;
    }

    let mut result = Vec::with_capacity(haystack.len());
    let mut cursor = 0;
    while cursor < haystack.len() {
        if haystack[cursor..].starts_with(needle) {
            result.extend_from_slice(replacement);
            cursor += needle.len();
        } else {
            result.push(haystack[cursor]);
            cursor += 1;
        }
    }
    Some(result)
}

/// Returns true if `haystack`, after URL percent-decoding, contains `needle`.
#[cfg(test)]
fn url_decoded_contains(haystack: &[u8], needle: &[u8]) -> bool {
    let decoded: Vec<u8> = percent_decode(haystack).collect();
    contains_bytes(&decoded, needle)
}

/// Returns true if `haystack`, after JSON `\uXXXX` decoding, contains `needle`.
/// Only `\uXXXX` escapes are expanded (sufficient to detect ASCII placeholders
/// hidden via unicode escapes); other JSON escapes pass through.
#[cfg(test)]
fn json_escaped_contains(haystack: &[u8], needle: &[u8]) -> bool {
    let decoded = json_unescape(haystack);
    contains_bytes(&decoded, needle)
}

/// Decode JSON `\uXXXX` escapes in a byte slice.
fn json_unescape(haystack: &[u8]) -> Vec<u8> {
    let mut decoded = Vec::with_capacity(haystack.len());
    let mut i = 0;
    while i < haystack.len() {
        if haystack[i] == b'\\'
            && i + 5 < haystack.len()
            && haystack[i + 1] == b'u'
            && let (Some(a), Some(b), Some(c), Some(d)) = (
                hex_digit(haystack[i + 2]),
                hex_digit(haystack[i + 3]),
                hex_digit(haystack[i + 4]),
                hex_digit(haystack[i + 5]),
            )
        {
            let cp = ((a as u32) << 12) | ((b as u32) << 8) | ((c as u32) << 4) | (d as u32);
            if let Some(ch) = char::from_u32(cp) {
                let mut buf = [0u8; 4];
                decoded.extend_from_slice(ch.encode_utf8(&mut buf).as_bytes());
            }
            i += 6;
            continue;
        }
        decoded.push(haystack[i]);
        i += 1;
    }
    decoded
}

fn hex_digit(b: u8) -> Option<u8> {
    (b as char).to_digit(16).map(|d| d as u8)
}

/// Update the Content-Length header value in `headers` to `new_len`.
///
/// Performs a case-insensitive line scan. If no Content-Length header exists
/// (e.g. chunked transfer encoding), the headers are returned unchanged.
fn update_content_length(headers: &str, new_len: usize) -> String {
    let mut result = String::with_capacity(headers.len());
    for (i, line) in headers.split("\r\n").enumerate() {
        if i > 0 {
            result.push_str("\r\n");
        }
        if line
            .as_bytes()
            .get(..15)
            .is_some_and(|b| b.eq_ignore_ascii_case(b"content-length:"))
        {
            result.push_str(&format!("Content-Length: {new_len}"));
        } else {
            result.push_str(line);
        }
    }
    result
}

/// Find the `\r\n\r\n` boundary between HTTP headers and body.
fn find_header_boundary(data: &[u8]) -> Option<usize> {
    data.windows(4)
        .position(|w| w == b"\r\n\r\n")
        .map(|pos| pos + 4)
}

fn append_chunk(output: &mut Vec<u8>, payload: &[u8]) {
    if payload.is_empty() {
        return;
    }
    output.extend_from_slice(format!("{:X}\r\n", payload.len()).as_bytes());
    output.extend_from_slice(payload);
    output.extend_from_slice(b"\r\n");
}

/// Split HTTP/1 metadata before decoding so matches cannot move between
/// permitted headers and forbidden query/body locations. Continuation reads
/// carry bytes only from the same body (or opaque stream).
fn detect_blocking_action_with_tail(
    ineligible_for_substitution: &[IneligibleSecret],
    prev_tail: &[u8],
    data: &[u8],
    headers: &str,
    protocol: RequestProtocol,
    location_hint: RequestLocation,
    http2_stream_id: Option<u32>,
) -> Option<SecretViolationReport> {
    if ineligible_for_substitution.is_empty() {
        return None;
    }

    let scan;
    let mut fragments = Vec::new();
    let summary = if matches!(protocol, RequestProtocol::Http1)
        && !headers.is_empty()
        && !is_scoped_fragment_location(location_hint)
    {
        let (request_line, metadata) = headers.split_once("\r\n").unwrap_or((headers, ""));
        if let Some((method, target, version)) = split_http_request_line(request_line) {
            fragments.push((method.as_bytes(), RequestLocation::Unknown));
            push_request_target_fragments(&mut fragments, target.as_bytes());
            fragments.push((version.as_bytes(), RequestLocation::Unknown));
        } else {
            fragments.push((request_line.as_bytes(), RequestLocation::Unknown));
        }

        fragments.push((metadata.as_bytes(), RequestLocation::Header));
        // Lossy UTF-8 decoding can expand header bytes; locate the body in the raw request.
        let body_start = find_header_boundary(data).unwrap_or(data.len());
        fragments.push((&data[body_start..], RequestLocation::Body));

        request_summary(headers, protocol)
    } else {
        scan = if prev_tail.is_empty() {
            Cow::Borrowed(data)
        } else {
            let mut stitched = Vec::with_capacity(prev_tail.len() + data.len());
            stitched.extend_from_slice(prev_tail);
            stitched.extend_from_slice(data);
            Cow::Owned(stitched)
        };

        fragments.push((scan.as_ref(), location_hint));
        RequestSummary::default()
    };

    detect_blocking_action_in_fragments(
        ineligible_for_substitution,
        &fragments,
        protocol,
        &summary,
        http2_stream_id,
    )
}

/// A URL path is never a substitution target. Split on the literal query
/// delimiter before decoding; an encoded question mark remains part of the path.
fn push_request_target_fragments<'a>(
    fragments: &mut Vec<(&'a [u8], RequestLocation)>,
    target: &'a [u8],
) {
    if let Some(query_start) = target.iter().position(|byte| *byte == b'?') {
        fragments.push((&target[..query_start], RequestLocation::Unknown));
        fragments.push((&target[query_start + 1..], RequestLocation::Query));
    } else {
        fragments.push((target, RequestLocation::Unknown));
    }
}

/// HTTP/2 pseudo-headers are structured fields, not an HTTP/1 request line.
fn detect_http2_header_blocking_action(
    secrets: &[IneligibleSecret],
    headers: &[(Vec<u8>, Vec<u8>)],
    summary: &RequestSummary,
    stream_id: u32,
) -> Option<SecretViolationReport> {
    let mut fragments = Vec::new();
    // Preserve field names so only Authorization values are decoded as Basic auth.
    let metadata: Vec<Vec<u8>> = headers
        .iter()
        .filter(|(name, _)| !name.starts_with(b":"))
        .map(|(name, value)| [name.as_slice(), b": ", value.as_slice()].concat())
        .collect();
    for (name, value) in headers {
        fragments.push((name.as_slice(), RequestLocation::Unknown));
        if name.eq_ignore_ascii_case(b":path") {
            push_request_target_fragments(&mut fragments, value);
        } else if name.starts_with(b":") {
            fragments.push((value.as_slice(), RequestLocation::Unknown));
        }
    }
    for line in &metadata {
        fragments.push((line.as_slice(), RequestLocation::Header));
    }
    detect_blocking_action_in_fragments(
        secrets,
        &fragments,
        RequestProtocol::Http2,
        summary,
        Some(stream_id),
    )
}

/// Check each location for placeholders not permitted on this connection.
/// A permitted secret must not mask another secret's encoded placeholder.
fn detect_blocking_action_in_fragments(
    secrets: &[IneligibleSecret],
    fragments: &[(&[u8], RequestLocation)],
    protocol: RequestProtocol,
    summary: &RequestSummary,
    http2_stream_id: Option<u32>,
) -> Option<SecretViolationReport> {
    if secrets.is_empty() {
        return None;
    }
    let opaque = matches!(protocol, RequestProtocol::Opaque);
    let mut detected = None;

    for &(data, location) in fragments {
        let url_decoded = data
            .contains(&b'%')
            .then(|| percent_decode(data).collect::<Vec<u8>>());
        let json_decoded = data
            .windows(2)
            .any(|window| window == b"\\u")
            .then(|| json_unescape(data));
        let basic_auth_credentials =
            if opaque || matches!(location, RequestLocation::Header | RequestLocation::Trailer) {
                decoded_basic_auth_credentials(&String::from_utf8_lossy(data))
            } else {
                Vec::new()
            };

        for secret in secrets {
            let needle = secret.placeholder.as_bytes();
            let matched = if basic_auth_credentials
                .iter()
                .any(|decoded| decoded.contains(&secret.placeholder))
            {
                Some((
                    if location == RequestLocation::Trailer {
                        location
                    } else {
                        RequestLocation::BasicAuth
                    },
                    PlaceholderMatchForm::BasicAuthDecoded,
                ))
            } else if contains_bytes(data, needle) {
                Some((location, PlaceholderMatchForm::Raw))
            } else if url_decoded
                .as_deref()
                .is_some_and(|decoded| contains_bytes(decoded, needle))
            {
                Some((location, PlaceholderMatchForm::PercentDecoded))
            } else if json_decoded
                .as_deref()
                .is_some_and(|decoded| contains_bytes(decoded, needle))
            {
                Some((location, PlaceholderMatchForm::JsonUnescaped))
            } else {
                None
            };

            if let Some((location, match_form)) = matched {
                let report = SecretViolationReport {
                    action: secret.action,
                    env_var: secret.env_var.clone(),
                    placeholder: secret.placeholder.clone(),
                    protocol,
                    location,
                    match_form,
                    method: summary.method.clone(),
                    path: summary.path.clone(),
                    host: summary.host.clone(),
                    http2_stream_id,
                };

                detected = Some(strictest_violation_report(detected, report));
            }
        }
    }

    detected
}

/// Locations whose bytes have already been separated from the request header
/// block by a protocol parser. Never combine them with adjacent locations.
fn is_scoped_fragment_location(location: RequestLocation) -> bool {
    matches!(
        location,
        RequestLocation::Body | RequestLocation::ChunkMetadata | RequestLocation::Trailer
    )
}

fn update_tail_buffer(tail: &mut Vec<u8>, data: &[u8], tail_size: usize) {
    if tail_size == 0 {
        tail.clear();
        return;
    }
    if data.len() >= tail_size {
        tail.clear();
        tail.extend_from_slice(&data[data.len() - tail_size..]);
        return;
    }
    tail.extend_from_slice(data);
    let overflow = tail.len().saturating_sub(tail_size);
    if overflow > 0 {
        tail.drain(..overflow);
    }
}

/// Consume chunked body bytes and return the position after the body when the
/// terminating zero chunk and trailers are complete.
fn consume_chunked_body(
    state: &mut ChunkedBodyState,
    data: &[u8],
) -> Result<Option<usize>, SecretViolationAction> {
    process_chunked_body(state, data, |_| Ok(()))
}

/// Process chunked body bytes and emit complete size/extension lines, decoded
/// payload slices, the terminating zero chunk, and complete trailer lines.
fn process_chunked_body<E>(
    state: &mut ChunkedBodyState,
    data: &[u8],
    mut on_event: E,
) -> Result<Option<usize>, SecretViolationAction>
where
    E: FnMut(ChunkedBodyEvent<'_>) -> Result<(), SecretViolationAction>,
{
    let mut cursor = 0;
    while cursor < data.len() {
        let phase = std::mem::replace(&mut state.phase, ChunkedPhase::SizeLine);
        match phase {
            ChunkedPhase::SizeLine => {
                state.line.push(data[cursor]);
                cursor += 1;
                if state.line.len() > MAX_HTTP_HEADER_BYTES {
                    return Err(SecretViolationAction::Block);
                }
                if state.line.ends_with(b"\r\n") {
                    let line = &state.line[..state.line.len() - 2];
                    let size = parse_chunk_size(line)?;
                    // Emit the complete bounded line before clearing it so a
                    // placeholder split across network reads is still scanned
                    // without a cross-location sliding tail.
                    on_event(ChunkedBodyEvent::SizeLine(&state.line))?;
                    state.line.clear();
                    state.phase = if size == 0 {
                        on_event(ChunkedBodyEvent::ZeroChunk)?;
                        ChunkedPhase::TrailerLine
                    } else {
                        ChunkedPhase::Data { remaining: size }
                    };
                } else {
                    state.phase = ChunkedPhase::SizeLine;
                }
            }
            ChunkedPhase::Data { mut remaining } => {
                let take = remaining.min(data.len() - cursor);
                on_event(ChunkedBodyEvent::Payload(&data[cursor..cursor + take]))?;
                cursor += take;
                remaining -= take;
                if remaining == 0 {
                    state.phase = ChunkedPhase::DataCrlf { seen_cr: false };
                } else {
                    state.phase = ChunkedPhase::Data { remaining };
                }
            }
            ChunkedPhase::DataCrlf { mut seen_cr } => {
                if !seen_cr {
                    if data[cursor] != b'\r' {
                        return Err(SecretViolationAction::Block);
                    }
                    seen_cr = true;
                    cursor += 1;
                    state.phase = ChunkedPhase::DataCrlf { seen_cr };
                } else {
                    if data[cursor] != b'\n' {
                        return Err(SecretViolationAction::Block);
                    }
                    state.phase = ChunkedPhase::SizeLine;
                    cursor += 1;
                }
            }
            ChunkedPhase::TrailerLine => {
                state.line.push(data[cursor]);
                cursor += 1;
                if state.line.len() > MAX_HTTP_HEADER_BYTES {
                    return Err(SecretViolationAction::Block);
                }
                if state.line.ends_with(b"\r\n") {
                    let is_empty = state.line.len() == 2;
                    on_event(ChunkedBodyEvent::TrailerLine(&state.line))?;
                    state.line.clear();
                    if is_empty {
                        return Ok(Some(cursor));
                    }
                    state.phase = ChunkedPhase::TrailerLine;
                } else {
                    state.phase = ChunkedPhase::TrailerLine;
                }
            }
        }
    }

    Ok(None)
}

fn parse_chunk_size(line: &[u8]) -> Result<usize, SecretViolationAction> {
    let size = line
        .split(|byte| *byte == b';')
        .next()
        .unwrap_or_default()
        .trim_ascii();
    if size.is_empty() {
        return Err(SecretViolationAction::Block);
    }
    let size = std::str::from_utf8(size).map_err(|_| SecretViolationAction::Block)?;
    usize::from_str_radix(size, 16).map_err(|_| SecretViolationAction::Block)
}

/// Returns the stricter of two blocking actions, where
/// `BlockAndTerminate` > `BlockAndLog` > `Block`.
fn strictest_violation_report(
    current: Option<SecretViolationReport>,
    candidate: SecretViolationReport,
) -> SecretViolationReport {
    let Some(current) = current else {
        return candidate;
    };
    if candidate.action.priority() > current.action.priority() {
        candidate
    } else {
        current
    }
}

impl BlockingAction {
    fn priority(self) -> u8 {
        match self {
            Self::Block => 0,
            Self::BlockAndLog => 1,
            Self::BlockAndTerminate => 2,
        }
    }
}

impl SecretViolationReport {
    fn apply_request_summary(&mut self, summary: &RequestSummary) {
        if self.method.is_none() {
            self.method = summary.method.clone();
        }
        if self.path.is_none() {
            self.path = summary.path.clone();
        }
        if self.host.is_none() {
            self.host = summary.host.clone();
        }
    }
}

//--------------------------------------------------------------------------------------------------
// Tests
//--------------------------------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;
    use crate::engine::secrets::hpack::tests::{PANICKING_BLOCKS, Rng, random_block};
    use crate::netstack::shared::{ResolvedHostnameFamily, SharedState};
    use crate::secrets::config::SecretSubstitution;
    use microsandbox_types::compat;

    use std::net::{IpAddr, Ipv4Addr};
    use std::time::Duration;

    #[test]
    fn legacy_header_scopes_merge_for_http1_and_http2() {
        for headers in [false, true] {
            for basic_auth in [false, true] {
                let mut wire = serde_json::json!({"on_violation":"block", "secrets":[{
                    "env_var":"KEY", "value":"real-secret", "placeholder":"$KEY",
                    "allowed_hosts":[{"exact":"api.example.com"}],
                    "injection":{"headers":headers,"basic_auth":basic_auth,"query_params":true},
                    "passthrough_hosts":[{"exact":"api.example.com"}],
                    "require_tls_identity":false
                }]});
                compat::v0_5_0::local::secrets::to_current(wire.as_object_mut().unwrap()).unwrap();
                let config: SecretsConfig = serde_json::from_value(wire).unwrap();
                let headers = headers || basic_auth;
                let basic = BASE64.encode("user:$KEY");
                let input = format!(
                    "GET /?key=$KEY HTTP/1.1\r\nHost: api.example.com\r\nAuthorization: Basic {basic}\r\nX-Key: $KEY\r\n\r\n"
                );
                for tls in [false, true] {
                    let mut handler = SecretsHandler::new(&config, "api.example.com", tls);
                    let output = handler.substitute(input.as_bytes()).unwrap();
                    let output = String::from_utf8(output.into_owned()).unwrap();
                    let expected_basic = BASE64.encode(if headers {
                        "user:real-secret"
                    } else {
                        "user:$KEY"
                    });
                    assert!(
                        output.contains(&format!("Authorization: Basic {expected_basic}")),
                        "{output}"
                    );
                    assert!(
                        output.contains(if headers {
                            "X-Key: real-secret"
                        } else {
                            "X-Key: $KEY"
                        }),
                        "{output}"
                    );
                    assert!(output.contains("/?key=real-secret"), "{output}");
                    let mut h2 = vec![
                        (b":path".to_vec(), b"/?key=$KEY".to_vec()),
                        (
                            b"authorization".to_vec(),
                            format!("Basic {basic}").into_bytes(),
                        ),
                        (b"x-key".to_vec(), b"$KEY".to_vec()),
                    ];
                    handler.substitute_http2_headers(&mut h2);
                    assert_eq!(h2[1].1, format!("Basic {expected_basic}").as_bytes());
                    assert_eq!(
                        h2[2].1,
                        if headers {
                            b"real-secret".as_slice()
                        } else {
                            b"$KEY".as_slice()
                        }
                    );
                }
                let mut denied = SecretsHandler::new(&config, "denied.example", true);
                assert!(denied.substitute(input.as_bytes()).is_err());
            }
        }
    }

    #[test]
    fn decoded_v06_policy_uses_current_disabled_body_enforcement() {
        let mut wire = serde_json::json!({"on_violation":"block", "secrets":[{
            "env_var":"KEY", "value":"real-secret", "placeholder":"$KEY",
            "allowed_hosts":[{"exact":"api.example.com"}],
            "injection":{"headers":true,"basic_auth":true,"query_params":false,"body":false},
            "require_tls_identity":false
        }]});
        compat::v0_5_0::local::secrets::to_current(wire.as_object_mut().unwrap()).unwrap();
        let config: SecretsConfig = serde_json::from_value(wire).unwrap();
        let request = b"POST / HTTP/1.1\r\nHost: api.example.com\r\nContent-Length: 4\r\n\r\n$KEY";
        let mut handler = SecretsHandler::new(&config, "api.example.com", true);
        assert_eq!(handler.substitute(request).unwrap().as_ref(), request);
        let mut denied = SecretsHandler::new(&config, "denied.example", true);
        assert_eq!(
            denied.substitute(request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn global_passthrough_preserves_fallback_and_per_secret_overrides() {
        let input = b"GET / HTTP/1.1\r\nX-Key: $KEY\r\n\r\n";
        let mut secret = make_secret("$KEY", "real-secret", "allowed.example");
        secret.passthrough_hosts = vec![HostPattern::Exact("entry.example".into())];
        let mut config = make_config(vec![secret]);
        config.passthrough_hosts = Some(vec![HostPattern::Exact("global.example".into())]);
        config.violation_action = SecretViolationAction::BlockAndLog;
        for host in ["entry.example", "global.example"] {
            let mut handler = SecretsHandler::new(&config, host, true);
            assert_eq!(handler.substitute(input).unwrap().as_ref(), input);
        }
        let mut denied = SecretsHandler::new(&config, "denied.example", true);
        assert_eq!(
            denied.substitute(input).unwrap_err(),
            SecretViolationAction::BlockAndLog
        );
        config.secrets[0].passthrough_hosts.clear();
        config.secrets[0].violation_action = Some(SecretViolationAction::BlockAndTerminate);
        let mut overridden = SecretsHandler::new(&config, "global.example", true);
        assert_eq!(
            overridden.substitute(input).unwrap_err(),
            SecretViolationAction::BlockAndTerminate
        );
        // The global default also applies to a secret added later without an override.
        config.secrets[0].violation_action = None;
        let mut inherited = SecretsHandler::new(&config, "global.example", true);
        assert_eq!(inherited.substitute(input).unwrap().as_ref(), input);
    }

    fn make_config(secrets: Vec<SecretEntry>) -> SecretsConfig {
        SecretsConfig {
            passthrough_hosts: None,
            secrets,
            violation_action: SecretViolationAction::Block,
        }
    }

    fn make_secret(placeholder: &str, value: &str, host: &str) -> SecretEntry {
        SecretEntry {
            env_var: "TEST_KEY".into(),
            value: zeroize::Zeroizing::new(value.into()),
            source: None,
            placeholder: placeholder.into(),
            allowed_hosts: vec![HostPattern::Exact(host.into())],
            substitution: SecretSubstitution::default(),
            passthrough_hosts: Vec::new(),
            violation_action: None,
            require_tls_identity: true,
        }
    }

    fn make_passthrough_secret(placeholder: &str, value: &str, host: &str) -> SecretEntry {
        let mut secret = make_secret(placeholder, value, host);
        secret.passthrough_hosts = vec![HostPattern::Exact(host.into())];
        secret
    }

    fn cache_host(shared: &SharedState, host: &str, ip: Ipv4Addr) {
        shared.cache_resolved_hostname(
            host,
            ResolvedHostnameFamily::Ipv4,
            [IpAddr::V4(ip)],
            Duration::from_secs(60),
        );
    }

    fn basic_auth_only() -> SecretSubstitution {
        SecretSubstitution {
            headers: true,
            header_fields: Vec::new(),
            query: false,
            body: false,
        }
    }

    fn plain_http_policy_handler(config: &SecretsConfig) -> SecretsHandler {
        let ip = Ipv4Addr::new(203, 0, 113, 10);
        let shared = Arc::new(SharedState::new(16));
        cache_host(&shared, "a.example", ip);
        cache_host(&shared, "b.example", ip);
        SecretsHandler::new_plain_http_policy(
            config,
            "a.example",
            SocketAddr::new(IpAddr::V4(ip), 80),
            Arc::new(NetworkPolicy::allow_all()),
            shared,
        )
    }

    #[test]
    fn plain_http_policy_keeps_secret_identity_across_allowed_host_switch() {
        let mut secret = make_secret("$KEY", "real-secret", "a.example");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = plain_http_policy_handler(&config);
        let first = handler
            .substitute(b"GET /one HTTP/1.1\r\nHost: a.example\r\nAuth: $KEY\r\n\r\n")
            .unwrap();
        assert!(String::from_utf8_lossy(&first).contains("Auth: real-secret"));

        // Both hosts resolve to the same IP and are network-allowed, but only A
        // is permitted to receive this secret. The second request must not leak it.
        assert!(
            handler
                .substitute(b"GET\t/two HTTP/1.1\r\nHost: b.exam")
                .unwrap()
                .is_empty()
        );
        assert_eq!(
            handler
                .substitute(b"ple\r\nAuth: $KEY\r\n\r\n")
                .unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn plain_http_policy_keeps_passthrough_identity_across_host_switch() {
        let mut secret = make_secret("$KEY", "real-secret", "secret.example");
        secret.passthrough_hosts = vec![HostPattern::Exact("a.example".into())];
        let config = make_config(vec![secret]);
        let mut handler = plain_http_policy_handler(&config);
        let first = b"GET /one HTTP/1.1\r\nHost: a.example\r\nAuth: $KEY\r\n\r\n";
        assert_eq!(handler.substitute(first).unwrap().as_ref(), first);
        assert_eq!(
            handler
                .substitute(b"GET /two HTTP/1.1\r\nHost: b.example\r\nAuth: $KEY\r\n\r\n",)
                .unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn plain_http_policy_preserves_secret_free_host_switches() {
        let mut handler = plain_http_policy_handler(&SecretsConfig::default());
        let pipeline = b"GET /one HTTP/1.1\r\nHost: a.example\r\n\r\nGET /two HTTP/1.1\r\nHost: b.example\r\n\r\n";
        assert_eq!(handler.substitute(pipeline).unwrap().as_ref(), pipeline);
    }

    #[test]
    fn plain_http_policy_preserves_host_agnostic_secret_switches() {
        let mut secret = make_secret("$KEY", "real-secret", "a.example");
        secret.allowed_hosts = vec![HostPattern::Any];
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = plain_http_policy_handler(&config);
        let second = handler
            .substitute(b"GET / HTTP/1.1\r\nHost: b.example\r\nAuth: $KEY\r\n\r\n")
            .unwrap();
        assert!(String::from_utf8_lossy(&second).contains("Auth: real-secret"));
    }

    #[test]
    fn plain_http_policy_keeps_secret_identity_for_http2_authority() {
        let mut secret = make_secret("$KEY", "real-secret", "a.example");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = plain_http_policy_handler(&config);
        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"http"),
                (b":authority", b"b.example"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );
        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    fn split_http_body(data: &[u8]) -> (&[u8], &[u8]) {
        let boundary = find_header_boundary(data).expect("HTTP header boundary");
        data.split_at(boundary)
    }

    fn decode_chunked_payload(data: &[u8]) -> (Vec<u8>, Vec<u8>, usize) {
        let mut cursor = 0;
        let mut decoded = Vec::new();
        let mut trailers = Vec::new();

        loop {
            let line_end = data[cursor..]
                .windows(2)
                .position(|window| window == b"\r\n")
                .map(|pos| cursor + pos)
                .expect("chunk size line");
            let size = parse_chunk_size(&data[cursor..line_end]).expect("valid chunk size");
            cursor = line_end + 2;

            if size == 0 {
                loop {
                    let trailer_end = data[cursor..]
                        .windows(2)
                        .position(|window| window == b"\r\n")
                        .map(|pos| cursor + pos + 2)
                        .expect("trailer line");
                    trailers.extend_from_slice(&data[cursor..trailer_end]);
                    let empty = trailer_end - cursor == 2;
                    cursor = trailer_end;
                    if empty {
                        return (decoded, trailers, cursor);
                    }
                }
            }

            decoded.extend_from_slice(&data[cursor..cursor + size]);
            cursor += size;
            assert_eq!(&data[cursor..cursor + 2], b"\r\n");
            cursor += 2;
        }
    }

    fn encode_h2_header_block(headers: &[(&[u8], &[u8])]) -> Vec<u8> {
        let mut encoder = HpackEncoder::with_dynamic_size(4096);
        let mut block = Vec::new();
        for (name, value) in headers {
            encoder
                .encode(
                    (name.to_vec(), value.to_vec(), HpackEncoder::NEVER_INDEXED),
                    &mut block,
                )
                .unwrap();
        }
        block
    }

    fn h2_request(headers: &[(&[u8], &[u8])], end_stream: bool) -> Vec<u8> {
        let encoded = encode_h2_header_block(headers);
        let mut out = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut out, 0x4, 0, 0, &[]).unwrap();
        append_http2_header_frames(&mut out, 1, end_stream, &encoded).unwrap();
        out
    }

    fn h2_request_with_split_headers(headers: &[(&[u8], &[u8])], split_at: usize) -> Vec<u8> {
        let encoded = encode_h2_header_block(headers);
        let split_at = split_at.min(encoded.len());
        let mut out = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut out, 0x4, 0, 0, &[]).unwrap();
        append_http2_frame(&mut out, HTTP2_FRAME_HEADERS, 0, 1, &encoded[..split_at]).unwrap();
        append_http2_frame(
            &mut out,
            HTTP2_FRAME_CONTINUATION,
            HTTP2_FLAG_END_HEADERS | HTTP2_FLAG_END_STREAM,
            1,
            &encoded[split_at..],
        )
        .unwrap();
        out
    }

    fn h2_request_with_data(headers: &[(&[u8], &[u8])], data: &[u8]) -> Vec<u8> {
        let mut out = h2_request(headers, false);
        append_http2_frame(&mut out, HTTP2_FRAME_DATA, HTTP2_FLAG_END_STREAM, 1, data).unwrap();
        out
    }

    fn append_h2_headers(
        out: &mut Vec<u8>,
        stream_id: u32,
        headers: &[(&[u8], &[u8])],
        end_stream: bool,
    ) {
        let encoded = encode_h2_header_block(headers);
        append_http2_header_frames(out, stream_id, end_stream, &encoded).unwrap();
    }

    fn decode_first_h2_headers(data: &[u8]) -> Vec<(Vec<u8>, Vec<u8>)> {
        assert!(data.starts_with(HTTP2_PREFACE));
        let mut cursor = HTTP2_PREFACE.len();
        let mut decoder = HpackDecoder::with_dynamic_size(4096);
        let mut header_block = Vec::new();
        let mut in_headers = false;

        while cursor + 9 <= data.len() {
            let len = http2_frame_payload_len(&data[cursor..cursor + 9]);
            let raw = &data[cursor..cursor + 9 + len];
            cursor += 9 + len;
            let frame = parse_http2_frame(raw).unwrap();
            match frame.kind {
                HTTP2_FRAME_HEADERS => {
                    header_block.extend_from_slice(
                        http2_headers_fragment(frame.flags, frame.payload).unwrap(),
                    );
                    if frame.flags & HTTP2_FLAG_END_HEADERS != 0 {
                        break;
                    }
                    in_headers = true;
                }
                HTTP2_FRAME_CONTINUATION if in_headers => {
                    header_block.extend_from_slice(frame.payload);
                    if frame.flags & HTTP2_FLAG_END_HEADERS != 0 {
                        break;
                    }
                }
                _ => {}
            }
        }

        let mut encoded = header_block;
        let mut headers = Vec::new();
        decoder.decode(&mut encoded, &mut headers).unwrap();
        headers
            .into_iter()
            .map(|(name, value, _flags)| (name, value))
            .collect()
    }

    fn h2_header_value(headers: &[(Vec<u8>, Vec<u8>)], name: &[u8]) -> String {
        let value = headers
            .iter()
            .find(|(header_name, _)| header_name.eq_ignore_ascii_case(name))
            .map(|(_, value)| value.as_slice())
            .expect("header present");
        String::from_utf8(value.to_vec()).unwrap()
    }

    #[test]
    fn violation_report_includes_secret_and_basic_auth_context() {
        let secret = IneligibleSecret {
            env_var: "OPENAI_API_KEY".into(),
            placeholder: "$KEY".into(),
            action: BlockingAction::BlockAndLog,
        };
        let encoded = BASE64.encode(b"user:$KEY");
        let headers = format!(
            "POST /v1/chat/completions?token=redacted HTTP/1.1\r\nHost: evil.example.com\r\nAuthorization: Basic {encoded}\r\n\r\n"
        );

        let report = detect_blocking_action_with_tail(
            &[secret],
            &[],
            headers.as_bytes(),
            &headers,
            RequestProtocol::Http1,
            RequestLocation::Unknown,
            None,
        )
        .expect("violation report");

        assert_eq!(report.action, BlockingAction::BlockAndLog);
        assert_eq!(report.env_var, "OPENAI_API_KEY");
        assert_eq!(report.placeholder, "$KEY");
        assert_eq!(report.location, RequestLocation::BasicAuth);
        assert!(matches!(
            report.match_form,
            PlaceholderMatchForm::BasicAuthDecoded
        ));
        assert_eq!(report.method.as_deref(), Some("POST"));
        assert_eq!(report.path.as_deref(), Some("/v1/chat/completions"));
        assert_eq!(report.host.as_deref(), Some("evil.example.com"));
    }

    #[test]
    fn violation_report_classifies_percent_decoded_query_match() {
        let secret = IneligibleSecret {
            env_var: "SERVICE_TOKEN".into(),
            placeholder: "abc/key".into(),
            action: BlockingAction::BlockAndLog,
        };
        let headers =
            "GET /leak?token=abc%2Fkey&other=redacted HTTP/1.1\r\nHost: evil.example.com\r\n\r\n";

        let report = detect_blocking_action_with_tail(
            &[secret],
            &[],
            headers.as_bytes(),
            headers,
            RequestProtocol::Http1,
            RequestLocation::Unknown,
            None,
        )
        .expect("violation report");

        assert_eq!(report.env_var, "SERVICE_TOKEN");
        assert_eq!(report.location, RequestLocation::Query);
        assert!(matches!(
            report.match_form,
            PlaceholderMatchForm::PercentDecoded
        ));
        assert_eq!(report.method.as_deref(), Some("GET"));
        assert_eq!(report.path.as_deref(), Some("/leak"));
        assert_eq!(report.host.as_deref(), Some("evil.example.com"));
    }

    #[test]
    fn http1_harmless_encoding_preserves_substitution_across_reads() {
        for body in [
            r#"{"x":"plain"}"#,
            r#"{"x":"100%"}"#,
            r#"{"x":"a%20b"}"#,
            r#"{"x":"\u0041"}"#,
            r#"{"x":"\\user"}"#,
        ] {
            for query in [false, true] {
                let mut secret = make_secret("$KEY", "real-secret", "api.example.com");
                secret.substitution.headers = !query;
                secret.substitution.query = query;
                let config = make_config(vec![secret]);
                let target = if query { "/?key=$KEY" } else { "/" };
                let auth = if query {
                    ""
                } else {
                    "Authorization: Bearer $KEY\r\n"
                };
                let request = format!(
                    "POST {target} HTTP/1.1\r\nHost: api.example.com\r\n{auth}Content-Length: {}\r\n\r\n{body}",
                    body.len()
                );
                let expected = request.replace("$KEY", "real-secret");
                for split in 0..=request.len() {
                    let mut handler = SecretsHandler::new(&config, "api.example.com", true);
                    let mut output = Vec::new();
                    for bytes in [&request.as_bytes()[..split], &request.as_bytes()[split..]] {
                        if bytes.is_empty() {
                            continue;
                        }
                        output.extend_from_slice(&handler.substitute(bytes).unwrap_or_else(
                            |action| {
                                panic!("body={body:?}, query={query}, split={split}: {action:?}")
                            },
                        ));
                    }
                    assert_eq!(output, expected.as_bytes(), "body={body:?}, split={split}");
                }
            }
        }
    }

    #[test]
    fn http1_every_body_byte_preserves_header_substitution() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.example.com")]);
        for byte in 0..=u8::MAX {
            // Every byte is legal in an HTTP body, including NUL and invalid UTF-8.
            let bodies = [
                vec![byte],
                format!("%{byte:02X}").into_bytes(),
                format!(r"\u{byte:04x}").into_bytes(),
            ];
            for body in bodies {
                let headers = format!(
                    "POST / HTTP/1.1\r\nHost: api.example.com\r\nAuthorization: Bearer $KEY\r\nContent-Length: {}\r\n\r\n",
                    body.len()
                );
                let mut request = headers.as_bytes().to_vec();
                request.extend_from_slice(&body);
                let mut expected = headers.replace("$KEY", "real-secret").into_bytes();
                expected.extend_from_slice(&body);
                for split in 0..=request.len() {
                    let mut handler = SecretsHandler::new(&config, "api.example.com", true);
                    let mut output = Vec::new();
                    for bytes in [&request[..split], &request[split..]] {
                        if !bytes.is_empty() {
                            output.extend_from_slice(&handler.substitute(bytes).unwrap_or_else(
                                |action| {
                                    panic!(
                                        "byte={byte:02x}, body={body:?}, split={split}: {action:?}"
                                    )
                                },
                            ));
                        }
                    }
                    assert_eq!(
                        output, expected,
                        "byte={byte:02x}, body={body:?}, split={split}"
                    );
                }
            }
        }
    }

    #[test]
    fn http1_unrelated_header_and_query_characters_preserve_substitution() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.example.com")]);
        for byte in 0..=u8::MAX {
            // Encode arbitrary query bytes; header values permit printable ASCII.
            let note = if (b' '..=b'~').contains(&byte) {
                char::from(byte).to_string()
            } else {
                format!(r"\u{byte:04x}")
            };
            let request = format!(
                "GET /?note=%{byte:02X} HTTP/1.1\r\nHost: api.example.com\r\nAuthorization: Bearer $KEY\r\nX-Note: {note}\r\n\r\n"
            );
            let mut handler = SecretsHandler::new(&config, "api.example.com", true);
            assert_eq!(
                handler.substitute(request.as_bytes()).unwrap().as_ref(),
                request.replace("$KEY", "real-secret").as_bytes(),
                "byte={byte:02x}"
            );
        }
    }

    #[test]
    fn http1_allowed_header_cannot_mask_forbidden_encoded_locations() {
        let basic = format!("Authorization: Basic {}\r\n", BASE64.encode(b"user:$KEY"));
        let mut notes = vec![
            Vec::new(),
            b"X-Note: %20\r\n".to_vec(),
            b"X-Note: \\u0041\r\n".to_vec(),
        ];
        // HTTP header values permit obs-text bytes, which need not be valid UTF-8.
        notes.extend(
            (0x80..=u8::MAX).map(|byte| [b"X-Note: ".as_slice(), &[byte], b"\r\n"].concat()),
        );
        for auth in ["Authorization: Bearer $KEY\r\n", basic.as_str()] {
            for body in ["$BLOCKED", "%24BLOCKED", r"\u0024BLOCKED"] {
                for note in &notes {
                    let config = make_config(vec![
                        make_secret("$KEY", "real-secret", "api.example.com"),
                        make_secret("$BLOCKED", "other-secret", "other.example"),
                    ]);
                    let mut request =
                        format!("POST / HTTP/1.1\r\nHost: api.example.com\r\n{auth}").into_bytes();
                    request.extend_from_slice(note);
                    request.extend_from_slice(
                        format!("Content-Length: {}\r\n\r\n{body}", body.len()).as_bytes(),
                    );
                    for split in 0..=request.len() {
                        let mut handler = SecretsHandler::new(&config, "api.example.com", true);
                        let mut blocked = false;
                        for bytes in [&request[..split], &request[split..]] {
                            if bytes.is_empty() {
                                continue;
                            }
                            if let Err(action) = handler.substitute(bytes) {
                                assert_eq!(action, SecretViolationAction::Block);
                                blocked = true;
                                break;
                            }
                        }
                        assert!(
                            blocked,
                            "auth={auth:?}, note={note:?}, body={body:?}, split={split}"
                        );
                    }
                }
            }
        }
    }

    #[test]
    fn http_request_locations_enforce_the_same_policy_in_both_protocols() {
        for target in ["/", "/$KEY", "/%24KEY", "/?key=$KEY", "/?key=%24KEY"] {
            for header_value in ["plain", "$KEY", "%24KEY"] {
                for headers in [false, true] {
                    for query in [false, true] {
                        let mut secret = make_secret("$KEY", "real-secret", "api.example.com");
                        secret.substitution.headers = headers;
                        secret.substitution.query = query;
                        secret.substitution.body = true;
                        let config = make_config(vec![secret]);
                        let expected_target = match target.split_once('?') {
                            Some((path, value)) if query => {
                                format!("{path}?{}", value.replace("$KEY", "real-secret"))
                            }
                            _ => target.to_string(),
                        };
                        let expected_header = if headers {
                            header_value.replace("$KEY", "real-secret")
                        } else {
                            header_value.to_string()
                        };
                        for http2 in [false, true] {
                            let mut handler = SecretsHandler::new(&config, "api.example.com", true);
                            let request = if http2 {
                                h2_request(
                                    &[
                                        (b":method", b"GET"),
                                        (b":scheme", b"https"),
                                        (b":authority", b"api.example.com"),
                                        (b":path", target.as_bytes()),
                                        (b"x-key", header_value.as_bytes()),
                                    ],
                                    true,
                                )
                            } else {
                                format!("GET {target} HTTP/1.1\r\nHost: api.example.com\r\nX-Key: {header_value}\r\n\r\n").into_bytes()
                            };
                            let output = handler.substitute(&request).unwrap();
                            if http2 {
                                let fields = decode_first_h2_headers(&output);
                                assert_eq!(h2_header_value(&fields, b":path"), expected_target);
                                assert_eq!(h2_header_value(&fields, b"x-key"), expected_header);
                            } else {
                                assert_eq!(output.as_ref(), format!("GET {expected_target} HTTP/1.1\r\nHost: api.example.com\r\nX-Key: {expected_header}\r\n\r\n").as_bytes());
                            }
                        }
                    }
                }
            }
        }
    }
    #[test]
    fn substitute_in_headers() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "GET / HTTP/1.1\r\nAuthorization: Bearer real-secret\r\n\r\n"
        );
    }

    #[test]
    fn header_field_allowlist_scopes_substitution() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.header_fields = vec!["authorization".into()];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\nX-Trace: redacted\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "GET / HTTP/1.1\r\nAuthorization: Bearer real-secret\r\nX-Trace: redacted\r\n\r\n"
        );
    }

    #[test]
    fn header_field_allowlist_forwards_placeholder_in_other_headers() {
        // A placeholder in a non-allowlisted header is a disabled location: on
        // a trusted destination it is forwarded unchanged, not substituted.
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.header_fields = vec!["authorization".into()];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET / HTTP/1.1\r\nX-Other: $KEY\r\nAuthorization: Bearer redacted\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(output.as_ref(), input);
    }

    #[test]
    fn empty_header_field_allowlist_substitutes_every_header() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET / HTTP/1.1\r\nX-Custom: $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "GET / HTTP/1.1\r\nX-Custom: real-secret\r\n\r\n"
        );
    }

    #[test]
    fn header_field_allowlist_scopes_basic_auth() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.header_fields = vec!["authorization".into()];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let encoded = BASE64.encode(b"user:$KEY");
        let input = format!("GET / HTTP/1.1\r\nAuthorization: Basic {encoded}\r\n\r\n");
        let output = handler.substitute(input.as_bytes()).unwrap();
        let auth = String::from_utf8(output.into_owned())
            .unwrap()
            .split("Authorization: Basic ")
            .nth(1)
            .unwrap()
            .trim()
            .to_string();
        assert_eq!(BASE64.decode(auth).unwrap(), b"user:real-secret");
    }

    #[test]
    fn header_field_allowlist_forwards_basic_auth_when_authorization_excluded() {
        // Excluding `authorization` from the allowlist leaves the encoded Basic
        // credential placeholder unchanged on a trusted destination.
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.header_fields = vec!["x-api-key".into()];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let encoded = BASE64.encode(b"user:$KEY");
        let input = format!("GET / HTTP/1.1\r\nAuthorization: Basic {encoded}\r\n\r\n");
        let output = handler.substitute(input.as_bytes()).unwrap();
        assert_eq!(output.as_ref(), input.as_bytes());
    }

    #[test]
    fn header_field_allowlist_scopes_http2_substitution() {
        let ip = Ipv4Addr::new(203, 0, 113, 60);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.header_fields = vec!["authorization".into()];
        let config = make_config(vec![secret]);

        let allowed = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let output = handler.substitute(&allowed).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(
            h2_header_value(&headers, b"authorization"),
            "Bearer real-secret"
        );

        let forwarded = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
                (b"x-trace", b"$KEY"),
            ],
            true,
        );
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let output = handler.substitute(&forwarded).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(h2_header_value(&headers, b"x-trace"), "$KEY");
    }

    #[test]
    fn tls_intercepted_http2_encoded_query_is_forwarded_when_query_scope_disabled() {
        let ip = Ipv4Addr::new(203, 0, 113, 61);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        // Default substitution enables headers but not the query. On a trusted
        // destination a percent-encoded placeholder in the `:path` query is a
        // disabled location and is forwarded unchanged.
        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/?token=%24KEY"),
            ],
            true,
        );
        let output = handler.substitute(&request).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(h2_header_value(&headers, b":path"), "/?token=%24KEY");
    }

    #[test]
    fn no_substitute_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_http1_post_is_not_misclassified_as_http2_preface() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        assert_eq!(handler.substitute(b"P").unwrap().as_ref(), b"");

        let output = handler
            .substitute(b"OST / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n")
            .unwrap();
        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "POST / HTTP/1.1\r\nAuthorization: Bearer real-secret\r\n\r\n"
        );
    }

    #[test]
    fn allowed_placeholder_substitutes_when_another_secret_is_ineligible() {
        let allowed = make_secret("$ALLOWED", "allowed-secret", "api.openai.com");
        let blocked = make_secret("$BLOCKED", "blocked-secret", "api.github.com");
        let config = make_config(vec![allowed, blocked]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $ALLOWED\r\n\r\n";
        let output = handler.substitute(input).unwrap();

        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "GET / HTTP/1.1\r\nAuthorization: Bearer allowed-secret\r\n\r\n"
        );
    }

    #[test]
    fn same_placeholder_substitutes_when_duplicate_secret_is_ineligible() {
        let allowed = make_secret("$KEY", "real-secret", "api.github.com");
        let mut duplicate_host = make_secret("$KEY", "real-secret", "unused.example.com");
        duplicate_host.allowed_hosts =
            vec![HostPattern::Wildcard("*.githubusercontent.com".into())];
        let config = make_config(vec![allowed, duplicate_host]);
        let mut handler = SecretsHandler::new(&config, "api.github.com", true);

        let input =
            b"POST /user HTTP/1.1\r\nAuthorization: Bearer $KEY\r\nContent-Length: 4\r\n\r\n$KEY";
        let output = handler.substitute(input).unwrap();

        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "POST /user HTTP/1.1\r\nAuthorization: Bearer real-secret\r\nContent-Length: 4\r\n\r\n$KEY"
        );
    }

    #[test]
    fn passthrough_host_forwards_placeholder_unchanged() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Exact("api.anthropic.com".into())];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.anthropic.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(&*output, input);
    }

    #[test]
    fn per_secret_passthrough_host_forwards_placeholder_unchanged() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Exact("api.anthropic.com".into())];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.anthropic.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(&*output, input);
    }

    #[test]
    fn any_host_passthrough_forwards_disallowed_placeholder_unchanged() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Any];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(&*output, input);
    }

    #[test]
    fn passthrough_only_connection_has_no_handler_work() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Any];
        let config = make_config(vec![secret]);
        let handler = SecretsHandler::new(&config, "evil.com", true);

        assert!(handler.is_empty());
    }

    #[test]
    fn passthrough_host_does_not_allow_other_disallowed_placeholders() {
        let mut passthrough = make_secret("$PASSTHROUGH", "real-secret-a", "api.openai.com");
        passthrough.passthrough_hosts = vec![HostPattern::Exact("api.anthropic.com".into())];
        let blocked = make_secret("$BLOCKED", "real-secret-b", "api.github.com");
        let config = make_config(vec![passthrough, blocked]);
        let mut handler = SecretsHandler::new(&config, "api.anthropic.com", true);

        let input = b"GET / HTTP/1.1\r\nX-A: $PASSTHROUGH\r\nX-B: $BLOCKED\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn per_secret_passthrough_blocks_for_non_matching_host() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Exact("api.anthropic.com".into())];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn passthrough_blocks_for_non_matching_host() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Exact("api.anthropic.com".into())];
        let mut config = make_config(vec![secret]);
        config.violation_action = SecretViolationAction::BlockAndLog;
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::BlockAndLog
        );
    }

    #[test]
    fn global_block_and_terminate_marks_violation_as_terminating() {
        let mut config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        config.violation_action = SecretViolationAction::BlockAndTerminate;
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::BlockAndTerminate
        );
    }

    #[test]
    fn per_secret_block_and_terminate_marks_violation_as_terminating() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.violation_action = Some(SecretViolationAction::BlockAndTerminate);
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::BlockAndTerminate
        );
    }

    #[test]
    fn disabled_body_substitution_preserves_placeholder_only_for_verified_allowed_host() {
        let body = b"{\"key\":\"$KEY\"}";
        for action in [
            SecretViolationAction::Block,
            SecretViolationAction::BlockAndLog,
            SecretViolationAction::BlockAndTerminate,
        ] {
            for host in ["api.example.com", "denied.example"] {
                for pinned in [false, true] {
                    for framing in ["fixed", "chunked", "http2"] {
                        let ip = Ipv4Addr::new(203, 0, 113, 10);
                        let shared = SharedState::new(16);
                        if pinned {
                            cache_host(&shared, host, ip);
                        }
                        let mut secret = make_secret("$KEY", "real-secret", "api.example.com");
                        secret.violation_action = Some(action.clone());
                        let config = make_config(vec![secret]);
                        let mut handler = SecretsHandler::new_tls_intercepted(
                            &config,
                            host,
                            IpAddr::V4(ip),
                            &shared,
                        );
                        let request = if framing == "http2" {
                            h2_request_with_data(
                                &[
                                    (b":method", b"POST"),
                                    (b":scheme", b"https"),
                                    (b":authority", host.as_bytes()),
                                    (b":path", b"/"),
                                ],
                                body,
                            )
                        } else if framing == "chunked" {
                            [
                                format!(
                                    "POST / HTTP/1.1\r\nHost: {host}\r\nTransfer-Encoding: chunked\r\n\r\n{:x}\r\n",
                                    body.len()
                                )
                                .as_bytes(),
                                body,
                                b"\r\n0\r\n\r\n",
                            ]
                            .concat()
                        } else {
                            [
                                format!(
                                    "POST / HTTP/1.1\r\nHost: {host}\r\nContent-Length: {}\r\n\r\n",
                                    body.len()
                                )
                                .as_bytes(),
                                body,
                            ]
                            .concat()
                        };
                        let result = handler.substitute(&request);
                        if pinned && host == "api.example.com" {
                            let output = result.unwrap();
                            if framing == "http2" {
                                assert!(output.ends_with(body));
                                assert!(!contains_bytes(&output, b"real-secret"));
                            } else {
                                assert_eq!(output.as_ref(), request);
                            }
                        } else {
                            assert_eq!(result.unwrap_err(), action);
                        }
                    }
                }
            }
        }
    }

    #[test]
    #[allow(deprecated)] // Both public names must enforce the same network policy.
    fn placeholder_permission_keeps_substitution_and_blocking_independent() {
        for legacy in [None, Some(false), Some(true)] {
            let secret = crate::config::builder::SecretBuilder::new()
                .env("API_KEY")
                .value("real-secret")
                .placeholder("$KEY")
                .allow("api.openai.com");
            let secret = match legacy {
                Some(true) => secret.allow_passthrough_for("placeholder.example"),
                Some(false) => secret.allow_placeholder_for("placeholder.example"),
                None => secret,
            };
            let config = make_config(vec![secret.build()]);
            let input = b"POST / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\nContent-Length: 15\r\n\r\n{\"key\": \"$KEY\"}";
            let mut allowed = SecretsHandler::new(&config, "api.openai.com", true);
            let output =
                String::from_utf8(allowed.substitute(input).unwrap().into_owned()).unwrap();
            assert!(output.contains("Authorization: Bearer real-secret"));
            assert!(output.contains("{\"key\": \"$KEY\"}"));
            let mut placeholder_host = SecretsHandler::new(&config, "placeholder.example", true);
            if legacy.is_some() {
                assert_eq!(placeholder_host.substitute(input).unwrap().as_ref(), input);
            } else {
                assert_eq!(
                    placeholder_host.substitute(input).unwrap_err(),
                    SecretViolationAction::Block
                );
            }
            let mut forbidden = SecretsHandler::new(&config, "evil.example.com", true);
            assert_eq!(
                forbidden.substitute(input).unwrap_err(),
                SecretViolationAction::Block
            );
        }
    }

    #[test]
    fn body_injection_when_enabled() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nContent-Length: 15\r\n\r\n{\"key\": \"$KEY\"}";
        let output = handler.substitute(input).unwrap();
        assert_eq!(
            String::from_utf8(output.into_owned()).unwrap(),
            "POST / HTTP/1.1\r\nContent-Length: 22\r\n\r\n{\"key\": \"real-secret\"}"
        );
    }

    #[test]
    fn body_injection_updates_content_length() {
        let mut secret = make_secret("$KEY", "a]longer]secret]value", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let body = "{\"key\": \"$KEY\"}";
        let input = format!(
            "POST / HTTP/1.1\r\nContent-Length: {}\r\n\r\n{}",
            body.len(),
            body
        );
        let output = handler.substitute(input.as_bytes()).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();

        let expected_body = "{\"key\": \"a]longer]secret]value\"}";
        assert!(result.contains(expected_body));
        assert!(result.contains(&format!("Content-Length: {}", expected_body.len())));
    }

    #[test]
    fn body_injection_buffers_until_content_length_complete() {
        let mut secret = make_secret("$KEY", "longer-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let body = b"{\"key\":\"$KEY\"}";
        let mut chunk1 = format!(
            "POST / HTTP/1.1\r\nHost: api.openai.com\r\nContent-Length: {}\r\n\r\n",
            body.len()
        )
        .into_bytes();
        chunk1.extend_from_slice(&body[..5]);

        let out1 = handler.substitute(&chunk1).unwrap();
        assert!(out1.is_empty());

        let out2 = handler.substitute(&body[5..]).unwrap();
        let result = String::from_utf8(out2.into_owned()).unwrap();
        let expected_body = "{\"key\":\"longer-secret\"}";
        assert!(result.contains(expected_body));
        assert!(result.contains(&format!("Content-Length: {}", expected_body.len())));
    }

    #[test]
    fn body_injection_blocks_content_length_over_buffer_limit() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = format!(
            "POST / HTTP/1.1\r\nHost: api.openai.com\r\nContent-Length: {}\r\n\r\n",
            MAX_HTTP_BODY_BUFFER_BYTES + 1
        );

        assert_eq!(
            handler.substitute(input.as_bytes()).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn invalid_content_length_is_blocked() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input =
            b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nContent-Length: nope\r\n\r\nxx$KEYyy";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn conflicting_content_lengths_are_blocked() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nContent-Length: 8\r\nContent-Length: 9\r\n\r\nxx$KEYyy";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn body_injection_no_content_length_header() {
        let mut secret = make_secret("$KEY", "longer-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        // Chunked requests do not carry Content-Length; body substitution
        // decodes and re-encodes chunked framing instead.
        let input =
            b"POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\nF\r\n{\"key\": \"$KEY\"}\r\n0\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();
        assert!(!result.contains("$KEY"));
        assert!(result.contains("longer-secret"));
        assert!(!result.contains("Content-Length"));
    }

    #[test]
    fn chunked_body_injection_rewrites_split_placeholder_across_chunks() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nxx$K\r\n2\r\nEY\r\n0\r\n\r\n";
        let output = handler.substitute(input).unwrap().into_owned();
        let (_, body) = split_http_body(&output);
        let (decoded, trailers, consumed) = decode_chunked_payload(body);

        assert_eq!(decoded, b"xxreal-secret");
        assert_eq!(trailers, b"\r\n");
        assert_eq!(consumed, body.len());
    }

    #[test]
    fn chunked_body_injection_rewrites_placeholder_split_across_tls_reads() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let chunk1 = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n4\r\nxx$K\r\n";
        let chunk2 = b"2\r\nEY\r\n0\r\n\r\n";

        let mut output = handler.substitute(chunk1).unwrap().into_owned();
        output.extend_from_slice(handler.substitute(chunk2).unwrap().as_ref());
        let (_, body) = split_http_body(&output);
        let (decoded, trailers, consumed) = decode_chunked_payload(body);

        assert_eq!(decoded, b"xxreal-secret");
        assert_eq!(trailers, b"\r\n");
        assert_eq!(consumed, body.len());
    }

    #[test]
    fn chunked_body_injection_preserves_trailers_and_recurses_to_next_request() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let mut input = b"POST /a HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n$KEY\r\n0\r\nX-Trailer: yes\r\n\r\n".to_vec();
        input.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: api.openai.com\r\nAuth: $KEY\r\n\r\n");

        let output = handler.substitute(&input).unwrap().into_owned();
        let (_, body_and_next) = split_http_body(&output);
        let (decoded, trailers, consumed) = decode_chunked_payload(body_and_next);
        let next_request = &body_and_next[consumed..];

        assert_eq!(decoded, b"real-secret");
        assert_eq!(trailers, b"X-Trailer: yes\r\n\r\n");
        assert_eq!(
            next_request,
            b"GET /b HTTP/1.1\r\nHost: api.openai.com\r\nAuth: real-secret\r\n\r\n"
        );
    }

    #[test]
    fn chunked_body_injection_blocks_content_encoded_placeholder() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\nContent-Encoding: gzip\r\n\r\n4\r\n$KEY\r\n0\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn unsupported_transfer_encoding_chain_is_blocked() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: gzip, chunked\r\n\r\n4\r\n$KEY\r\n0\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn transfer_encoding_with_content_length_is_blocked() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\nContent-Length: 4\r\n\r\n4\r\n$KEY\r\n0\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_chunked_body_payload_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n2\r\n$K\r\n2\r\nEY\r\n0\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_chunked_trailer_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let first = b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nx\r\n0\r\nX-Token: $K";
        assert_eq!(handler.substitute(first).unwrap().as_ref(), first);
        assert_eq!(
            handler.substitute(b"EY\r\n\r\n").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_chunked_trailer_preserves_placeholder_on_allowed_host() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        // Trailers are not part of the substitutable header section. The
        // rewrite path buffers this partial line, then forwards the placeholder
        // unchanged because this destination is allowed to receive the credential.
        let first = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nx\r\n0\r\nX-Token: $K";
        let output = handler.substitute(first).unwrap();
        assert!(!output.as_ref().ends_with(b"$K"));
        assert_eq!(
            handler.substitute(b"EY\r\n\r\n").unwrap().as_ref(),
            b"X-Token: $KEY\r\n\r\n"
        );
    }

    #[test]
    fn split_chunk_extension_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let first =
            b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n1;token=$K";
        assert_eq!(handler.substitute(first).unwrap().as_ref(), first);
        assert_eq!(
            handler.substitute(b"EY\r\nx\r\n0\r\n\r\n").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_chunk_extension_blocks_during_body_rewrite() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![
            secret,
            make_secret("$BLOCKED", "other-secret", "other.example"),
        ]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let first = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n1;token=$B";
        let output = handler.substitute(first).unwrap();
        assert!(!output.as_ref().ends_with(b"$B"));
        assert_eq!(
            handler.substitute(b"LOCKED\r\nx\r\n0\r\n\r\n").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn chunked_passthrough_allows_split_metadata_placeholders() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.passthrough_hosts = vec![HostPattern::Exact("evil.com".into())];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let fragments: [&[u8]; 3] = [
            b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n1;token=$K",
            b"EY\r\nx\r\n0\r\nX-Token: $K",
            b"EY\r\n\r\n",
        ];
        for fragment in fragments {
            assert_eq!(handler.substitute(fragment).unwrap().as_ref(), fragment);
        }
    }

    #[test]
    fn chunked_rewrite_substitutes_body_and_preserves_passthrough_trailer() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        secret.passthrough_hosts = vec![HostPattern::Exact("api.openai.com".into())];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nTransfer-Encoding: chunked\r\n\r\n4\r\n$KEY\r\n0\r\nX-Token: $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap().into_owned();
        let (_, body) = split_http_body(&output);
        let (decoded, trailers, consumed) = decode_chunked_payload(body);

        assert_eq!(decoded, b"real-secret");
        assert_eq!(trailers, b"X-Token: $KEY\r\n\r\n");
        assert_eq!(consumed, body.len());
    }

    #[test]
    fn chunked_detection_does_not_join_distinct_protocol_locations() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        // None of these semantic locations contains the complete placeholder:
        // a chunk extension ends in `$K`, payload starts with `EY`, a later
        // payload ends in `$K`, and the trailer starts with `EY`.
        let input = b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n2;note=$K\r\nEY\r\n2\r\n$K\r\n0\r\nEY: yes\r\n\r\n";
        assert_eq!(handler.substitute(input).unwrap().as_ref(), input);
    }

    #[test]
    fn basic_auth_placeholder_in_chunked_trailer_is_blocked() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        // base64("admin:$KEY") has no raw placeholder bytes, so trailer
        // detection must retain the encoded Basic-auth scan used by headers.
        let input = b"POST / HTTP/1.1\r\nHost: evil.com\r\nTransfer-Encoding: chunked\r\n\r\n0\r\nAuthorization: Basic YWRtaW46JEtFWQ==\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn chunked_trailer_violation_keeps_original_request_context() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);
        handler.http1_request_summary = Some(http1_request_summary(
            "POST /upload?ignored=yes HTTP/1.1\r\nHost: evil.com\r\n\r\n",
        ));

        let trailer = b"Authorization: Basic YWRtaW46JEtFWQ==\r\n";
        let report = handler
            .detect_http1_fragment_blocking_action(
                &[],
                trailer,
                std::str::from_utf8(trailer).unwrap(),
                RequestLocation::Trailer,
            )
            .unwrap();

        assert_eq!(report.location, RequestLocation::Trailer);
        assert!(matches!(
            report.match_form,
            PlaceholderMatchForm::BasicAuthDecoded
        ));
        assert_eq!(report.method.as_deref(), Some("POST"));
        assert_eq!(report.path.as_deref(), Some("/upload"));
        assert_eq!(report.host.as_deref(), Some("evil.com"));
    }

    #[test]
    fn oversized_secret_placeholder_is_rejected() {
        let placeholder = "x".repeat(MAX_SECRET_PLACEHOLDER_BYTES + 1);
        let config = make_config(vec![make_secret(
            &placeholder,
            "real-secret",
            "api.openai.com",
        )]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        assert_eq!(
            handler.substitute(b"GET / HTTP/1.1\r\n\r\n").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn header_only_substitution_preserves_content_length() {
        let config = make_config(vec![make_secret("$KEY", "longer-value", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input =
            b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\nContent-Length: 5\r\n\r\nhello";
        let output = handler.substitute(input).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();
        // Body unchanged, Content-Length should stay 5.
        assert!(result.contains("Content-Length: 5"));
        assert!(result.ends_with("hello"));
    }

    #[test]
    fn eligible_secret_preserves_binary_body_without_placeholder() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let body = vec![0x1f, 0x8b, 0x08, 0x00, 0xff, 0x00, 0x80, 0xfe];
        let mut input = format!(
            "POST /git-upload-pack HTTP/1.1\r\nContent-Encoding: gzip\r\nContent-Length: {}\r\n\r\n",
            body.len()
        )
        .into_bytes();
        input.extend_from_slice(&body);

        let output = handler.substitute(&input).unwrap();
        assert_eq!(&*output, input.as_slice());
    }

    #[test]
    fn body_injection_blocks_content_encoded_placeholder() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let body = b"compressed-looking-$KEY-bytes";
        let mut input = format!(
            "POST /git-upload-pack HTTP/1.1\r\nContent-Encoding: gzip\r\nContent-Length: {}\r\n\r\n",
            body.len()
        )
        .into_bytes();
        input.extend_from_slice(body);

        assert_eq!(
            handler.substitute(&input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn body_injection_blocks_split_content_encoded_placeholder() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let first = b"POST /git-upload-pack HTTP/1.1\r\nContent-Encoding: gzip\r\nContent-Length: 4\r\n\r\n$K";

        let output = handler.substitute(first).unwrap();
        assert_eq!(&*output, first.as_slice());
        assert_eq!(
            handler.substitute(b"EY").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn eligible_secret_preserves_binary_chunk_without_placeholder() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = [0x1f, 0x8b, 0x08, 0x00, 0xff, 0x00, 0x80, 0xfe];
        let output = handler.substitute(&input).unwrap();
        assert_eq!(&*output, input.as_slice());
    }

    #[test]
    fn body_injection_preserves_non_utf8_bytes() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let body = [0xff, b'$', b'K', b'E', b'Y', 0xfe];
        let mut input =
            format!("POST / HTTP/1.1\r\nContent-Length: {}\r\n\r\n", body.len()).into_bytes();
        input.extend_from_slice(&body);

        let output = handler.substitute(&input).unwrap().into_owned();
        let expected_body = [b"\xffreal-secret".as_slice(), &[0xfe]].concat();
        let expected = [
            format!(
                "POST / HTTP/1.1\r\nContent-Length: {}\r\n\r\n",
                expected_body.len()
            )
            .as_bytes(),
            expected_body.as_slice(),
        ]
        .concat();

        assert_eq!(output, expected);
    }

    #[test]
    fn no_secrets_passthrough() {
        let config = make_config(vec![]);
        let mut handler = SecretsHandler::new(&config, "anything.com", true);

        let input = b"GET / HTTP/1.1\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert_eq!(&*output, input);
    }

    #[test]
    fn require_tls_identity_blocks_on_non_intercepted() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        // tls_intercepted = false — secret requires TLS identity
        let mut handler = SecretsHandler::new(&config, "api.openai.com", false);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn new_plain_http_blocks_require_tls_identity_secrets() {
        // new_plain_http must NOT substitute require_tls_identity=true secrets
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let shared = SharedState::new(4);
        let ip = Ipv4Addr::new(1, 2, 3, 4);
        cache_host(&shared, "api.openai.com", ip);
        let mut handler =
            SecretsHandler::new_plain_http(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"POST / HTTP/1.1\r\nHost: api.openai.com\r\nContent-Length: 4\r\n\r\n$KEY";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn new_plain_http_substitutes_when_tls_identity_not_required() {
        // new_plain_http MUST substitute secrets with require_tls_identity=false
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let shared = SharedState::new(4);
        let ip = Ipv4Addr::new(1, 2, 3, 4);
        cache_host(&shared, "api.openai.com", ip);
        let mut handler =
            SecretsHandler::new_plain_http(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"POST / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\nHost: api.openai.com\r\nContent-Length: 4\r\n\r\n$KEY";
        let output = handler.substitute(input).unwrap();
        assert_eq!(output.as_ref(), b"POST / HTTP/1.1\r\nAuthorization: Bearer real-secret\r\nHost: api.openai.com\r\nContent-Length: 4\r\n\r\n$KEY");
    }

    #[test]
    fn new_plain_http_invalid_host_blocks_host_bound_secret() {
        // Host could not be proven: a host-bound secret must not be substituted,
        // and its placeholder must not leak unchanged to the server.
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        // violation_action is Block, so the placeholder is blocked, not forwarded.
        assert!(handler.substitute(input).is_err());
    }

    #[test]
    fn new_plain_http_invalid_host_substitutes_when_all_secrets_any() {
        // When every secret allows HostPattern::Any the host is irrelevant, so
        // substitution is allowed even with no provable host.
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        secret.allowed_hosts = vec![HostPattern::Any];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        assert!(
            String::from_utf8(output.into_owned())
                .unwrap()
                .contains("real-secret")
        );
    }

    #[test]
    fn new_plain_http_invalid_host_blocks_any_secret_when_mixed() {
        // The all-Any exception is all-or-nothing: a single host-bound secret
        // alongside an Any secret makes every secret ineligible.
        let mut any_secret = make_secret("$ANY", "any-value", "api.openai.com");
        any_secret.require_tls_identity = false;
        any_secret.allowed_hosts = vec![HostPattern::Any];
        let mut bound_secret = make_secret("$BOUND", "bound-value", "api.openai.com");
        bound_secret.require_tls_identity = false;
        let config = make_config(vec![any_secret, bound_secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        // Even the Any secret's placeholder is now blocked, not substituted.
        let input = b"GET / HTTP/1.1\r\nAuthorization: Bearer $ANY\r\n\r\n";
        assert!(handler.substitute(input).is_err());
    }

    #[test]
    fn opaque_prefix_never_receives_secret_substitution() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        secret.allowed_hosts = vec![HostPattern::Any];
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let input = b"BINARY3 v1\0opaque\r\nAuthorization: $KEY\r\n\r\n";

        assert_eq!(handler.substitute(input).unwrap().as_ref(), input);
    }

    #[test]
    fn opaque_prefix_blocks_basic_auth_encoded_placeholder() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let input = b"BINARY3 v1\0\r\nAuthorization: Basic dXNlcjokS0VZ\r\n\r\n";

        assert_eq!(handler.substitute(input), Err(SecretViolationAction::Block));
    }

    #[test]
    fn opaque_prefix_blocks_basic_auth_split_after_long_prefix() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let decoded_prefix = format!("user:{}", "x".repeat(97));
        assert_eq!(decoded_prefix.len() % 3, 0);
        let encoded_prefix = BASE64.encode(&decoded_prefix);
        let encoded = BASE64.encode(format!("{decoded_prefix}$KEY"));
        let first = format!("BINARY3 v1\0\r\nAuthorization: Basic {encoded_prefix}");

        assert_eq!(
            handler.substitute(first.as_bytes()).unwrap(),
            first.as_bytes()
        );
        assert_eq!(
            handler.substitute(format!("{}\r\n\r\n", &encoded[encoded_prefix.len()..]).as_bytes()),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn opaque_prefix_forwards_oversized_authorization_like_data() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let mut input = b"BINARY3 v1\0\r\naUtHoRiZaTiOn: ".to_vec();
        input.resize(input.len() + MAX_HTTP_HEADER_BYTES + 1, b'x');

        assert_eq!(handler.substitute(&input).unwrap(), input.as_slice());
    }

    #[test]
    fn opaque_prefix_blocks_oversized_basic_auth_split_placeholder() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let decoded_prefix = vec![b'x'; 3 * (MAX_HTTP_HEADER_BYTES / 4 + 1)];
        let encoded_prefix = BASE64.encode(&decoded_prefix);
        let encoded = BASE64.encode([decoded_prefix.as_slice(), b"$KEY"].concat());
        let first = format!("BINARY3 v1\0\r\nAuthorization: Basic {encoded_prefix}");

        assert_eq!(
            handler.substitute(first.as_bytes()).unwrap(),
            first.as_bytes()
        );
        assert_eq!(
            handler.substitute(format!("{}\r\n", &encoded[encoded_prefix.len()..]).as_bytes()),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn opaque_prefix_blocks_basic_auth_with_split_header_name() {
        let config = make_config(vec![make_secret("$", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);
        let first = b"BINARY3 v1\0opaque\r\nAuthorizatio";

        assert_eq!(handler.substitute(first).unwrap(), &first[..]);
        assert_eq!(
            handler.substitute(b"n: Basic dXNlcjok\r\n\r\n"),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn opaque_prefix_blocks_placeholder_split_across_writes() {
        let mut secret = make_secret("$MSB_KEY", "real-secret", "api.openai.com");
        secret.require_tls_identity = false;
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        assert_eq!(
            handler.substitute(b"BINARY3 v1\0opaque $MS").unwrap(),
            &b"BINARY3 v1\0opaque $MS"[..]
        );
        assert_eq!(
            handler.substitute(b"B_KEY\0request"),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn opaque_prefix_keeps_later_ascii_writes_opaque() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        assert_eq!(
            handler.substitute(b"BINARY3 v1\0opaque").unwrap(),
            &b"BINARY3 v1\0opaque"[..]
        );
        assert_eq!(handler.substitute(b"PING").unwrap(), &b"PING"[..]);
    }

    #[test]
    fn tab_delimited_non_http_prefix_is_not_buffered() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new_plain_http_invalid_host(&config);

        assert_eq!(
            handler.substitute(b"PING\tpayload").unwrap(),
            &b"PING\tpayload"[..]
        );
    }

    #[test]
    fn opaque_prefix_uses_connection_policy() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let mut handler = plain_http_policy_handler(&config);

        assert_eq!(
            handler.substitute(b"AMQP\0\0\x09\x01").unwrap(),
            &b"AMQP\0\0\x09\x01"[..]
        );
        assert_eq!(
            handler.substitute(b"PING HTTP/1.1").unwrap(),
            &b"PING HTTP/1.1"[..]
        );
        assert_eq!(
            handler.substitute(b" $KEY"),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn http_shaped_binary_control_is_blocked_when_authority_is_required() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let mut handler = plain_http_policy_handler(&config);

        assert_eq!(
            handler.substitute(b"GET\0 / HTTP/1.1\r\nHost: b.example\r\n\r\n"),
            Err(SecretViolationAction::Block)
        );
    }

    #[test]
    fn basic_auth_decodes_substitutes_and_reencodes_credentials() {
        let mut user = make_secret("$MSB_USER", "alice", "api.openai.com");
        user.env_var = "USER".into();
        user.substitution = basic_auth_only();
        let mut password = make_secret("$MSB_PASSWORD", "s3cr3t", "api.openai.com");
        password.env_var = "PASSWORD".into();
        password.substitution = basic_auth_only();
        let config = make_config(vec![user, password]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let encoded = BASE64.encode(b"$MSB_USER:$MSB_PASSWORD");
        let input = format!("GET / HTTP/1.1\r\nAuthorization: Basic {encoded}\r\n\r\n");
        let output = handler.substitute(input.as_bytes()).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();

        assert!(result.contains(&format!(
            "Authorization: Basic {}",
            BASE64.encode(b"alice:s3cr3t")
        )));
        assert!(!result.contains("$MSB_USER"));
        assert!(!result.contains("$MSB_PASSWORD"));
    }

    #[test]
    fn basic_auth_encoded_placeholder_is_blocked_for_wrong_host() {
        let mut secret = make_secret("$MSB_PASSWORD", "s3cr3t", "api.openai.com");
        secret.substitution = basic_auth_only();
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let encoded = BASE64.encode(b"user:$MSB_PASSWORD");
        let input = format!("GET / HTTP/1.1\r\nAuthorization: Basic {encoded}\r\n\r\n");

        assert_eq!(
            handler.substitute(input.as_bytes()).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn basic_auth_encoded_placeholder_is_not_replaced_when_scope_disabled() {
        let mut secret = make_secret("$MSB_PASSWORD", "s3cr3t", "api.openai.com");
        secret.substitution = SecretSubstitution {
            headers: false,
            header_fields: Vec::new(),
            query: false,
            body: true,
        };
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let encoded = BASE64.encode(b"user:$MSB_PASSWORD");
        let input = format!("GET / HTTP/1.1\r\nAuthorization: Basic {encoded}\r\n\r\n");
        assert_eq!(
            handler.substitute(input.as_bytes()).unwrap().as_ref(),
            input.as_bytes()
        );
    }

    #[test]
    fn query_params_substitution() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution = SecretSubstitution {
            headers: false,
            header_fields: Vec::new(),
            query: true,
            body: false,
        };
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET /api?key=$KEY HTTP/1.1\r\nHost: api.openai.com\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();
        // Request line should be substituted.
        assert!(result.contains("GET /api?key=real-secret HTTP/1.1"));
        // Other headers should NOT be substituted.
    }

    #[test]
    fn query_params_do_not_substitute_path() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution = SecretSubstitution {
            headers: false,
            header_fields: Vec::new(),
            query: true,
            body: false,
        };
        let config = make_config(vec![secret]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET /path/$KEY?token=$KEY HTTP/1.1\r\nHost: api.openai.com\r\n\r\n";
        let output = handler.substitute(input).unwrap();
        let result = String::from_utf8(output.into_owned()).unwrap();

        assert!(result.contains("GET /path/$KEY?token=real-secret HTTP/1.1"));
    }

    #[test]
    fn header_injection_does_not_substitute_request_line_query() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);

        let input = b"GET /api?key=$KEY HTTP/1.1\r\nHost: api.openai.com\r\n\r\n";
        assert_eq!(handler.substitute(input).unwrap().as_ref(), input);
    }

    #[test]
    fn url_encoded_placeholder_in_query_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        // `%24KEY` is the URL-encoded form of `$KEY`.
        let input = b"GET /api?token=%24KEY HTTP/1.1\r\nHost: evil.com\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn url_encoded_placeholder_in_body_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let input = b"POST / HTTP/1.1\r\nContent-Length: 13\r\n\r\nkey=%24KEY&x=1";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn json_escaped_placeholder_in_body_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        // `$KEY` is the JSON unicode-escape form of `$KEY`.
        let input =
            b"POST / HTTP/1.1\r\nContent-Type: application/json\r\n\r\n{\"k\":\"\\u0024KEY\"}";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_url_encoded_placeholder_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let chunk1 = b"POST / HTTP/1.1\r\nHost: evil.com\r\nContent-Length: 14\r\n\r\nkey=%24K";
        let chunk2 = b"EY&x=1";

        assert!(handler.substitute(chunk1).is_ok());
        assert_eq!(
            handler.substitute(chunk2).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_json_escaped_placeholder_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let chunk1 =
            b"POST / HTTP/1.1\r\nHost: evil.com\r\nContent-Length: 17\r\n\r\n{\"k\":\"\\u0024K";
        let chunk2 = b"EY\"}";

        assert!(handler.substitute(chunk1).is_ok());
        assert_eq!(
            handler.substitute(chunk2).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn placeholder_split_across_writes_blocks_for_wrong_host() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        // Send the placeholder bytes across two separate substitute() calls.
        let first = b"GET / HTTP/1.1\r\nX-Token: $K";
        let second = b"EY\r\nHost: evil.com\r\n\r\n";

        // The first chunk doesn't contain the full placeholder, so it forwards.
        assert!(handler.substitute(first).is_ok());
        // The second chunk completes the placeholder when stitched with the tail.
        assert_eq!(
            handler.substitute(second).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn split_headers_do_not_leak_header_secret_into_body() {
        let config = make_config(vec![make_passthrough_secret(
            "$KEY",
            "real-secret",
            "example.com",
        )]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let chunk1 = b"POST /upload HTTP/1.1\r\nHost: example.com\r\nContent-Length: 8\r\n";
        let out1 = handler.substitute(chunk1).unwrap();
        assert!(out1.is_empty());

        let chunk2 = b"\r\nxx$KEYyy";
        let out2 = handler.substitute(chunk2).unwrap();
        let result = String::from_utf8(out2.into_owned()).unwrap();

        assert!(result.contains("xx$KEYyy"));
        assert!(!result.contains("real-secret"));
    }

    #[test]
    fn url_decoded_contains_basic() {
        assert!(url_decoded_contains(b"foo%24KEYbar", b"$KEY"));
        assert!(!url_decoded_contains(b"fooKEYbar", b"$KEY"));
        // Invalid escapes pass through unchanged.
        assert!(url_decoded_contains(b"%2", b"%2"));
    }

    #[test]
    fn json_escaped_contains_basic() {
        assert!(json_escaped_contains(b"\"\\u0024KEY\"", b"$KEY"));
        assert!(json_escaped_contains(
            b"\\u0024\\u004B\\u0045\\u0059",
            b"$KEY"
        ));
        assert!(!json_escaped_contains(b"KEY", b"$KEY"));
    }

    #[test]
    fn body_in_separate_chunk_preserves_non_utf8_bytes() {
        // substitute() is called once per chunk from the TLS stream. A
        // single HTTP request can arrive as (headers) then (body) in
        // separate calls; the second call carries body bytes with no
        // `\r\n\r\n` boundary and must be recognised as body continuation,
        // not parsed as a fresh request.
        //
        // The body embeds a literal `$KEY` between non-UTF-8 bytes. Without
        // framing state the continuation chunk is parsed as headers,
        // `may_substitute_in_headers` finds the placeholder, the chunk is
        // lossy-decoded (mangling the surrounding bytes), and the
        // header-only secret leaks into the body.
        let config = make_config(vec![make_passthrough_secret(
            "$KEY",
            "real-secret",
            "example.com",
        )]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        // Chunk 1: headers only; Content-Length announces 13 body bytes.
        let chunk1 = b"POST /upload HTTP/1.1\r\nHost: example.com\r\nContent-Length: 13\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        // Chunk 2: 13 body bytes, no boundary marker. `$KEY` sits between
        // 0xff / 0xfe bytes so misclassification corrupts both.
        let mut body: Vec<u8> = vec![0x00, 0x80, 0xc0, 0xff, 0xfe];
        body.extend_from_slice(b"$KEY");
        body.extend_from_slice(&[0x81, 0xc1, 0xee, 0xef]);
        assert_eq!(body.len(), 13);

        let out = handler.substitute(&body).unwrap();
        assert_eq!(out.as_ref(), body.as_slice());
    }

    #[test]
    fn body_split_across_two_chunks_round_trips() {
        // Body bytes arrive across two substitute() calls: the first chunk
        // carries headers + the first slice of body, the second chunk
        // carries the remainder. Both halves must pass through byte-for-byte
        // (the state machine decrements `remaining` correctly).
        //
        // The second chunk embeds a literal `$KEY` between non-UTF-8 bytes,
        // so a regression where continuation chunks fall back to the header
        // path both leaks the secret and clobbers the surrounding bytes.
        let config = make_config(vec![make_passthrough_secret(
            "$KEY",
            "real-secret",
            "example.com",
        )]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let mut body: Vec<u8> = vec![0x00, 0x80, 0xc0, 0xff, 0xfe, 0xfd, 0xfc];
        body.extend_from_slice(b"$KEY");
        body.extend_from_slice(&[0x81, 0xc1, 0xee, 0xef]);
        assert_eq!(body.len(), 15);

        let mut chunk1 =
            b"POST /upload HTTP/1.1\r\nHost: example.com\r\nContent-Length: 15\r\n\r\n".to_vec();
        chunk1.extend_from_slice(&body[..5]);

        let out1 = handler.substitute(&chunk1).unwrap();
        let boundary = out1
            .windows(4)
            .position(|w| w == b"\r\n\r\n")
            .map(|p| p + 4)
            .unwrap();
        assert_eq!(&out1[boundary..], &body[..5]);

        let out2 = handler.substitute(&body[5..]).unwrap();
        assert_eq!(out2.as_ref(), &body[5..]);
    }

    #[test]
    fn framing_state_resets_after_request_completes() {
        // Once a body has been fully forwarded, the next chunk must be
        // parsed as a fresh request — not continued as body. A regression
        // here would silently treat the next request line as body bytes.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let body: Vec<u8> = vec![0x00, 0x80, 0xc0, 0xff, 0xfe];
        let mut chunk1 =
            b"POST /a HTTP/1.1\r\nHost: example.com\r\nContent-Length: 5\r\n\r\n".to_vec();
        chunk1.extend_from_slice(&body);
        handler.substitute(&chunk1).unwrap();

        // Second request on the same connection. With state correctly reset
        // to AwaitingHeaders, this is parsed normally and forwarded.
        let chunk2 = b"GET /b HTTP/1.1\r\nHost: example.com\r\n\r\n";
        let out2 = handler.substitute(chunk2).unwrap();
        assert_eq!(out2.as_ref(), chunk2.as_slice());
    }

    #[test]
    fn violation_detected_in_body_continuation_chunk() {
        // Placeholder bytes for a host that is not allowed to receive the
        // real secret arrive in a body-continuation chunk. The body-only
        // path must still run violation detection.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let chunk1 = b"POST /a HTTP/1.1\r\nHost: evil.com\r\nContent-Length: 16\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        let chunk2 = b"prefix:$KEY:suffix";
        assert_eq!(
            handler.substitute(chunk2).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn header_only_secret_preserves_placeholder_in_body_continuation_chunk() {
        // Security regression: a secret with the default substitution scopes
        // (substitute_headers=true, substitute_body=false) must NOT substitute its
        // placeholder when the placeholder appears in body bytes. Without
        // the framing fix, a body-continuation chunk was parsed as headers
        // and run through `substitute_in_headers`, which replaces the
        // placeholder on every line — leaking the real secret value into a
        // request body the user explicitly opted out of injecting into.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        // Chunk 1: headers only. Content-Length announces 24 body bytes.
        let chunk1 = b"POST /upload HTTP/1.1\r\nHost: example.com\r\nContent-Length: 24\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        // Chunk 2: ASCII body containing a literal `$KEY` token. The
        // placeholder must remain unchanged, never replaced with the secret value.
        let body = b"prefix:$KEY:more-padding";
        assert_eq!(body.len(), 24);
        assert_eq!(handler.substitute(body).unwrap().as_ref(), body);
    }

    #[test]
    fn pipelined_request_in_body_continuation_chunk_is_substituted() {
        // HTTP/1.1 pipelining: request 1's body ends partway through chunk
        // 2 and request 2's headers follow in the same chunk. Without
        // recursion into the spillover, request 2's bytes are forwarded
        // verbatim as body and its substitutable placeholder never
        // reaches the substitution loop.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        // Chunk 1: request 1 headers + 4 of 5 body bytes.
        let mut chunk1 =
            b"POST /a HTTP/1.1\r\nHost: example.com\r\nContent-Length: 5\r\n\r\n".to_vec();
        chunk1.extend_from_slice(b"abcd");
        handler.substitute(&chunk1).unwrap();

        // Chunk 2: last body byte, then a complete pipelined request with
        // `$KEY` in a header.
        let mut chunk2 = b"e".to_vec();
        chunk2.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out = handler.substitute(&chunk2).unwrap();

        let mut expected = b"e".to_vec();
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn pipelined_request_in_same_chunk_as_headers_is_substituted() {
        // Headers-path pipelining: a single chunk carries request 1's
        // headers + complete body + the start of request 2. The header
        // parser must scope the body to Content-Length and recurse on
        // the trailing bytes; otherwise request 2's headers get treated
        // as request 1's body and no substitution runs.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let mut chunk =
            b"POST /a HTTP/1.1\r\nHost: example.com\r\nContent-Length: 5\r\n\r\n".to_vec();
        chunk.extend_from_slice(b"abcde");
        chunk.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out = handler.substitute(&chunk).unwrap();

        let mut expected =
            b"POST /a HTTP/1.1\r\nHost: example.com\r\nContent-Length: 5\r\n\r\n".to_vec();
        expected.extend_from_slice(b"abcde");
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn three_pipelined_requests_in_one_chunk_all_substitute() {
        // Three pipelined requests in one chunk. The recursion nests
        // twice. Each request has a substitutable placeholder in a
        // header that must be replaced.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let r1 =
            b"POST /a HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\nContent-Length: 3\r\n\r\nbod";
        let r2 =
            b"PUT /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\nContent-Length: 2\r\n\r\nXY";
        let r3 = b"GET /c HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n";
        let mut chunk = Vec::new();
        chunk.extend_from_slice(r1);
        chunk.extend_from_slice(r2);
        chunk.extend_from_slice(r3);

        let out = handler.substitute(&chunk).unwrap();

        let r1_out = b"POST /a HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\nContent-Length: 3\r\n\r\nbod";
        let r2_out = b"PUT /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\nContent-Length: 2\r\n\r\nXY";
        let r3_out = b"GET /c HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n";
        let mut expected = Vec::new();
        expected.extend_from_slice(r1_out);
        expected.extend_from_slice(r2_out);
        expected.extend_from_slice(r3_out);

        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn pipelined_spillover_without_substitution_stays_zero_copy() {
        // No eligible secret matches this host; the chunk just needs to
        // be forwarded. Even with a pipelined boundary inside the chunk,
        // the output should be the original borrowed slice (no allocation).
        let config = make_config(vec![make_secret("$KEY", "real-secret", "other.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let r1 = b"POST /a HTTP/1.1\r\nHost: example.com\r\nContent-Length: 3\r\n\r\nbod";
        let r2 = b"GET /b HTTP/1.1\r\nHost: example.com\r\n\r\n";
        let mut chunk = Vec::new();
        chunk.extend_from_slice(r1);
        chunk.extend_from_slice(r2);

        let out = handler.substitute(&chunk).unwrap();
        assert!(matches!(out, Cow::Borrowed(_)));
        assert_eq!(out.as_ref(), chunk.as_slice());
    }

    #[test]
    fn violation_in_pipelined_next_request_basic_auth_is_detected() {
        // Request 1's body ends in this chunk and request 2's headers
        // follow. Request 2 carries `Authorization: Basic <b64>` whose
        // decoded credentials contain a placeholder for a host that is
        // NOT allowed to receive the real secret. The base64 form
        // has no literal `$KEY` bytes, so the body-path byte scan
        // cannot see it. Only the recursive header pass decodes the
        // credentials and detects the violation.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "evil.com", true);

        let chunk1 = b"POST /a HTTP/1.1\r\nHost: evil.com\r\nContent-Length: 3\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        // base64("admin:$KEY") = "YWRtaW46JEtFWQ==" - no literal `$KEY` in the
        // encoded form, so byte-level scanning over the body chunk misses it.
        let mut chunk2 = b"foo".to_vec();
        chunk2.extend_from_slice(
            b"POST /b HTTP/1.1\r\nHost: evil.com\r\nAuthorization: Basic YWRtaW46JEtFWQ==\r\n\r\n",
        );
        assert_eq!(
            handler.substitute(&chunk2).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn pipelined_get_without_content_length_recurses_into_next_request() {
        // Per RFC 9112 §6.3 case 6, a request with no Content-Length and no
        // Transfer-Encoding has a zero-length body. Any trailing bytes are
        // the start of the next pipelined request, not body of this one.
        // A regression that treats them as body misses substitution and
        // violation detection for the entire rest of the connection.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let mut chunk = b"GET /a HTTP/1.1\r\nHost: example.com\r\n\r\n".to_vec();
        chunk.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out = handler.substitute(&chunk).unwrap();

        let mut expected = b"GET /a HTTP/1.1\r\nHost: example.com\r\n\r\n".to_vec();
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn substitution_resumes_after_chunked_request_body_terminator() {
        // A chunked-encoded request must not poison the connection state.
        // After the chunked body terminator (`0\r\n\r\n`), the next bytes
        // are the start of a fresh request whose headers must be parsed
        // and substituted. A regression that stays in `InBody { None }`
        // forever misses every subsequent keep-alive request's headers.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        // Chunk 1: request 1 headers with `Transfer-Encoding: chunked`.
        let chunk1 = b"POST /a HTTP/1.1\r\nHost: example.com\r\nTransfer-Encoding: chunked\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        // Chunk 2: a 5-byte chunk (`hello`), the chunked terminator, then
        // a pipelined request with `$KEY` in a header.
        let mut chunk2 = b"5\r\nhello\r\n0\r\n\r\n".to_vec();
        chunk2.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out = handler.substitute(&chunk2).unwrap();

        let mut expected = b"5\r\nhello\r\n0\r\n\r\n".to_vec();
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn exact_host_requires_dns_pin_for_tls_intercepted_secret() {
        let ip = Ipv4Addr::new(203, 0, 113, 10);
        let shared = SharedState::new(16);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"GET / HTTP/1.1\r\nHost: api.openai.com\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );

        cache_host(&shared, "api.openai.com", ip);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let output = handler.substitute(input).unwrap();

        assert!(
            String::from_utf8(output.into_owned())
                .unwrap()
                .contains("real-secret")
        );
    }

    #[test]
    fn any_host_bypasses_dns_pin_for_tls_intercepted_secret() {
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.allowed_hosts = vec![HostPattern::Any];
        let config = make_config(vec![secret]);
        let shared = SharedState::new(16);
        let mut handler = SecretsHandler::new_tls_intercepted(
            &config,
            "unresolved.example",
            IpAddr::V4(Ipv4Addr::new(203, 0, 113, 20)),
            &shared,
        );

        let input =
            b"GET / HTTP/1.1\r\nHost: unresolved.example\r\nAuthorization: Bearer $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();

        assert!(
            String::from_utf8(output.into_owned())
                .unwrap()
                .contains("real-secret")
        );
    }

    #[test]
    fn host_alias_matches_gateway_without_dns_pin() {
        let gateway = Ipv4Addr::new(192, 0, 2, 1);
        let shared = SharedState::new(16);
        shared.set_gateway_ips(Some(gateway), None);

        let config = make_config(vec![make_secret("$KEY", "real-secret", crate::HOST_ALIAS)]);
        let mut handler = SecretsHandler::new_tls_intercepted(
            &config,
            crate::HOST_ALIAS,
            IpAddr::V4(gateway),
            &shared,
        );

        let input = format!(
            "GET / HTTP/1.1\r\nHost: {}\r\nAuthorization: Bearer $KEY\r\n\r\n",
            crate::HOST_ALIAS
        );
        let output = handler.substitute(input.as_bytes()).unwrap();

        assert!(
            String::from_utf8(output.into_owned())
                .unwrap()
                .contains("real-secret")
        );
    }

    #[test]
    fn tls_ip_authority_compares_addresses_without_allowing_hostname_fronting() {
        let shared = SharedState::new(16);
        let config = SecretsConfig::default();
        for (identity, authority, allowed) in [
            ("2001:db8::1", "[2001:db8::1]:443", true),
            ("2001:db8::1", "[2001:0db8:0:0:0:0:0:1]:443", true),
            ("2001:db8::1", "[2001:db8::2]:443", false),
            ("2001:db8::1", "example.com", false),
            ("192.0.2.1", "192.0.2.1:443", true),
            ("192.0.2.1", "192.0.2.2", false),
            ("192.0.2.1", "example.com", false),
            ("example.com", "192.0.2.1", false),
        ] {
            let ip = identity
                .parse()
                .unwrap_or_else(|_| "192.0.2.1".parse().unwrap());
            cache_host(&shared, "example.com", "192.0.2.1".parse().unwrap());
            let mut handler = SecretsHandler::new_tls_intercepted(&config, identity, ip, &shared);
            let request = format!("GET / HTTP/1.1\r\nHost: {authority}\r\n\r\n");
            assert_eq!(
                handler.substitute(request.as_bytes()).is_ok(),
                allowed,
                "identity={identity}, authority={authority}"
            );
        }
    }

    #[test]
    fn tls_intercepted_http_host_must_match_sni() {
        let ip = Ipv4Addr::new(203, 0, 113, 30);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"GET / HTTP/1.1\r\nHost: evil.com\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn connect_tls_intercepted_http_host_must_match_sni() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted_via_connect(&config, "api.openai.com");

        let input = b"GET / HTTP/1.1\r\nHost: evil.com\r\nAuthorization: Bearer $KEY\r\n\r\n";
        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_host_validation_buffers_split_headers() {
        let ip = Ipv4Addr::new(203, 0, 113, 31);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let out1 = handler
            .substitute(b"GET / HTTP/1.1\r\nHost: evil.com\r\n")
            .unwrap();
        assert!(out1.is_empty());
        assert_eq!(
            handler
                .substitute(b"Authorization: Bearer $KEY\r\n\r\n")
                .unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_host_validation_survives_leading_empty_block() {
        let ip = Ipv4Addr::new(203, 0, 113, 32);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        assert_eq!(
            handler.substitute(b"\r\n\r\n").unwrap().as_ref(),
            b"\r\n\r\n"
        );
        assert_eq!(
            handler
                .substitute(b"GET / HTTP/1.1\r\nHost: evil.com\r\nAuth: $KEY\r\n\r\n")
                .unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_host_validation_blocks_leading_empty_request() {
        let ip = Ipv4Addr::new(203, 0, 113, 34);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"\r\nGET / HTTP/1.1\r\nHost: evil.com\r\nAuth: $KEY\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_host_validation_buffers_split_leading_empty_request() {
        let ip = Ipv4Addr::new(203, 0, 113, 35);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let out1 = handler
            .substitute(b"\r\nGET / HTTP/1.1\r\nHost: evil.com\r\n")
            .unwrap();
        assert!(out1.is_empty());
        assert_eq!(
            handler.substitute(b"Auth: $KEY\r\n\r\n").unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_blocks_malformed_request_line() {
        let ip = Ipv4Addr::new(203, 0, 113, 36);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"GET / \r\nHost: api.openai.com\r\nAuth: $KEY\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_absolute_target_must_match_sni() {
        let ip = Ipv4Addr::new(203, 0, 113, 37);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input =
            b"GET https://evil.com/path HTTP/1.1\r\nHost: api.openai.com\r\nAuth: $KEY\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http_absolute_target_allows_matching_sni() {
        let ip = Ipv4Addr::new(203, 0, 113, 38);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input = b"GET https://api.openai.com/path HTTP/1.1\r\nHost: api.openai.com\r\nAuth: $KEY\r\n\r\n";
        let output = handler.substitute(input).unwrap();

        assert!(
            String::from_utf8(output.into_owned())
                .unwrap()
                .contains("real-secret")
        );
    }

    #[test]
    fn tls_intercepted_http_duplicate_host_is_blocked() {
        let ip = Ipv4Addr::new(203, 0, 113, 39);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let input =
            b"GET / HTTP/1.1\r\nHost: api.openai.com\r\nHost: api.openai.com\r\nAuth: $KEY\r\n\r\n";

        assert_eq!(
            handler.substitute(input).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_authority_must_match_sni() {
        let ip = Ipv4Addr::new(203, 0, 113, 33);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"evil.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn connect_tls_intercepted_http2_authority_must_match_sni() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted_via_connect(&config, "api.openai.com");

        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"evil.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn http2_trailers_preserve_permitted_placeholders_and_block_other_hosts() {
        for (allowed, passthrough) in [(true, false), (false, true), (false, false)] {
            let mut secret = make_secret("$KEY", "real-secret", "api.example.com");
            if !allowed {
                secret.allowed_hosts = vec![HostPattern::Exact("other.example".into())];
            }
            if passthrough {
                secret.passthrough_hosts = vec![HostPattern::Exact("api.example.com".into())];
            }
            let config = make_config(vec![secret]);
            let mut handler = SecretsHandler::new(&config, "api.example.com", true);
            let initial = h2_request(
                &[
                    (b":method", b"POST"),
                    (b":scheme", b"https"),
                    (b":authority", b"api.example.com"),
                    (b":path", b"/"),
                ],
                false,
            );
            assert!(handler.substitute(&initial).is_ok());
            let mut trailers = Vec::new();
            append_h2_headers(&mut trailers, 1, &[(b"x-key", b"$KEY")], true);
            let result = handler.substitute(&trailers);
            if allowed || passthrough {
                let mut output = HTTP2_PREFACE.to_vec();
                output.extend_from_slice(&result.unwrap());
                assert_eq!(
                    h2_header_value(&decode_first_h2_headers(&output), b"x-key"),
                    "$KEY"
                );
            } else {
                assert_eq!(result.unwrap_err(), SecretViolationAction::Block);
            }
        }
    }

    #[test]
    fn tls_intercepted_http2_substitutes_header_secret() {
        let ip = Ipv4Addr::new(203, 0, 113, 34);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        let output = handler.substitute(&request).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(
            h2_header_value(&headers, b"authorization"),
            "Bearer real-secret"
        );
    }

    #[test]
    fn tls_intercepted_http2_preface_can_span_tls_reads() {
        let ip = Ipv4Addr::new(203, 0, 113, 38);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        assert_eq!(handler.substitute(&request[..1]).unwrap().as_ref(), b"");

        let output = handler.substitute(&request[1..]).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(
            h2_header_value(&headers, b"authorization"),
            "Bearer real-secret"
        );
    }

    #[test]
    fn tls_intercepted_http2_substitutes_query_and_basic_auth() {
        let ip = Ipv4Addr::new(203, 0, 113, 35);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution = SecretSubstitution {
            headers: true,
            header_fields: Vec::new(),
            query: true,
            body: false,
        };
        let config = make_config(vec![secret]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let auth = format!("Basic {}", BASE64.encode(b"user:$KEY"));

        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/v1/chat?token=$KEY"),
                (b"authorization", auth.as_bytes()),
            ],
            true,
        );

        let output = handler.substitute(&request).unwrap().into_owned();
        let headers = decode_first_h2_headers(&output);
        assert_eq!(
            h2_header_value(&headers, b":path"),
            "/v1/chat?token=real-secret"
        );
        let auth = h2_header_value(&headers, b"authorization");
        let decoded = split_auth_scheme(&auth)
            .and_then(|(_, encoded)| BASE64.decode(encoded).ok())
            .and_then(|bytes| String::from_utf8(bytes).ok())
            .unwrap();
        assert_eq!(decoded, "user:real-secret");
    }

    #[test]
    fn tls_intercepted_http2_split_header_block_is_validated() {
        let ip = Ipv4Addr::new(203, 0, 113, 36);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let request = h2_request_with_split_headers(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"evil.com"),
                (b":path", b"/"),
                (b"authorization", b"Bearer $KEY"),
            ],
            8,
        );

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_body_placeholder_blocks_until_body_rewrite_exists() {
        let ip = Ipv4Addr::new(203, 0, 113, 37);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let request = h2_request_with_data(
            &[
                (b":method", b"POST"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
            ],
            b"{\"key\":\"$KEY\"}",
        );

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_body_placeholder_split_across_data_frames_blocks() {
        let ip = Ipv4Addr::new(203, 0, 113, 39);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_h2_headers(
            &mut request,
            1,
            &[
                (b":method", b"POST"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
            ],
            false,
        );
        append_http2_frame(&mut request, HTTP2_FRAME_DATA, 0, 1, b"$KE").unwrap();
        append_http2_frame(
            &mut request,
            HTTP2_FRAME_DATA,
            HTTP2_FLAG_END_STREAM,
            1,
            b"Y",
        )
        .unwrap();

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_data_tails_are_tracked_per_stream() {
        let ip = Ipv4Addr::new(203, 0, 113, 40);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        for stream_id in [1, 3] {
            append_h2_headers(
                &mut request,
                stream_id,
                &[
                    (b":method", b"POST"),
                    (b":scheme", b"https"),
                    (b":authority", b"api.openai.com"),
                    (b":path", b"/"),
                ],
                false,
            );
        }
        append_http2_frame(&mut request, HTTP2_FRAME_DATA, 0, 1, b"$KE").unwrap();
        append_http2_frame(
            &mut request,
            HTTP2_FRAME_DATA,
            HTTP2_FLAG_END_STREAM,
            3,
            b"Y",
        )
        .unwrap();

        assert!(handler.substitute(&request).is_ok());
    }

    #[test]
    fn tls_intercepted_http2_large_data_frame_without_placeholder_passes() {
        let ip = Ipv4Addr::new(203, 0, 113, 41);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let mut secret = make_secret("$KEY", "real-secret", "api.openai.com");
        secret.substitution.body = true;
        let config = make_config(vec![secret]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let payload = vec![b'a'; 1024 * 1024];

        let request = h2_request_with_data(
            &[
                (b":method", b"POST"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/"),
            ],
            &payload,
        );

        let output = handler.substitute(&request).unwrap().into_owned();
        assert!(output.ends_with(&payload));
    }

    #[test]
    fn tls_intercepted_http2_data_before_headers_is_blocked() {
        let ip = Ipv4Addr::new(203, 0, 113, 42);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_http2_frame(
            &mut request,
            HTTP2_FRAME_DATA,
            HTTP2_FLAG_END_STREAM,
            1,
            b"body",
        )
        .unwrap();

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_decoded_header_list_size_is_bounded() {
        let ip = Ipv4Addr::new(203, 0, 113, 43);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);
        let mut encoder = HpackEncoder::with_dynamic_size(4096);

        let mut first_block = Vec::new();
        for (name, value) in [
            (b":method".as_slice(), b"GET".as_slice()),
            (b":scheme".as_slice(), b"https".as_slice()),
            (b":authority".as_slice(), b"api.openai.com".as_slice()),
            (b":path".as_slice(), b"/".as_slice()),
        ] {
            encoder
                .encode(
                    (name.to_vec(), value.to_vec(), HpackEncoder::NEVER_INDEXED),
                    &mut first_block,
                )
                .unwrap();
        }
        encoder
            .encode(
                (
                    b"x-fill".to_vec(),
                    vec![b'a'; 4000],
                    HpackEncoder::WITH_INDEXING,
                ),
                &mut first_block,
            )
            .unwrap();

        let mut second_block = Vec::new();
        for (name, value) in [
            (b":method".as_slice(), b"GET".as_slice()),
            (b":scheme".as_slice(), b"https".as_slice()),
            (b":authority".as_slice(), b"api.openai.com".as_slice()),
            (b":path".as_slice(), b"/".as_slice()),
        ] {
            encoder
                .encode(
                    (name.to_vec(), value.to_vec(), HpackEncoder::NEVER_INDEXED),
                    &mut second_block,
                )
                .unwrap();
        }
        for _ in 0..20 {
            encoder.encode(62u32, &mut second_block).unwrap();
        }

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_http2_header_frames(&mut request, 1, true, &first_block).unwrap();
        append_http2_header_frames(&mut request, 3, true, &second_block).unwrap();

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_limits_concurrent_open_streams() {
        let ip = Ipv4Addr::new(203, 0, 113, 44);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        for i in 0..=MAX_HTTP2_TRACKED_STREAMS {
            append_h2_headers(
                &mut request,
                1 + (i as u32 * 2),
                &[
                    (b":method", b"POST"),
                    (b":scheme", b"https"),
                    (b":authority", b"api.openai.com"),
                    (b":path", b"/"),
                ],
                false,
            );
        }

        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_closed_streams_release_tracking_state() {
        let ip = Ipv4Addr::new(203, 0, 113, 45);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        for i in 0..=MAX_HTTP2_TRACKED_STREAMS {
            append_h2_headers(
                &mut request,
                1 + (i as u32 * 2),
                &[
                    (b":method", b"GET"),
                    (b":scheme", b"https"),
                    (b":authority", b"api.openai.com"),
                    (b":path", b"/"),
                ],
                true,
            );
        }

        assert!(handler.substitute(&request).is_ok());
    }

    // The HTTP/2 stream-id reuse checks below are ported from #1227
    // (originally authored by Liraz Siri). They fail closed when a client
    // presents a completed stream id as a new request.

    #[test]
    fn tls_intercepted_http2_rejects_reused_stream_id_after_headers_end_stream() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);
        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/first"),
            ],
            true,
        );
        handler.substitute(&request).unwrap();

        let mut reused = Vec::new();
        append_h2_headers(
            &mut reused,
            1,
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/reused"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        assert_eq!(
            handler.substitute(&reused).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_rejects_reused_stream_id_after_data_end_stream() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);
        let request = h2_request(
            &[
                (b":method", b"POST"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/first"),
            ],
            false,
        );
        handler.substitute(&request).unwrap();

        let mut completed = Vec::new();
        append_http2_frame(
            &mut completed,
            HTTP2_FRAME_DATA,
            HTTP2_FLAG_END_STREAM,
            1,
            b"",
        )
        .unwrap();
        handler.substitute(&completed).unwrap();

        let mut reused = Vec::new();
        append_h2_headers(
            &mut reused,
            1,
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/reused"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        assert_eq!(
            handler.substitute(&reused).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn tls_intercepted_http2_allows_higher_stream_id_after_close() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler = SecretsHandler::new(&config, "api.openai.com", true);
        let request = h2_request(
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/first"),
            ],
            true,
        );
        handler.substitute(&request).unwrap();

        let mut next = Vec::new();
        append_h2_headers(
            &mut next,
            3,
            &[
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"api.openai.com"),
                (b":path", b"/next"),
                (b"authorization", b"Bearer $KEY"),
            ],
            true,
        );

        let output = handler.substitute(&next).unwrap();
        let mut framed = HTTP2_PREFACE.to_vec();
        framed.extend_from_slice(&output);
        let headers = decode_first_h2_headers(&framed);
        assert_eq!(
            h2_header_value(&headers, b"authorization"),
            "Bearer real-secret"
        );
    }

    #[test]
    fn chunked_body_internal_terminator_bytes_do_not_end_request() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let chunk1 = b"POST /a HTTP/1.1\r\nHost: example.com\r\nTransfer-Encoding: chunked\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        let mut chunk2 = b"B\r\nAA\r\n0\r\n\r\nBB\r\n0\r\n\r\n".to_vec();
        chunk2.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out = handler.substitute(&chunk2).unwrap();

        let mut expected = b"B\r\nAA\r\n0\r\n\r\nBB\r\n0\r\n\r\n".to_vec();
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out.as_ref(), expected.as_slice());
    }

    #[test]
    fn split_chunked_terminator_resumes_next_request() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "example.com")]);
        let mut handler = SecretsHandler::new(&config, "example.com", true);

        let chunk1 = b"POST /a HTTP/1.1\r\nHost: example.com\r\nTransfer-Encoding: chunked\r\n\r\n";
        handler.substitute(chunk1).unwrap();

        let chunk2 = b"5\r\nhello\r\n0\r";
        let out2 = handler.substitute(chunk2).unwrap();
        assert_eq!(out2.as_ref(), chunk2.as_slice());

        let mut chunk3 = b"\n\r\n".to_vec();
        chunk3.extend_from_slice(b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: $KEY\r\n\r\n");

        let out3 = handler.substitute(&chunk3).unwrap();

        let mut expected = b"\n\r\n".to_vec();
        expected.extend_from_slice(
            b"GET /b HTTP/1.1\r\nHost: example.com\r\nAuth: real-secret\r\n\r\n",
        );
        assert_eq!(out3.as_ref(), expected.as_slice());
    }

    /// Frames carrying `block` as one request header block on `stream_id`,
    /// split across HEADERS and CONTINUATION when `split_at` falls inside it.
    fn append_h2_raw_block(out: &mut Vec<u8>, stream_id: u32, block: &[u8], split_at: usize) {
        let end = HTTP2_FLAG_END_HEADERS | HTTP2_FLAG_END_STREAM;
        if split_at == 0 || split_at >= block.len() {
            append_http2_frame(out, HTTP2_FRAME_HEADERS, end, stream_id, block).unwrap();
            return;
        }
        let (head, tail) = block.split_at(split_at);
        append_http2_frame(
            out,
            HTTP2_FRAME_HEADERS,
            HTTP2_FLAG_END_STREAM,
            stream_id,
            head,
        )
        .unwrap();
        append_http2_frame(out, HTTP2_FRAME_CONTINUATION, end, stream_id, tail).unwrap();
    }

    #[test]
    fn http2_malformed_hpack_block_is_blocked() {
        // Each block made httlib-hpack 0.1.3 index out of bounds, which aborts
        // the sandbox process in release builds (`panic = "abort"`).
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        for block in PANICKING_BLOCKS {
            for split_at in 0..block.len() {
                let mut request = HTTP2_PREFACE.to_vec();
                append_h2_raw_block(&mut request, 1, block, split_at);
                let handlers = [
                    SecretsHandler::new(&config, "a.example", false),
                    SecretsHandler::new(&config, "a.example", true),
                    // A domain egress rule alone installs a handler on plain
                    // TCP, with no secrets configured.
                    plain_http_policy_handler(&make_config(Vec::new())),
                ];
                for mut handler in handlers {
                    assert_eq!(
                        handler.substitute(&request).unwrap_err(),
                        SecretViolationAction::Block,
                        "{block:02x?} split at {split_at}"
                    );
                }
            }
        }
    }

    #[test]
    fn http2_random_header_blocks_never_panic() {
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let request_prefix = encode_h2_header_block(&[
            (b":method", b"GET"),
            (b":scheme", b"https"),
            (b":authority", b"a.example"),
            (b":path", b"/"),
        ]);
        let mut rng = Rng(0x9e37_79b9_7f4a_7c15);
        let mut processed = [0usize; 3];
        for _ in 0..500 {
            // Up to three requests on one connection, so later blocks decode
            // against dynamic-table entries added by earlier ones. Half of the
            // blocks start with a valid request, so they also reach the checks
            // that run after decoding.
            let mut request = HTTP2_PREFACE.to_vec();
            append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
            for stream_id in [1, 3, 5].into_iter().take(1 + rng.below(3)) {
                let mut block = Vec::new();
                if rng.below(2) == 0 {
                    block.extend_from_slice(&request_prefix);
                }
                block.extend(random_block(&mut rng));
                let split_at = rng.below(block.len() + 1);
                append_h2_raw_block(&mut request, stream_id, &block, split_at);
            }
            let handlers = [
                SecretsHandler::new(&config, "a.example", false),
                SecretsHandler::new(&config, "a.example", true),
                plain_http_policy_handler(&make_config(Vec::new())),
            ];
            for (index, mut handler) in handlers.into_iter().enumerate() {
                if handler.substitute(&request).is_ok() {
                    processed[index] += 1;
                }
            }
        }
        // Coverage witness: a parser regression that rejected every flight
        // early would otherwise leave this test passing without exercising the
        // decode path. Each handler variant must process at least one request.
        for (index, count) in processed.iter().enumerate() {
            assert!(
                *count > 0,
                "handler {index} never processed a random request successfully"
            );
        }
    }

    #[test]
    fn http2_dynamic_table_reference_across_streams_is_decoded() {
        // Deterministic later-stream dynamic reference: stream 1 inserts
        // `x-a: 1` with incremental indexing, so index 62 names it; stream 3
        // sends only `be` (indexed field 62). A successful decode proves the
        // dynamic table carries across streams instead of every flight being
        // rejected before it can reference an earlier entry.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let fields: [(&[u8], &[u8]); 4] = [
            (b":method", b"POST"),
            (b":scheme", b"https"),
            (b":authority", b"a.example"),
            (b":path", b"/"),
        ];
        let mut request_block = encode_h2_header_block(&fields);
        request_block.extend_from_slice(&[0x40, 0x03, b'x', b'-', b'a', 0x01, b'1']);
        let mut reference_block = encode_h2_header_block(&fields);
        reference_block.push(0xbe);

        let mut handler = SecretsHandler::new(&config, "a.example", false);
        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_http2_header_frames(&mut request, 1, true, &request_block).unwrap();
        handler.substitute(&request).unwrap();

        let mut next = Vec::new();
        append_http2_header_frames(&mut next, 3, true, &reference_block).unwrap();
        let mut output = HTTP2_PREFACE.to_vec();
        output.extend_from_slice(&handler.substitute(&next).unwrap());
        assert_eq!(
            h2_header_value(&decode_first_h2_headers(&output), b"x-a"),
            "1"
        );
    }

    #[test]
    fn tls_intercepted_http2_output_is_unchanged_for_indexed_guest_blocks() {
        let ip = Ipv4Addr::new(203, 0, 113, 45);
        let shared = SharedState::new(16);
        cache_host(&shared, "api.openai.com", ip);
        let config = make_config(vec![make_secret("$KEY", "real-secret", "api.openai.com")]);
        let mut handler =
            SecretsHandler::new_tls_intercepted(&config, "api.openai.com", IpAddr::V4(ip), &shared);

        // The guest indexes every field (Huffman-coded) in the first block, so
        // the second block is made only of dynamic-table references.
        let flags = HpackEncoder::WITH_INDEXING
            | HpackEncoder::HUFFMAN_NAME
            | HpackEncoder::HUFFMAN_VALUE
            | HpackEncoder::BEST_FORMAT;
        let fields: [(&[u8], &[u8]); 5] = [
            (b":method", b"GET"),
            (b":scheme", b"https"),
            (b":authority", b"api.openai.com"),
            (b":path", b"/"),
            (b"authorization", b"Bearer $KEY"),
        ];
        let mut encoder = HpackEncoder::with_dynamic_size(4096);
        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        for stream_id in [1, 3] {
            let mut block = Vec::new();
            for (name, value) in fields {
                encoder
                    .encode((name.to_vec(), value.to_vec(), flags), &mut block)
                    .unwrap();
            }
            if stream_id == 3 {
                assert!(block.iter().all(|octet| octet & 0x80 != 0), "{block:02x?}");
            }
            append_http2_header_frames(&mut request, stream_id, true, &block).unwrap();
        }

        let output = handler.substitute(&request).unwrap().into_owned();

        // Every output field is a never-indexed literal with raw strings, so
        // the bytes do not depend on how the guest encoded its block.
        let mut substituted = fields;
        substituted[4].1 = b"Bearer real-secret";
        let mut expected = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut expected, 0x4, 0, 0, &[]).unwrap();
        append_h2_headers(&mut expected, 1, &substituted, true);
        append_h2_headers(&mut expected, 3, &substituted, true);
        assert_eq!(output, expected);
    }

    #[test]
    fn http2_size_update_only_trailer_block_is_accepted_and_applied() {
        // A trailer block may hold only table size updates (RFC 7541 §4.2).
        // The request adds `x-a: 1` to the guest's dynamic table; `be` in the
        // next request refers to it. `20` (size 0) evicts it, so that
        // reference must fail after the update and succeed without it.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let fields: [(&[u8], &[u8]); 4] = [
            (b":method", b"POST"),
            (b":scheme", b"https"),
            (b":authority", b"a.example"),
            (b":path", b"/"),
        ];
        let mut request_block = encode_h2_header_block(&fields);
        request_block.extend_from_slice(&[0x40, 0x03, b'x', b'-', b'a', 0x01, b'1']);
        let mut next_block = encode_h2_header_block(&fields);
        next_block.push(0xbe);

        for (trailer, evicted) in [
            (&[][..], false),
            (&[0x20][..], true),
            (&[0x20, 0x3f, 0xe1, 0x1f][..], true),
        ] {
            let mut handler = SecretsHandler::new(&config, "a.example", false);
            let mut request = HTTP2_PREFACE.to_vec();
            append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
            append_http2_header_frames(&mut request, 1, false, &request_block).unwrap();
            append_http2_header_frames(&mut request, 1, true, trailer).unwrap();
            let output = handler.substitute(&request).unwrap().into_owned();
            // The trailer is forwarded as an empty header block.
            let mut empty_trailer = Vec::new();
            append_http2_header_frames(&mut empty_trailer, 1, true, &[]).unwrap();
            assert!(output.ends_with(&empty_trailer), "{trailer:02x?}");

            let mut next = Vec::new();
            append_http2_header_frames(&mut next, 3, true, &next_block).unwrap();
            let result = handler.substitute(&next);
            if evicted {
                assert_eq!(
                    result.unwrap_err(),
                    SecretViolationAction::Block,
                    "{trailer:02x?}"
                );
            } else {
                let mut output = HTTP2_PREFACE.to_vec();
                output.extend_from_slice(&result.unwrap());
                assert_eq!(
                    h2_header_value(&decode_first_h2_headers(&output), b"x-a"),
                    "1"
                );
            }
        }
    }

    #[test]
    fn http2_header_block_limit_is_64_kib_across_continuation_frames() {
        // A trailer has no pseudo-header fields, so one raw literal can fill
        // the block while its decoded size (name + value + 4) stays below the
        // decoded-size limit. The block is sent as HEADERS plus three 16 KiB
        // CONTINUATION frames.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        for extra in [0, 1] {
            let mut request = h2_request(
                &[
                    (b":method", b"POST"),
                    (b":scheme", b"https"),
                    (b":authority", b"a.example"),
                    (b":path", b"/"),
                ],
                false,
            );
            let value = vec![b'v'; 64 * 1024 - 12 + extra];
            let block = encode_h2_header_block(&[(b"x-fill", &value)]);
            assert_eq!(block.len(), MAX_HTTP2_HEADER_BLOCK_BYTES + extra);
            append_http2_header_frames(&mut request, 1, true, &block).unwrap();

            let mut handler = SecretsHandler::new(&config, "a.example", false);
            let result = handler.substitute(&request);
            if extra == 0 {
                // Re-encoding uses the same never-indexed raw literals.
                assert_eq!(result.unwrap().into_owned(), request);
            } else {
                assert_eq!(result.unwrap_err(), SecretViolationAction::Block);
            }
        }
    }

    /// A request header block with the four pseudo-headers followed by one
    /// `a: <value>` field whose value is Huffman-compressed. The decoded value
    /// is exactly `value_len` bytes, so the caller controls the decoder's
    /// decoded-size total. `b'a'` has a 5-bit Huffman code (the shortest), so
    /// even a 100,000-byte value compresses to about 62.5 KiB and stays under
    /// the 64 KiB block cap.
    fn h2_request_block_with_huffman_value(value_len: usize) -> Vec<u8> {
        let mut block = encode_h2_header_block(&[
            (b":method", b"GET"),
            (b":scheme", b"https"),
            (b":authority", b"a.example"),
            (b":path", b"/"),
        ]);
        let mut encoder = HpackEncoder::with_dynamic_size(4096);
        encoder
            .encode(
                (
                    b"a".to_vec(),
                    vec![b'a'; value_len],
                    HpackEncoder::NEVER_INDEXED | HpackEncoder::HUFFMAN_VALUE,
                ),
                &mut block,
            )
            .unwrap();
        block
    }

    /// A trailer block of `unit` repetitions filled to the 64 KiB block cap.
    fn h2_size_update_storm_block(unit: &[u8]) -> Vec<u8> {
        let mut block = Vec::new();
        while block.len() + unit.len() <= MAX_HTTP2_HEADER_BLOCK_BYTES {
            block.extend_from_slice(unit);
        }
        block
    }

    #[test]
    fn http2_header_field_count_boundary_is_1024() {
        // The field limit is checked before each field is pushed, so exactly
        // 1,024 fields decode and the 1,025th blocks.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        for (extra, accepted) in [(1020usize, true), (1021, false)] {
            let mut fields: Vec<(&[u8], &[u8])> = vec![
                (b":method", b"GET"),
                (b":scheme", b"https"),
                (b":authority", b"a.example"),
                (b":path", b"/"),
            ];
            for _ in 0..extra {
                fields.push((b"x-a", b"1"));
            }
            let request = h2_request(&fields, true);
            let mut handler = SecretsHandler::new(&config, "a.example", false);
            let result = handler.substitute(&request);
            if accepted {
                assert!(result.is_ok(), "1,024 fields must be accepted");
            } else {
                assert_eq!(result.unwrap_err(), SecretViolationAction::Block);
            }
        }
    }

    #[test]
    fn http2_decoded_size_boundary_is_exact_for_huffman_values() {
        // Decoded size is `name + value + 4` per field; the four pseudo-headers
        // contribute 63 bytes, so value length 65,468 reaches exactly 65,536
        // and 65,469 reaches 65,537. Both Huffman-compressed blocks are far
        // below the 64 KiB block cap, so only the decoded-size check decides.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        for (value_len, accepted) in [(65_468usize, true), (65_469, false)] {
            let block = h2_request_block_with_huffman_value(value_len);
            assert!(block.len() <= MAX_HTTP2_HEADER_BLOCK_BYTES);
            let mut request = HTTP2_PREFACE.to_vec();
            append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
            append_http2_header_frames(&mut request, 1, true, &block).unwrap();
            let mut handler = SecretsHandler::new(&config, "a.example", false);
            let result = handler.substitute(&request);
            if accepted {
                assert!(result.is_ok(), "decoded size at the limit must be accepted");
            } else {
                assert_eq!(result.unwrap_err(), SecretViolationAction::Block);
            }
        }
    }

    #[test]
    fn http2_block_under_the_cap_can_expand_past_the_decoded_limit() {
        // A block under the 64 KiB cap can still expand past 64 KiB decoded: a
        // ~62.5 KiB Huffman value decodes to 100,000 bytes, so only the
        // decoded-size check can reject it.
        let block = h2_request_block_with_huffman_value(100_000);
        assert!(block.len() <= MAX_HTTP2_HEADER_BLOCK_BYTES);
        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_http2_header_frames(&mut request, 1, true, &block).unwrap();
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let mut handler = SecretsHandler::new(&config, "a.example", false);
        assert_eq!(
            handler.substitute(&request).unwrap_err(),
            SecretViolationAction::Block
        );
    }

    #[test]
    fn http2_size_update_storm_is_bounded_and_terminates() {
        // Pre-existing behaviour, not introduced by the guard: `httlib-hpack`
        // drains the front of its buffer once per representation, so a 64 KiB
        // block that is almost all one-byte size updates moves on the order of
        // 2 GiB and costs time quadratic in the capped block size. The guard
        // itself is linear and allocation-free. This pins that the handler
        // still completes with bounded decoder state; in a debug build 64 KiB
        // takes about 40 ms.
        let config = make_config(vec![make_secret("$KEY", "real-secret", "a.example")]);
        let request_block = encode_h2_header_block(&[
            (b":method", b"POST"),
            (b":scheme", b"https"),
            (b":authority", b"a.example"),
            (b":path", b"/"),
        ]);

        // Size-update-only trailers: `20` (size 0) and alternating 0/4096.
        for unit in [&[0x20u8][..], &[0x20, 0x3f, 0xe1, 0x1f][..]] {
            let trailer = h2_size_update_storm_block(unit);
            let mut handler = SecretsHandler::new(&config, "a.example", false);
            let mut request = HTTP2_PREFACE.to_vec();
            append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
            append_http2_header_frames(&mut request, 1, false, &request_block).unwrap();
            append_http2_header_frames(&mut request, 1, true, &trailer).unwrap();
            let output = handler.substitute(&request).unwrap();
            // A trailer of size updates decodes to no fields and is forwarded
            // as an empty header block.
            let mut empty_trailer = Vec::new();
            append_http2_header_frames(&mut empty_trailer, 1, true, &[]).unwrap();
            assert!(output.ends_with(&empty_trailer), "{unit:02x?}");
        }

        // Updates interspersed with indexed fields, as one request block: the
        // pseudo-headers plus indexed `cookie` fields (every 64 bytes) and `20`
        // updates filling the rest. The field count stays under the 1,024
        // limit and the decoded size under 64 KiB, so the whole block decodes.
        let mut interspersed = request_block;
        let mut fields = 4usize;
        while interspersed.len() < MAX_HTTP2_HEADER_BLOCK_BYTES {
            if fields < MAX_HTTP2_HEADER_FIELDS && interspersed.len().is_multiple_of(64) {
                // `a0` indexes static-table entry 32 (`cookie`).
                interspersed.push(0xa0);
                fields += 1;
            } else {
                interspersed.push(0x20);
            }
        }
        let mut handler = SecretsHandler::new(&config, "a.example", false);
        let mut request = HTTP2_PREFACE.to_vec();
        append_http2_frame(&mut request, 0x4, 0, 0, &[]).unwrap();
        append_http2_header_frames(&mut request, 1, true, &interspersed).unwrap();
        assert!(handler.substitute(&request).is_ok());
    }
}