netconf_rust/

codec.rs

use bytes::{Buf, Bytes, BytesMut};
use log::{debug, trace, warn};
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
use tokio_util::codec::{Decoder, Encoder};

use crate::error::FramingError;

/// Controls whether the chunked framing decoder tolerates incorrect chunk
/// sizes from the remote side.
///
/// Some routers send `\n#<size>\n` headers where `<size>` doesn't match
/// the actual number of bytes before the next chunk boundary. When enabled,
/// the decoder scans for the real `\n#` boundary and adjusts the chunk
/// size accordingly.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub enum LenientChunkedFraming {
    /// Strict mode (default): trust the declared chunk size exactly.
    #[default]
    Off,
    /// Recover when the declared size is smaller than the actual data
    /// (router undercounts).
    RecoverUndercount,
    /// Recover when the declared size is larger than the actual data
    /// (router overcounts).
    RecoverOvercount,
    /// Recover from both undercount and overcount mismatches.
    RecoverBoth,
}

impl LenientChunkedFraming {
    /// Returns `true` if any recovery mode is enabled.
    fn is_enabled(&self) -> bool {
        *self != Self::Off
    }

    /// Returns `true` if undercount recovery is active.
    fn recovers_undercount(&self) -> bool {
        matches!(self, Self::RecoverUndercount | Self::RecoverBoth)
    }

    /// Returns `true` if overcount recovery is active.
    fn recovers_overcount(&self) -> bool {
        matches!(self, Self::RecoverOvercount | Self::RecoverBoth)
    }
}

const EOM_MARKER: &[u8] = b"]]>]]>";
const EOM_LEN: usize = EOM_MARKER.len();

const CHUNKED_EOM_MARKER: &[u8] = b"\n##\n";
const CHUNKED_EOM_MARKER_LEN: usize = CHUNKED_EOM_MARKER.len();

const CHUNKED_HEADER_START: &[u8] = b"\n#";

/// A decoded frame from the NETCONF codec.
///
/// Instead of returning complete messages, the decoder yields individual
/// chunks as they arrive. This enables streaming: the reader task can
/// forward chunks directly to consumers without buffering the entire
/// message.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum DecodedFrame {
    /// A piece of the current NETCONF message.
    Chunk(Bytes),
    /// The current message is complete.
    EndOfMessage,
}

/// Netconf defines 2 framing modes.
/// 1. Netconf 1.0 defines End of Message (EOM) in RFC 4742, where each message is followed by
///    the literal sequence `]]>]]>`. For example, `<rpc-reply message-id="1"><ok/></rpc-reply>]]>]]>`
/// 2. Netconf 1.1 defines Chunked in RFC 6242, where each message is sent with length-prefixed
///    chunks. The chunk starts with \n#{num_of_bytes_in_msg}\n. \n##\n defines end of message
///    for example `\n#28\n<rpc-reply><ok/></rpc-re\n#6\nply/>\n##\n`
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FramingMode {
    /// NETCONF 1.0 (RFC 4742): messages terminated by `]]>]]`
    EndOfMessage,
    /// NETCONF 1.1 (RFC 6242): length-prefixed chunked framing
    Chunked,
}

#[derive(Default, Debug, Clone, Copy)]
pub struct CodecConfig {
    pub max_message_size: Option<usize>, // None = unlimited
    pub lenient_chunked_framing: LenientChunkedFraming,
}

pub struct NetconfCodec {
    framing_mode: FramingMode,
    config: CodecConfig,
    /// Tracks whether we need to yield `EndOfMessage` on the next `decode()`
    /// call. In EOM mode, when the `]]>]]>` marker is found, the final data
    /// is yielded as a `Chunk` first, and `EndOfMessage` follows on the next
    /// call. This two-step yield is needed because `decode()` can only return
    /// one item at a time.
    eom_complete: bool,
    /// Cumulative bytes yielded for the current message. Reset on
    /// `EndOfMessage`. Used to enforce `max_message_size` in both EOM
    /// and chunked modes.
    message_bytes: usize,
    /// When true, `decode_eof` silently discards leftover bytes instead of
    /// returning an error. Set by the reader loop after a `close-session` RPC
    /// is in flight so that harmless holdback bytes don't surface as a
    /// transport error.
    closing: bool,
}

/// tokio_util codec for NETCONF message framing.
///
/// Implements the `Decoder` trait from tokio_util. Instead of returning
/// complete messages, the decoder yields [`DecodedFrame`] items:
/// individual `Chunk`s as data arrives, followed by `EndOfMessage` when
/// the message boundary is reached.
///
/// This chunk-level output enables the reader task to route messages
/// without buffering: normal RPCs accumulate chunks into a `BytesMut`,
/// while streaming RPCs forward each chunk directly to the consumer.
///
/// The `Encoder` side is unchanged — it frames complete XML documents
/// with the appropriate delimiter/chunking.
impl NetconfCodec {
    pub fn new(framing_mode: FramingMode, config: CodecConfig) -> Self {
        Self {
            framing_mode,
            config,
            eom_complete: false,
            message_bytes: 0,
            closing: false,
        }
    }

    pub fn set_mode(&mut self, framing_mode: FramingMode) {
        self.framing_mode = framing_mode;
        self.eom_complete = false;
        self.message_bytes = 0;
    }
    pub fn framing_mode(&self) -> FramingMode {
        self.framing_mode
    }
    /// Mark the codec as closing so that `decode_eof` silently discards
    /// leftover holdback bytes instead of treating them as an error.
    pub fn set_closing(&mut self) {
        self.closing = true;
    }

    fn check_size(&self, size: usize) -> Result<(), FramingError> {
        if let Some(max_size) = self.config.max_message_size
            && size > max_size
        {
            return Err(FramingError::MessageTooLarge {
                limit: max_size,
                received: size,
            });
        }
        Ok(())
    }

    /// Decode EOM-framed data into chunks.
    ///
    /// Yields available data as `Chunk` frames, holding back `EOM_LEN - 1`
    /// bytes to handle `]]>]]>` markers split across reads. When the marker
    /// is found, the final data before it is yielded as a `Chunk`, and
    /// `EndOfMessage` follows on the next `decode()` call via the
    /// `eom_complete` flag.
    fn decode_eom(&mut self, src: &mut BytesMut) -> Result<Option<DecodedFrame>, FramingError> {
        // Two-step yield: if we just found the EOM marker and yielded
        // the final Chunk, now yield EndOfMessage.
        if self.eom_complete {
            self.eom_complete = false;
            self.message_bytes = 0;
            return Ok(Some(DecodedFrame::EndOfMessage));
        }

        if src.is_empty() {
            return Ok(None);
        }

        // Search for the EOM marker.
        if let Some(pos) = memchr::memmem::find(src, EOM_MARKER) {
            if pos > 0 {
                // Yield data before the marker as a Chunk, schedule EndOfMessage.
                let data = src.split_to(pos);
                src.advance(EOM_LEN);
                self.message_bytes += data.len();
                self.check_size(self.message_bytes)?;
                self.eom_complete = true;
                debug!("eom: final chunk ({} bytes), marker found", data.len());
                Ok(Some(DecodedFrame::Chunk(data.freeze())))
            } else {
                // Marker at the start — empty message.
                src.advance(EOM_LEN);
                self.message_bytes = 0;
                debug!("eom: empty message");
                Ok(Some(DecodedFrame::EndOfMessage))
            }
        } else {
            // No marker found. Yield everything except the holdback
            // (EOM_LEN - 1 bytes) since the marker could be split across reads.
            let holdback = EOM_LEN - 1;
            if src.len() <= holdback {
                return Ok(None);
            }
            let safe_len = src.len() - holdback;
            let chunk = src.split_to(safe_len);
            self.message_bytes += chunk.len();
            self.check_size(self.message_bytes)?;
            trace!(
                "eom: yielding chunk ({} bytes), holding back {}",
                chunk.len(),
                holdback
            );
            Ok(Some(DecodedFrame::Chunk(chunk.freeze())))
        }
    }

    /// Decode chunked-framed data into individual chunks.
    ///
    /// Each RFC 6242 chunk `\n#<size>\n<data>` yields a `Chunk(data)`.
    /// The end marker `\n##\n` yields `EndOfMessage`. Unlike the previous
    /// implementation, chunks are NOT accumulated — each one is yielded
    /// individually, enabling streaming.
    fn decode_chunked(&mut self, src: &mut BytesMut) -> Result<Option<DecodedFrame>, FramingError> {
        // The smallest possible frame is \n##\n (4 bytes).
        if src.len() < CHUNKED_EOM_MARKER_LEN {
            trace!(
                "chunked: buffer too small ({} bytes), need more data",
                src.len()
            );
            return Ok(None);
        }

        // Every chunk or end marker starts with \n#
        if src[0..2] != *CHUNKED_HEADER_START {
            return Err(FramingError::InvalidHeader {
                expected: "\\n#",
                got: src[..2].to_vec(),
            });
        }

        // Check for end of chunks marker: \n##\n.
        if src[2] == b'#' {
            if src[3] != b'\n' {
                return Err(FramingError::InvalidHeader {
                    expected: "\\n##\\n",
                    got: src[..4].to_vec(),
                });
            }
            src.advance(CHUNKED_EOM_MARKER_LEN);
            self.message_bytes = 0;
            debug!("chunked: end of message");
            return Ok(Some(DecodedFrame::EndOfMessage));
        }

        // Parse chunk header \n#<size>\n
        let header_start = 2; // skip \n#
        let header_end = match src[header_start..].iter().position(|&b| b == b'\n') {
            Some(pos_end_of_header) => header_start + pos_end_of_header,
            None => {
                // Header not yet complete - need more data.
                // Sanity-check the header length.
                if src.len() > 20 {
                    return Err(FramingError::InvalidChunkSize(
                        String::from_utf8_lossy(&src[header_start..]).into_owned(),
                    ));
                }
                return Ok(None);
            }
        };

        // Extract the chunk size from the header and parse into usize
        let size_str = &src[header_start..header_end];
        let chunk_size: usize = std::str::from_utf8(size_str)
            .map_err(|_| {
                FramingError::InvalidChunkSize(String::from_utf8_lossy(size_str).into_owned())
            })?
            .parse()
            .map_err(|_| {
                FramingError::InvalidChunkSize(String::from_utf8_lossy(size_str).into_owned())
            })?;

        if chunk_size == 0 {
            return Err(FramingError::InvalidChunkSize("0".into()));
        }

        // Total header length: \n# + size digits + \n
        let header_len = header_end + 1; // +1 for the trailing \n

        // Check if the full chunk (header + data) is available
        let total_chunk_len = header_len + chunk_size;

        if self.config.lenient_chunked_framing.is_enabled() {
            return self.decode_chunked_lenient(src, header_len, chunk_size);
        }

        if src.len() < total_chunk_len {
            trace!(
                "chunked: need {} more bytes for chunk (have {}, need {})",
                total_chunk_len - src.len(),
                src.len(),
                total_chunk_len
            );
            return Ok(None);
        }
        self.message_bytes += chunk_size;
        self.check_size(self.message_bytes)?;

        trace!("chunked: yielding chunk ({} bytes)", chunk_size);

        // Consume header
        src.advance(header_len);

        // Extract and yield the chunk data
        let chunk_data = src.split_to(chunk_size);
        Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())))
    }

    /// Lenient chunked decoding: tolerates incorrect chunk sizes by scanning
    /// for the real `\n#` boundary.
    fn decode_chunked_lenient(
        &mut self,
        src: &mut BytesMut,
        header_len: usize,
        chunk_size: usize,
    ) -> Result<Option<DecodedFrame>, FramingError> {
        let data_start = header_len;
        let declared_end = data_start + chunk_size;
        let mode = self.config.lenient_chunked_framing;

        // FAST PATH: if we have enough bytes, peek to see if the declared
        // size lands on a valid \n# boundary.
        if src.len() >= declared_end + 2
            && src[declared_end] == b'\n'
            && src[declared_end + 1] == b'#'
        {
            // Declared size is correct — take chunk_size bytes.
            if src.len() < data_start + chunk_size {
                return Ok(None);
            }
            self.message_bytes += chunk_size;
            self.check_size(self.message_bytes)?;
            trace!(
                "chunked-lenient: fast path, declared size correct ({} bytes)",
                chunk_size
            );
            src.advance(header_len);
            let chunk_data = src.split_to(chunk_size);
            return Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())));
        }

        // RECOVERY PATH: scan for the real boundary.
        match Self::find_real_chunk_boundary(src, data_start) {
            Some(real_size) => {
                if real_size == chunk_size {
                    // Declared size happens to be correct (fast path couldn't
                    // confirm because we didn't have the peek bytes, but the
                    // scan found the boundary at the expected offset).
                    self.message_bytes += chunk_size;
                    self.check_size(self.message_bytes)?;
                    trace!(
                        "chunked-lenient: scan confirmed declared size ({} bytes)",
                        chunk_size
                    );
                    src.advance(header_len);
                    let chunk_data = src.split_to(chunk_size);
                    Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())))
                } else if real_size > chunk_size && mode.recovers_undercount() {
                    warn!(
                        "chunked-lenient: undercount recovery, declared={} actual={}",
                        chunk_size, real_size
                    );
                    self.message_bytes += real_size;
                    self.check_size(self.message_bytes)?;
                    src.advance(header_len);
                    let chunk_data = src.split_to(real_size);
                    Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())))
                } else if real_size < chunk_size && mode.recovers_overcount() {
                    warn!(
                        "chunked-lenient: overcount recovery, declared={} actual={}",
                        chunk_size, real_size
                    );
                    self.message_bytes += real_size;
                    self.check_size(self.message_bytes)?;
                    src.advance(header_len);
                    let chunk_data = src.split_to(real_size);
                    Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())))
                } else {
                    // Mismatch direction not covered by the current mode —
                    // fall back to strict behaviour (wait for declared size).
                    let total_chunk_len = header_len + chunk_size;
                    if src.len() < total_chunk_len {
                        return Ok(None);
                    }
                    self.message_bytes += chunk_size;
                    self.check_size(self.message_bytes)?;
                    src.advance(header_len);
                    let chunk_data = src.split_to(chunk_size);
                    Ok(Some(DecodedFrame::Chunk(chunk_data.freeze())))
                }
            }
            None => {
                // No valid boundary found yet — need more data.
                Ok(None)
            }
        }
    }

    /// Scan `src[data_start..]` for the first valid `\n#` chunk boundary.
    ///
    /// A valid boundary is `\n#` followed by either:
    /// - `#\n` (the EOM marker `\n##\n`), or
    /// - one or more ASCII digits then `\n` (a next chunk header).
    ///
    /// Returns the offset from `data_start` to the boundary (i.e. the real
    /// chunk data size), or `None` if no valid boundary is found (need more
    /// data).
    fn find_real_chunk_boundary(src: &BytesMut, data_start: usize) -> Option<usize> {
        let data = &src[data_start..];
        let finder = memchr::memmem::Finder::new(b"\n#");
        let mut search_start = 0;

        loop {
            let candidate = match finder.find(&data[search_start..]) {
                Some(pos) => search_start + pos,
                None => return None,
            };

            // Position in data after \n#
            let after_hash = candidate + 2;
            if after_hash >= data.len() {
                // Not enough bytes to validate — need more data.
                return None;
            }

            let next_byte = data[after_hash];

            if next_byte == b'#' {
                // Potential EOM: \n##\n
                if after_hash + 1 >= data.len() {
                    return None; // need one more byte to confirm
                }
                if data[after_hash + 1] == b'\n' {
                    return Some(candidate);
                }
                // False positive — \n## not followed by \n
                search_start = after_hash;
                continue;
            }

            if next_byte.is_ascii_digit() {
                // Potential next chunk header: \n#<digits>\n
                let mut i = after_hash + 1;
                loop {
                    if i >= data.len() {
                        return None; // need more bytes to validate
                    }
                    if data[i] == b'\n' {
                        // Valid next chunk header boundary.
                        return Some(candidate);
                    }
                    if !data[i].is_ascii_digit() {
                        // Not a valid chunk header — false positive.
                        break;
                    }
                    i += 1;
                }
                search_start = after_hash;
                continue;
            }

            // Neither # nor digit after \n# — false positive (e.g. \n# in XML)
            search_start = after_hash;
        }
    }
}

pub(crate) async fn read_eom_message<R: AsyncRead + Unpin>(
    reader: &mut R,
    max_size: Option<usize>,
) -> crate::Result<String> {
    let mut buf = Vec::with_capacity(4096);
    let mut tmp = [0u8; 4096];

    loop {
        let read_bytes = reader.read(&mut tmp).await?;

        if read_bytes == 0 {
            debug!("read_eom: unexpected EOF after {} bytes", buf.len());
            return Err(FramingError::UnexpectedEof.into());
        }
        buf.extend_from_slice(&tmp[..read_bytes]);
        trace!(
            "read_eom: read {} bytes, buffer now {} bytes",
            read_bytes,
            buf.len()
        );
        if let Some(limit) = max_size
            && buf.len() > limit + EOM_LEN
        {
            return Err(FramingError::MessageTooLarge {
                limit,
                received: buf.len(),
            }
            .into());
        }
        if let Some(pos) = memchr::memmem::find(&buf, EOM_MARKER) {
            buf.truncate(pos);
            debug!("read_eom: complete message ({} bytes)", buf.len());
            return String::from_utf8(buf).map_err(|_| FramingError::InvalidUtf8.into());
        }
    }
}

pub(crate) async fn write_eom_message<W: AsyncWrite + Unpin>(
    writer: &mut W,
    message: &str,
) -> crate::Result<()> {
    writer.write_all(message.as_bytes()).await?;
    writer.write_all(EOM_MARKER).await?;
    writer.flush().await?;
    Ok(())
}

/// Extract the `message-id` attribute value from a NETCONF XML fragment.
///
/// Performs a byte-level scan for `message-id="<digits>"` and returns the
/// parsed `u32`. This avoids pulling in an XML parser for the hot path
/// in the reader task, where we only need the message-id from the first
/// chunk to route the message.
pub(crate) fn extract_message_id_from_bytes(bytes: &[u8]) -> Option<u32> {
    const PATTERN: &[u8] = b"message-id=\"";
    let pos = memchr::memmem::find(bytes, PATTERN)?;
    let start = pos + PATTERN.len();
    let remaining = bytes.get(start..)?;
    let end = memchr::memchr(b'"', remaining)?;
    let id_bytes = &remaining[..end];
    std::str::from_utf8(id_bytes).ok()?.parse().ok()
}

/// <https://docs.rs/tokio-util/latest/tokio_util/codec/trait.Decoder.html>
impl Decoder for NetconfCodec {
    type Item = DecodedFrame;
    type Error = FramingError;

    fn decode(&mut self, src: &mut BytesMut) -> Result<Option<Self::Item>, Self::Error> {
        match self.framing_mode {
            FramingMode::EndOfMessage => self.decode_eom(src),
            FramingMode::Chunked => self.decode_chunked(src),
        }
    }

    /// Handle EOF from the underlying transport.
    ///
    /// When `closing` is set (a `close-session` RPC is in flight), leftover
    /// holdback bytes are harmless artifacts of the EOM split-marker guard
    /// and are silently discarded. Otherwise we fall back to the default
    /// behaviour: any remaining bytes at EOF indicate a transport problem.
    fn decode_eof(&mut self, buf: &mut BytesMut) -> Result<Option<Self::Item>, Self::Error> {
        match self.decode(buf)? {
            Some(frame) => Ok(Some(frame)),
            None => {
                if !buf.is_empty() {
                    if self.closing {
                        debug!(
                            "decode_eof: discarding {} leftover bytes (session closing)",
                            buf.len()
                        );
                        buf.clear();
                    } else {
                        return Err(FramingError::Io(std::io::Error::other(format!(
                            "bytes remaining on stream ({} bytes)",
                            buf.len()
                        ))));
                    }
                }
                Ok(None)
            }
        }
    }
}

impl Encoder<Bytes> for NetconfCodec {
    type Error = FramingError;

    fn encode(&mut self, item: Bytes, dst: &mut BytesMut) -> Result<(), Self::Error> {
        debug!(
            "encode: framing={:?}, message={} bytes",
            self.framing_mode,
            item.len()
        );
        trace!(
            "encode: message preview: {:?}",
            String::from_utf8_lossy(&item[..item.len().min(200)])
        );
        match self.framing_mode {
            FramingMode::EndOfMessage => {
                dst.reserve(item.len() + EOM_LEN);
                dst.extend_from_slice(&item);
                dst.extend_from_slice(EOM_MARKER);
            }
            FramingMode::Chunked => {
                let header = format!("\n#{}\n", item.len());
                dst.reserve(header.len() + item.len() + CHUNKED_EOM_MARKER_LEN);
                dst.extend_from_slice(header.as_bytes());
                dst.extend_from_slice(&item);
                dst.extend_from_slice(CHUNKED_EOM_MARKER);
            }
        }
        Ok(())
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    /// Helper: decode all frames until EndOfMessage and concatenate the chunks.
    fn collect_message(codec: &mut NetconfCodec, buf: &mut BytesMut) -> Bytes {
        let mut result = BytesMut::new();
        loop {
            match codec.decode(buf).unwrap() {
                Some(DecodedFrame::Chunk(chunk)) => result.extend_from_slice(&chunk),
                Some(DecodedFrame::EndOfMessage) => break,
                None => panic!("unexpected None before EndOfMessage"),
            }
        }
        result.freeze()
    }

    // ── EOM Decoder tests ───────────────────────────────────────────────

    #[test]
    fn eom_decode_complete_message() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"<rpc-reply/>]]>]]>"[..]);

        // First decode: yields the data before the marker as a Chunk
        let result = codec.decode(&mut buf).unwrap();
        assert_eq!(
            result,
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<rpc-reply/>")))
        );

        // Second decode: yields EndOfMessage
        let result = codec.decode(&mut buf).unwrap();
        assert_eq!(result, Some(DecodedFrame::EndOfMessage));

        assert!(buf.is_empty());
    }

    #[test]
    fn eom_decode_incomplete_message() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"<rpc-reply/>"[..]);

        // 12 bytes available, holdback is 5. Safe to emit: 7 bytes.
        let result = codec.decode(&mut buf).unwrap();
        assert_eq!(
            result,
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<rpc-re")))
        );

        // Remaining 5 bytes <= holdback, need more data.
        let result = codec.decode(&mut buf).unwrap();
        assert_eq!(result, None);
    }

    #[test]
    fn eom_decode_partial_marker() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"<ok/>]]>"[..]);

        // 8 bytes, holdback 5, safe 3 — yield first chunk
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<ok")))
        );
        // Remaining 5 bytes <= holdback
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // Complete the marker
        buf.extend_from_slice(b"]]>");
        // Now buf is b"/>]]>]]>" — marker found at pos 2
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"/>")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn eom_decode_empty_message() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"]]>]]>"[..]);

        // Marker at position 0 — empty message, yield EndOfMessage directly.
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn eom_decode_two_messages() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"<a/>]]>]]><b/>]]>]]>"[..]);

        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<a/>")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<b/>")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn eom_decode_within_holdback() {
        // Buffer smaller than holdback — need more data.
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::from(&b"<ok>"[..]);
        assert_eq!(codec.decode(&mut buf).unwrap(), None);
    }

    #[test]
    fn eom_decode_large_message_streams_chunks() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let data = "x".repeat(1000);
        let mut buf = BytesMut::new();
        buf.extend_from_slice(data.as_bytes());
        buf.extend_from_slice(EOM_MARKER);

        // Collect all chunks — should reconstruct the original data.
        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, Bytes::from(data));
    }

    // ── Chunked Decoder tests ───────────────────────────────────────────

    #[test]
    fn chunked_decode_single_chunk() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#7\n<data/>\n##\n"[..]);

        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<data/>")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
        assert!(buf.is_empty());
    }

    #[test]
    fn chunked_decode_multiple_chunks_yields_individually() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#5\nHello\n#6\n World\n##\n"[..]);

        // Each chunk is yielded individually (not accumulated).
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b" World")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_decode_incomplete_header() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#"[..]);
        assert_eq!(codec.decode(&mut buf).unwrap(), None);
    }

    #[test]
    fn chunked_decode_incomplete_data() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#10\nHello"[..]);
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // Complete the data + end marker
        buf.extend_from_slice(b" Wrld\n##\n");
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello Wrld")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_decode_large_chunk() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let data = "x".repeat(10000);
        let mut buf = BytesMut::new();
        buf.extend_from_slice(format!("\n#{}\n", data.len()).as_bytes());
        buf.extend_from_slice(data.as_bytes());
        buf.extend_from_slice(b"\n##\n");

        let result = codec.decode(&mut buf).unwrap();
        match result {
            Some(DecodedFrame::Chunk(chunk)) => assert_eq!(chunk.len(), 10000),
            other => panic!("expected Chunk, got {:?}", other),
        }
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_decode_invalid_header() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#abc\n"[..]);
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::InvalidChunkSize(_)));
    }

    #[test]
    fn chunked_decode_zero_chunk_size() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#0\n\n##\n"[..]);
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::InvalidChunkSize(_)));
    }

    #[test]
    fn chunked_decode_size_limit() {
        let config = CodecConfig {
            max_message_size: Some(5),
            ..Default::default()
        };
        let mut codec = NetconfCodec::new(FramingMode::Chunked, config);
        let mut buf = BytesMut::from(&b"\n#10\n0123456789\n##\n"[..]);
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::MessageTooLarge { .. }));
    }

    #[test]
    fn chunked_decode_size_limit_cumulative() {
        let config = CodecConfig {
            max_message_size: Some(10),
            ..Default::default()
        };
        let mut codec = NetconfCodec::new(FramingMode::Chunked, config);
        // Three 5-byte chunks: cumulative 15 bytes exceeds the 10-byte limit
        let mut buf = BytesMut::from(&b"\n#5\naaaaa\n#5\nbbbbb\n#5\nccccc\n##\n"[..]);

        // First chunk (5 bytes) — under limit
        assert!(codec.decode(&mut buf).unwrap().is_some());
        // Second chunk (cumulative 10 bytes) — at limit
        assert!(codec.decode(&mut buf).unwrap().is_some());
        // Third chunk (cumulative 15 bytes) — exceeds limit
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::MessageTooLarge { .. }));
    }

    #[test]
    fn eom_decode_size_limit() {
        let config = CodecConfig {
            max_message_size: Some(10),
            ..Default::default()
        };
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, config);
        let mut buf = BytesMut::new();
        // 20 bytes of data exceeds the 10-byte limit
        buf.extend_from_slice(b"01234567890123456789]]>]]>");
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::MessageTooLarge { .. }));
    }

    #[test]
    fn eom_decode_size_limit_cumulative() {
        let config = CodecConfig {
            max_message_size: Some(10),
            ..Default::default()
        };
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, config);

        // First batch: 8 bytes of data, no marker yet. Holdback keeps 5,
        // so 3 bytes are yielded — under the limit.
        let mut buf = BytesMut::from(&b"01234567"[..]);
        assert!(codec.decode(&mut buf).unwrap().is_some()); // yields 3 bytes

        // Second batch: more data + marker. Cumulative now exceeds 10.
        buf.extend_from_slice(b"89ABCDEF]]>]]>");
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::MessageTooLarge { .. }));
    }

    #[test]
    fn eom_decode_size_limit_resets_between_messages() {
        let config = CodecConfig {
            max_message_size: Some(10),
            ..Default::default()
        };
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, config);

        // First message: 5 bytes — under the limit
        let mut buf = BytesMut::from(&b"hello]]>]]>"[..]);
        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, Bytes::from_static(b"hello"));

        // Second message: also 5 bytes — should succeed (counter was reset)
        buf.extend_from_slice(b"world]]>]]>");
        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, Bytes::from_static(b"world"));
    }

    // ── Encoder tests ───────────────────────────────────────────────────

    #[test]
    fn eom_encode() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::new();
        codec
            .encode(Bytes::from_static(b"<ok/>"), &mut buf)
            .unwrap();
        assert_eq!(&buf[..], b"<ok/>]]>]]>");
    }

    #[test]
    fn chunked_encode() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::new();
        codec
            .encode(Bytes::from_static(b"<ok/>"), &mut buf)
            .unwrap();
        assert_eq!(&buf[..], b"\n#5\n<ok/>\n##\n");
    }

    // ── Roundtrip tests ─────────────────────────────────────────────────

    #[test]
    fn eom_roundtrip() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let original = Bytes::from_static(b"<rpc message-id=\"1\"><get/></rpc>");
        let mut buf = BytesMut::new();
        codec.encode(original.clone(), &mut buf).unwrap();

        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, original);
    }

    #[test]
    fn chunked_roundtrip() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let original = Bytes::from_static(b"<rpc message-id=\"1\"><get/></rpc>");
        let mut buf = BytesMut::new();
        codec.encode(original.clone(), &mut buf).unwrap();

        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, original);
    }

    #[test]
    fn mode_switch() {
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());

        // Encode/decode in EOM mode
        let mut buf = BytesMut::new();
        codec
            .encode(Bytes::from_static(b"hello"), &mut buf)
            .unwrap();
        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, Bytes::from_static(b"hello"));

        // Switch to chunked
        codec.set_mode(FramingMode::Chunked);

        let mut buf = BytesMut::new();
        codec
            .encode(Bytes::from_static(b"world"), &mut buf)
            .unwrap();
        let collected = collect_message(&mut codec, &mut buf);
        assert_eq!(collected, Bytes::from_static(b"world"));
    }

    // ── EOM hello helpers tests ─────────────────────────────────────────

    #[tokio::test]
    async fn eom_helper_roundtrip() {
        let (mut client, mut server) = tokio::io::duplex(4096);

        let msg = "<hello/>";
        tokio::spawn(async move {
            write_eom_message(&mut server, msg).await.unwrap();
        });

        let received = read_eom_message(&mut client, None).await.unwrap();
        assert_eq!(received, msg);
    }

    #[tokio::test]
    async fn eom_helper_size_limit() {
        let (mut client, mut server) = tokio::io::duplex(4096);

        let msg = "x".repeat(1000);
        tokio::spawn(async move {
            write_eom_message(&mut server, &msg).await.unwrap();
        });

        let result = read_eom_message(&mut client, Some(10)).await;
        assert!(result.is_err());
    }

    // ── extract_message_id_from_bytes tests ─────────────────────────────

    #[test]
    fn extract_message_id_basic() {
        let xml =
            b"<rpc-reply message-id=\"42\" xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\">";
        assert_eq!(extract_message_id_from_bytes(xml), Some(42));
    }

    #[test]
    fn extract_message_id_large_id() {
        let xml = b"<rpc-reply message-id=\"4294967295\">";
        assert_eq!(extract_message_id_from_bytes(xml), Some(4294967295));
    }

    #[test]
    fn extract_message_id_with_xml_decl() {
        let xml = b"<?xml version=\"1.0\"?><rpc-reply message-id=\"7\">";
        assert_eq!(extract_message_id_from_bytes(xml), Some(7));
    }

    #[test]
    fn extract_message_id_missing() {
        let xml = b"<rpc-reply xmlns=\"urn:ietf:params:xml:ns:netconf:base:1.0\">";
        assert_eq!(extract_message_id_from_bytes(xml), None);
    }

    #[test]
    fn extract_message_id_non_numeric() {
        let xml = b"<rpc-reply message-id=\"abc\">";
        assert_eq!(extract_message_id_from_bytes(xml), None);
    }

    #[test]
    fn extract_message_id_empty_bytes() {
        assert_eq!(extract_message_id_from_bytes(b""), None);
    }

    #[test]
    fn extract_message_id_partial_header() {
        // Only have the start of the attribute, no closing quote
        let xml = b"<rpc-reply message-id=\"12";
        assert_eq!(extract_message_id_from_bytes(xml), None);
    }

    // ── Chunk-level decode tests (new) ──────────────────────────────────

    #[test]
    fn eom_incremental_arrival() {
        // Simulate data arriving in small pieces.
        let mut codec = NetconfCodec::new(FramingMode::EndOfMessage, CodecConfig::default());
        let mut buf = BytesMut::new();

        // First batch: just a few bytes (within holdback)
        buf.extend_from_slice(b"<ok");
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // Second batch: more data, now exceeds holdback
        buf.extend_from_slice(b"/>");
        // buf = b"<ok/>" (5 bytes), exactly holdback — still None
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // Third batch: data + marker
        buf.extend_from_slice(b"]]>]]>");
        // buf = b"<ok/>]]>]]>" — marker found at pos 5
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"<ok/>")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_two_messages_interleaved() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::new();
        buf.extend_from_slice(b"\n#3\naaa\n##\n\n#3\nbbb\n##\n");

        // First message
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"aaa")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );

        // Second message
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"bbb")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_three_chunks_in_one_message() {
        let mut codec = NetconfCodec::new(FramingMode::Chunked, CodecConfig::default());
        let mut buf = BytesMut::from(&b"\n#1\na\n#1\nb\n#1\nc\n##\n"[..]);

        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"a")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"b")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"c")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    // ── Lenient chunked framing tests ─────────────────────────────────

    fn lenient_config(mode: LenientChunkedFraming) -> CodecConfig {
        CodecConfig {
            max_message_size: None,
            lenient_chunked_framing: mode,
        }
    }

    #[test]
    fn chunked_lenient_correct_size_fast_path() {
        // Correct sizes with lenient enabled — same behaviour as strict.
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverBoth),
        );
        let mut buf = BytesMut::from(&b"\n#5\nHello\n#6\n World\n##\n"[..]);

        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b" World")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_undercount_recovery() {
        // Declared 5, actual 11 bytes before next boundary.
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverUndercount),
        );
        // Header says 5 bytes, but the real data is "Hello World" (11 bytes).
        let mut buf = BytesMut::from(&b"\n#5\nHello World\n##\n"[..]);

        let frame = codec.decode(&mut buf).unwrap();
        assert_eq!(
            frame,
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello World")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_overcount_recovery() {
        // Declared 20, actual 5 bytes before next \n# boundary.
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverOvercount),
        );
        // Header says 20, but real data is only "Hello" (5 bytes) before \n#3\n...
        let mut buf = BytesMut::from(&b"\n#20\nHello\n#3\nEnd\n##\n"[..]);

        let frame = codec.decode(&mut buf).unwrap();
        assert_eq!(
            frame,
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"End")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_both_recovery() {
        // RecoverBoth handles undercount…
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverBoth),
        );
        let mut buf = BytesMut::from(&b"\n#2\nHello\n##\n"[..]);
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );

        // …and overcount.
        codec.message_bytes = 0;
        let mut buf = BytesMut::from(&b"\n#20\nWorld\n##\n"[..]);
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"World")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_undercount_only_ignores_overcount() {
        // RecoverUndercount does NOT recover overcount — falls back to strict
        // (waits for declared size).
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverUndercount),
        );
        // Declared 20, actual 5 — but we're in RecoverUndercount mode.
        // The boundary scan finds "Hello" at 5 bytes, but since 5 < 20 is
        // overcount and we don't recover that, we fall to strict path which
        // waits for 20 bytes. Since only 5+EOM are available, strict needs
        // header_len(5) + 20 = 25 bytes total. We have "\n#20\nHello\n##\n" = 18 bytes.
        // Strict path: src.len() < header_len + chunk_size => Ok(None).
        let mut buf = BytesMut::from(&b"\n#20\nHello\n##\n"[..]);
        assert_eq!(codec.decode(&mut buf).unwrap(), None);
    }

    #[test]
    fn chunked_lenient_xml_with_hash_false_positive() {
        // \n# in XML content should not be treated as a chunk boundary
        // because it's followed by a non-digit, non-# character.
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverBoth),
        );
        // The data contains "\n#comment" which is NOT a valid boundary.
        // Declared size is 5 but actual is 18 ("data\n#comment\nend").
        let data = b"data\n#comment\nend";
        let mut buf = BytesMut::new();
        buf.extend_from_slice(format!("\n#5\n").as_bytes());
        buf.extend_from_slice(data);
        buf.extend_from_slice(b"\n##\n");

        let frame = codec.decode(&mut buf).unwrap();
        assert_eq!(
            frame,
            Some(DecodedFrame::Chunk(Bytes::from(data.as_slice())))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_incremental_arrival() {
        // Data arriving in small increments returns Ok(None) correctly.
        let mut codec = NetconfCodec::new(
            FramingMode::Chunked,
            lenient_config(LenientChunkedFraming::RecoverBoth),
        );

        // Just the header, no data yet.
        let mut buf = BytesMut::from(&b"\n#5\nHel"[..]);
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // More data but still no boundary.
        buf.extend_from_slice(b"lo Wor");
        assert_eq!(codec.decode(&mut buf).unwrap(), None);

        // Now the boundary arrives.
        buf.extend_from_slice(b"ld\n##\n");
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::Chunk(Bytes::from_static(b"Hello World")))
        );
        assert_eq!(
            codec.decode(&mut buf).unwrap(),
            Some(DecodedFrame::EndOfMessage)
        );
    }

    #[test]
    fn chunked_lenient_size_limit_uses_actual_size() {
        // max_message_size enforcement should use the recovered size.
        let config = CodecConfig {
            max_message_size: Some(5),
            lenient_chunked_framing: LenientChunkedFraming::RecoverUndercount,
        };
        let mut codec = NetconfCodec::new(FramingMode::Chunked, config);
        // Declared 3, actual 10 ("0123456789") — exceeds the 5-byte limit.
        let mut buf = BytesMut::from(&b"\n#3\n0123456789\n##\n"[..]);
        let err = codec.decode(&mut buf).unwrap_err();
        assert!(matches!(err, FramingError::MessageTooLarge { .. }));
    }
}