sozu_command_lib/proto/

display.rs

use std::{
    collections::{BTreeMap, HashMap, HashSet},
    fmt::{self, Display, Formatter},
    net::SocketAddr,
};

use prettytable::{Row, Table, cell, row};
use time::format_description;
use x509_parser::time::ASN1Time;

use super::command::FilteredHistogram;
use crate::{
    AsString,
    proto::{
        DisplayError,
        command::{
            AggregatedMetrics, AvailableMetrics, CertificateAndKey, CertificateSummary,
            CertificatesWithFingerprints, ClientAuthMode, Cluster, ClusterMetrics,
            CustomHttpAnswers, Event, EventKind, FilteredMetrics, ForwardedHeaders,
            HealthCheckConfig, HealthCheckMode, HealthChecksList, HttpEndpoint, HttpListenerConfig,
            HttpStatusRange, HttpsListenerConfig, ListOfCertificatesByAddress, ListedFrontends,
            ListenersList, MetricDetailStatus, ProtobufEndpoint, QueryCertificatesFilters,
            RequestCounts, RequestHttpFrontend, Response, ResponseContent, ResponseStatus,
            RunState, SocketAddress, TlsVersion, WorkerInfos, WorkerMetrics, WorkerResponses,
            filtered_metrics, protobuf_endpoint, request::RequestType,
            response_content::ContentType,
        },
    },
};

impl Display for CertificateAndKey {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        let versions = self.versions.iter().fold(String::new(), |acc, tls_v| {
            acc + " "
                + match TlsVersion::try_from(*tls_v) {
                    Ok(v) => v.as_str_name(),
                    Err(_) => "",
                }
        });
        write!(
            f,
            "\tcertificate: {}\n\tcertificate_chain: {:?}\n\tkey: {}\n\tTLS versions: {}\n\tnames: {:?}",
            self.certificate,
            self.certificate_chain,
            self.key,
            versions,
            concatenate_vector(&self.names)
        )
    }
}

impl Display for CertificateSummary {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        write!(f, "{}:\t{}", self.fingerprint, self.domain)
    }
}

impl Display for QueryCertificatesFilters {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        if let Some(d) = self.domain.clone() {
            write!(f, "domain:{d}")
        } else if let Some(fp) = self.fingerprint.clone() {
            write!(f, "fingerprint:{fp}")
        } else {
            write!(f, "all certificates")
        }
    }
}

pub fn concatenate_vector(vec: &[String]) -> String {
    vec.join(", ")
}

pub fn format_request_type(request_type: &RequestType) -> &str {
    match request_type {
        RequestType::SaveState(_) => "SaveState",
        RequestType::LoadState(_) => "LoadState",
        RequestType::CountRequests(_) => "CountRequests",
        RequestType::ListWorkers(_) => "ListWorkers",
        RequestType::ListFrontends(_) => "ListFrontends",
        RequestType::ListListeners(_) => "ListListeners",
        RequestType::LaunchWorker(_) => "LaunchWorker",
        RequestType::UpgradeMain(_) => "UpgradeMain",
        RequestType::UpgradeWorker(_) => "UpgradeWorker",
        RequestType::SubscribeEvents(_) => "SubscribeEvents",
        RequestType::ReloadConfiguration(_) => "ReloadConfiguration",
        RequestType::Status(_) => "Status",
        RequestType::QueryProtectedHealthCheckSupport(_) => "QueryProtectedHealthCheckSupport",
        RequestType::ProtectedHealthCheckOrder(_) => "ProtectedHealthCheckOrder",
        RequestType::AddCluster(_) => "AddCluster",
        RequestType::RemoveCluster(_) => "RemoveCluster",
        RequestType::AddHttpFrontend(_) => "AddHttpFrontend",
        RequestType::RemoveHttpFrontend(_) => "RemoveHttpFrontend",
        RequestType::AddHttpsFrontend(_) => "AddHttpsFrontend",
        RequestType::AddHttpFrontendWithSilentClose(_) => "AddHttpFrontendWithSilentClose",
        RequestType::AddHttpsFrontendWithSilentClose(_) => "AddHttpsFrontendWithSilentClose",
        RequestType::RemoveHttpsFrontend(_) => "RemoveHttpsFrontend",
        RequestType::AddHttpFrontendWithHeaderPredicates(_) => {
            "AddHttpFrontendWithHeaderPredicates"
        }
        RequestType::RemoveHttpFrontendWithHeaderPredicates(_) => {
            "RemoveHttpFrontendWithHeaderPredicates"
        }
        RequestType::AddHttpsFrontendWithHeaderPredicates(_) => {
            "AddHttpsFrontendWithHeaderPredicates"
        }
        RequestType::RemoveHttpsFrontendWithHeaderPredicates(_) => {
            "RemoveHttpsFrontendWithHeaderPredicates"
        }
        RequestType::AddCertificate(_) => "AddCertificate",
        RequestType::ReplaceCertificate(_) => "ReplaceCertificate",
        RequestType::RemoveCertificate(_) => "RemoveCertificate",
        RequestType::AddTcpFrontend(_) => "AddTcpFrontend",
        RequestType::RemoveTcpFrontend(_) => "RemoveTcpFrontend",
        RequestType::AddBackend(_) => "AddBackend",
        RequestType::AddUnixBackend(_) => "AddUnixBackend",
        RequestType::RemoveBackend(_) => "RemoveBackend",
        RequestType::AddHttpListener(_) => "AddHttpListener",
        RequestType::AddHttpsListener(_) => "AddHttpsListener",
        RequestType::AddHttpsListenerWithClientAuth(_) => "AddHttpsListenerWithClientAuth",
        RequestType::AddTcpListener(_) => "AddTcpListener",
        RequestType::AddUdpListener(_) => "AddUdpListener",
        RequestType::UpdateUdpListener(_) => "UpdateUdpListener",
        RequestType::AddUdpFrontend(_) => "AddUdpFrontend",
        RequestType::RemoveUdpFrontend(_) => "RemoveUdpFrontend",
        RequestType::RemoveListener(_) => "RemoveListener",
        RequestType::ActivateListener(_) => "ActivateListener",
        RequestType::DeactivateListener(_) => "DeactivateListener",
        RequestType::QueryClusterById(_) => "QueryClusterById",
        RequestType::QueryClustersByDomain(_) => "QueryClustersByDomain",
        RequestType::QueryClustersHashes(_) => "QueryClustersHashes",
        RequestType::QueryMetrics(_) => "QueryMetrics",
        RequestType::SoftStop(_) => "SoftStop",
        RequestType::HardStop(_) => "HardStop",
        RequestType::ConfigureMetrics(_) => "ConfigureMetrics",
        RequestType::Logging(_) => "Logging",
        RequestType::ReturnListenSockets(_) => "ReturnListenSockets",
        RequestType::QueryCertificatesFromTheState(_) => "QueryCertificatesFromTheState",
        RequestType::QueryCertificatesFromWorkers(_) => "QueryCertificatesFromWorkers",
        RequestType::UpdateHttpListener(_) => "UpdateHttpListener",
        RequestType::UpdateHttpsListener(_) => "UpdateHttpsListener",
        RequestType::UpdateHttpsListenerWithClientAuth(_) => "UpdateHttpsListenerWithClientAuth",
        RequestType::UpdateTcpListener(_) => "UpdateTcpListener",
        RequestType::SetMaxConnectionsPerIp(_) => "SetMaxConnectionsPerIp",
        RequestType::QueryMaxConnectionsPerIp(_) => "QueryMaxConnectionsPerIp",
        RequestType::SetMaxConnectionsPerSubnet(_) => "SetMaxConnectionsPerSubnet",
        RequestType::SetMaxConnectionAttempts(_) => "SetMaxConnectionAttempts",
        RequestType::QueryMaxConnectionsPerSubnet(_) => "QueryMaxConnectionsPerSubnet",
        RequestType::SetHealthCheck(_) => "SetHealthCheck",
        RequestType::SetProtectedHealthCheck(_) => "SetProtectedHealthCheck",
        RequestType::RemoveHealthCheck(_) => "RemoveHealthCheck",
        RequestType::QueryHealthChecks(_) => "QueryHealthChecks",
        RequestType::SetMetricDetail(_) => "SetMetricDetail",
        RequestType::CloseSessions(_) => "CloseSessions",
    }
}

pub fn print_json_response<T: ::serde::Serialize>(input: &T) -> Result<(), DisplayError> {
    let pretty_json = serde_json::to_string_pretty(&input).map_err(DisplayError::Json)?;
    println!("{pretty_json}");
    Ok(())
}

impl Response {
    pub fn display(&self, json: bool) -> Result<(), DisplayError> {
        match self.status() {
            ResponseStatus::Ok => {
                // avoid displaying anything else than JSON
                if !json {
                    println!("Success: {}", self.message)
                }
            }
            ResponseStatus::Failure => println!("Failure: {}", self.message),
            ResponseStatus::Processing => {
                return Err(DisplayError::WrongResponseType(
                    "ResponseStatus::Processing".to_string(),
                ));
            }
        }

        match &self.content {
            Some(content) => content.display(json),
            None => {
                if json {
                    println!("{{}}");
                } else {
                    println!("No content");
                }
                Ok(())
            }
        }
    }
}

impl ResponseContent {
    fn display(&self, json: bool) -> Result<(), DisplayError> {
        let content_type = match &self.content_type {
            Some(content_type) => content_type,
            None => {
                println!("No content");
                return Ok(());
            }
        };

        if json {
            return print_json_response(&content_type);
        }

        match content_type {
            ContentType::Workers(worker_infos) => print_status(worker_infos),
            ContentType::Metrics(aggr_metrics) => print_metrics(aggr_metrics),
            ContentType::FrontendList(frontends) => print_frontends(frontends),
            ContentType::ListenersList(listeners) => print_listeners(listeners),
            ContentType::WorkerMetrics(worker_metrics) => print_worker_metrics(worker_metrics),
            ContentType::AvailableMetrics(list) => print_available_metrics(list),
            ContentType::RequestCounts(request_counts) => print_request_counts(request_counts),
            ContentType::CertificatesWithFingerprints(certs) => {
                print_certificates_with_validity(certs)
            }
            ContentType::WorkerResponses(worker_responses) => {
                // exception when displaying clusters
                if worker_responses.contain_cluster_infos() {
                    print_cluster_infos(worker_responses)
                } else if worker_responses.contain_cluster_hashes() {
                    print_cluster_hashes(worker_responses)
                } else {
                    print_responses_by_worker(worker_responses, json)
                }
            }
            ContentType::ProtectedHealthCheckReply(_) => Ok(()), // internal acknowledgement
            ContentType::Clusters(_) | ContentType::ClusterHashes(_) => Ok(()), // not displayed directly, see print_cluster_responses
            ContentType::CertificatesByAddress(certs) => print_certificates_by_address(certs),
            ContentType::MetricDetailStatus(status) => print_metric_detail_status(status),
            ContentType::MaxConnectionsPerIpLimit(limit_info) => {
                if limit_info.limit == 0 {
                    println!("Max connections per (cluster, source-IP): unlimited (0)");
                } else {
                    println!(
                        "Max connections per (cluster, source-IP): {}",
                        limit_info.limit
                    );
                }
                Ok(())
            }
            ContentType::MaxConnectionsPerSubnetLimit(limit_info) => {
                // The prefixes are boot-time only, so they are printed
                // alongside the cap: "100" alone would not tell the
                // operator what it is 100 connections PER.
                if limit_info.limit == 0 {
                    println!("Max connections per (cluster, source-subnet): unlimited (0)");
                } else {
                    println!(
                        "Max connections per (cluster, source-subnet): {}",
                        limit_info.limit
                    );
                }
                println!(
                    "Subnet prefixes: IPv4 /{}, IPv6 /{}",
                    limit_info.ipv4_prefix, limit_info.ipv6_prefix
                );
                Ok(())
            }
            ContentType::HealthChecksList(list) => print_health_checks(list),
            ContentType::Event(_event) => Ok(()), // not event displayed yet!
            // Per-worker SetMetricDetail status payload. The aggregated
            // MetricDetailStatus is what operators read at the
            // `sozu` CLI surface; the per-worker variant flows
            // master-side only (collected by SetMetricDetailTask) and
            // is never printed directly. Silent OK keeps the match
            // exhaustive without surfacing internal IPC payloads on
            // the operator's terminal.
            ContentType::WorkerMetricDetailStatus(_) => Ok(()),
            ContentType::ClosedSessions(closed) => {
                println!(
                    "{} sessions closed, {} draining",
                    closed.closed, closed.draining
                );
                Ok(())
            }
        }
    }
}

impl WorkerResponses {
    fn contain_cluster_infos(&self) -> bool {
        for response in self.map.values() {
            if let Some(content_type) = &response.content_type
                && matches!(content_type, ContentType::Clusters(_))
            {
                return true;
            }
        }
        false
    }

    fn contain_cluster_hashes(&self) -> bool {
        for response in self.map.values() {
            if let Some(content_type) = &response.content_type
                && matches!(content_type, ContentType::ClusterHashes(_))
            {
                return true;
            }
        }
        false
    }
}

pub fn print_status(worker_infos: &WorkerInfos) -> Result<(), DisplayError> {
    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    table.add_row(row!["worker id", "pid", "run state"]);

    let mut sorted_infos = worker_infos.vec.clone();
    sorted_infos.sort_by_key(|worker| worker.id);

    for worker_info in &sorted_infos {
        let row = row!(
            worker_info.id,
            worker_info.pid,
            RunState::try_from(worker_info.run_state)
                .map_err(DisplayError::DecodeError)?
                .as_str_name()
        );
        table.add_row(row);
    }

    table.printstd();
    Ok(())
}

pub fn print_metrics(aggregated_metrics: &AggregatedMetrics) -> Result<(), DisplayError> {
    // main process metrics
    println!("\nMAIN PROCESS\n============");
    print_proxy_metrics(&aggregated_metrics.main);

    if !aggregated_metrics.proxying.is_empty() {
        println!("\nPROXYING\n============");
        print_proxy_metrics(&aggregated_metrics.proxying);
    }

    // workers
    for (worker_id, worker) in aggregated_metrics.workers.iter() {
        if !worker.clusters.is_empty() && !worker.proxy.is_empty() {
            println!("\nWorker {worker_id}\n=========");
            print_worker_metrics(worker)?;
        }
    }

    // clusters
    if !aggregated_metrics.clusters.is_empty() {
        println!("\nClusters\n=======");
        print_cluster_metrics(&aggregated_metrics.clusters);
    }

    Ok(())
}

fn print_proxy_metrics(proxy_metrics: &BTreeMap<String, FilteredMetrics>) {
    let filtered = filter_metrics(proxy_metrics);
    print_gauges_and_counts(&filtered);
    print_percentiles(&filtered);
    print_histograms(&filtered);
}

fn print_worker_metrics(worker_metrics: &WorkerMetrics) -> Result<(), DisplayError> {
    print_proxy_metrics(&worker_metrics.proxy);
    print_cluster_metrics(&worker_metrics.clusters);

    Ok(())
}

fn print_cluster_metrics(cluster_metrics: &BTreeMap<String, ClusterMetrics>) {
    for (cluster_id, cluster_metrics_data) in cluster_metrics.iter() {
        println!("\nCluster {cluster_id}\n--------");

        let filtered = filter_metrics(&cluster_metrics_data.cluster);
        print_gauges_and_counts(&filtered);
        print_percentiles(&filtered);
        print_histograms(&filtered);

        // backend_id -> (metric_name -> value )
        let mut backend_metric_acc: HashMap<String, BTreeMap<String, FilteredMetrics>> =
            HashMap::new();

        for backend in &cluster_metrics_data.backends {
            for (metric_name, value) in &backend.metrics {
                backend_metric_acc
                    .entry(backend.backend_id.clone())
                    .and_modify(|map| {
                        map.insert(metric_name.clone(), value.clone());
                    })
                    .or_insert(BTreeMap::from([(metric_name.clone(), value.clone())]));
            }
        }

        for (backend_id, metrics) in backend_metric_acc {
            println!("\n{cluster_id}/{backend_id}\n--------");
            let filtered = filter_metrics(&metrics);
            print_gauges_and_counts(&filtered);
            print_percentiles(&filtered);
            print_histograms(&filtered);
        }
    }
}

fn filter_metrics(
    metrics: &BTreeMap<String, FilteredMetrics>,
) -> BTreeMap<String, FilteredMetrics> {
    let mut filtered_metrics = BTreeMap::new();

    for (metric_key, filtered_value) in metrics.iter() {
        filtered_metrics.insert(
            metric_key.replace('\t', ".").to_string(),
            filtered_value.clone(),
        );
    }
    filtered_metrics
}

fn print_gauges_and_counts(filtered_metrics: &BTreeMap<String, FilteredMetrics>) {
    let mut titles: Vec<String> = filtered_metrics
        .iter()
        .filter_map(|(title, filtered_data)| match filtered_data.inner {
            Some(filtered_metrics::Inner::Count(_)) | Some(filtered_metrics::Inner::Gauge(_)) => {
                Some(title.to_owned())
            }
            _ => None,
        })
        .collect();

    // sort the titles so they always appear in the same order
    titles.sort();

    if titles.is_empty() {
        return;
    }

    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);

    table.set_titles(Row::new(vec![cell!(""), cell!("gauge"), cell!("count")]));

    for title in titles {
        let mut row = vec![cell!(title)];
        match filtered_metrics.get(&title) {
            Some(filtered_metrics) => match filtered_metrics.inner {
                Some(filtered_metrics::Inner::Count(c)) => {
                    row.push(cell!(""));
                    row.push(cell!(c))
                }
                Some(filtered_metrics::Inner::Gauge(c)) => {
                    row.push(cell!(c));
                    row.push(cell!(""))
                }
                _ => {}
            },
            _ => row.push(cell!("")),
        }
        table.add_row(Row::new(row));
    }

    table.printstd();
}

fn print_percentiles(filtered_metrics: &BTreeMap<String, FilteredMetrics>) {
    let mut percentile_titles: Vec<String> = filtered_metrics
        .iter()
        .filter_map(|(title, filtered_data)| match filtered_data.inner.clone() {
            Some(filtered_metrics::Inner::Percentiles(_)) => Some(title.to_owned()),
            _ => None,
        })
        .collect();

    // sort the metrics so they always appear in the same order
    percentile_titles.sort();

    if percentile_titles.is_empty() {
        return;
    }

    let mut percentile_table = Table::new();
    percentile_table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);

    percentile_table.set_titles(Row::new(vec![
        cell!("Percentiles"),
        cell!("samples"),
        cell!("p50"),
        cell!("p90"),
        cell!("p99"),
        cell!("p99.9"),
        cell!("p99.99"),
        cell!("p99.999"),
        cell!("p100"),
    ]));

    for title in percentile_titles {
        if let Some(FilteredMetrics {
            inner: Some(filtered_metrics::Inner::Percentiles(percentiles)),
        }) = filtered_metrics.get(&title)
        {
            percentile_table.add_row(Row::new(vec![
                cell!(title),
                cell!(percentiles.samples),
                cell!(percentiles.p_50),
                cell!(percentiles.p_90),
                cell!(percentiles.p_99),
                cell!(percentiles.p_99_9),
                cell!(percentiles.p_99_99),
                cell!(percentiles.p_99_999),
                cell!(percentiles.p_100),
            ]));
        } else {
            println!("Something went VERY wrong here");
        }
    }

    percentile_table.printstd();
}

fn print_histograms(filtered_metrics: &BTreeMap<String, FilteredMetrics>) {
    let histograms: BTreeMap<String, FilteredHistogram> = filtered_metrics
        .iter()
        .filter_map(|(name, metric)| match metric.inner.clone() {
            Some(filtered_metrics::Inner::Histogram(hist)) => Some((name.to_owned(), hist)),
            _ => None,
        })
        .collect();

    let mut histogram_titles: Vec<String> = histograms.keys().map(ToOwned::to_owned).collect();
    histogram_titles.sort();
    if histogram_titles.is_empty() {
        return;
    }

    let mut histogram_table = Table::new();
    histogram_table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);

    let mut first_row = Row::new(vec![cell!("Histograms (ms)"), cell!("sum"), cell!("count")]);

    let biggest_hist_length = histograms
        .values()
        .map(|hist| hist.buckets.len())
        .max()
        .unwrap_or(0);

    // 0, 1, 3, 7... in the upper row
    for exponent in 0..biggest_hist_length {
        first_row.add_cell(cell!(format!("{}", (1 << exponent) - 1)));
    }
    histogram_table.set_titles(first_row);

    for title in histogram_titles {
        if let Some(hist) = histograms.get(&title) {
            let trimmed_name = title.strip_suffix("_histogram").unwrap_or_default();
            let mut row = Row::new(vec![
                cell!(trimmed_name),
                cell!(hist.sum),
                cell!(hist.count),
            ]);
            // display the count by bucket, not the incremented count
            let mut last_bucket_count = 0;
            for bucket in &hist.buckets {
                row.add_cell(cell!(bucket.count - last_bucket_count));
                last_bucket_count = bucket.count;
            }
            histogram_table.add_row(row);
        }
    }

    histogram_table.printstd();
}

fn print_available_metrics(available_metrics: &AvailableMetrics) -> Result<(), DisplayError> {
    println!("Available metrics on the proxy level:");
    for metric_name in &available_metrics.proxy_metrics {
        println!("\t{metric_name}");
    }
    println!("Available metrics on the cluster level:");
    for metric_name in &available_metrics.cluster_metrics {
        println!("\t{metric_name}");
    }
    Ok(())
}

/// Table of HTTP(S) frontends for `ListFrontends`. The header predicates are
/// summarised by their count only: names and values may carry secrets.
fn http_frontends_table(title: &str, frontends: &[RequestHttpFrontend]) -> Table {
    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    table.add_row(row![title]);
    table.add_row(row![
        "cluster_id",
        "address",
        "hostname",
        "path",
        "method",
        "position",
        "header_predicates",
        "tags"
    ]);
    for frontend in frontends.iter() {
        table.add_row(row!(
            frontend.cluster_id.clone().unwrap_or("Deny".to_owned()),
            frontend.address.to_string(),
            frontend.hostname.to_string(),
            format!("{:?}", frontend.path),
            format!("{:?}", frontend.method),
            format!("{:?}", frontend.position),
            frontend.header_predicates.len(),
            format_tags_to_string(&frontend.tags)
        ));
    }
    table
}

/// Table of the HTTP(S) frontends of `ListClusters`, one marker column per
/// worker. Same redaction rule as [`http_frontends_table`].
fn cluster_http_frontends_table(
    frontends: &BTreeMap<&RequestHttpFrontend, Vec<String>>,
    worker_responses: &WorkerResponses,
) -> Table {
    let mut table = create_cluster_table(
        vec!["id", "hostname", "path", "header_predicates"],
        &worker_responses.map,
    );
    for (key, values) in frontends.iter() {
        let mut row = Vec::new();
        match &key.cluster_id {
            Some(cluster_id) => row.push(cell!(cluster_id)),
            None => row.push(cell!("-")),
        }
        row.push(cell!(key.hostname));
        row.push(cell!(key.path));
        row.push(cell!(key.header_predicates.len()));

        for val in values.iter() {
            if worker_responses.map.contains_key(val) {
                row.push(cell!("X"));
            } else {
                row.push(cell!(""));
            }
        }

        table.add_row(Row::new(row));
    }
    table
}

fn print_frontends(frontends: &ListedFrontends) -> Result<(), DisplayError> {
    trace!(" We received this frontends to display {:#?}", frontends);
    // HTTP frontends
    if !frontends.http_frontends.is_empty() {
        http_frontends_table("HTTP frontends ", &frontends.http_frontends).printstd();
    }

    // HTTPS frontends
    if !frontends.https_frontends.is_empty() {
        http_frontends_table("HTTPS frontends", &frontends.https_frontends).printstd();
    }

    // TCP frontends
    if !frontends.tcp_frontends.is_empty() {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        table.add_row(row!["TCP frontends  "]);
        table.add_row(row!["Cluster ID", "address", "tags"]);
        for tcp_frontend in frontends.tcp_frontends.iter() {
            table.add_row(row!(
                tcp_frontend.cluster_id,
                tcp_frontend.address,
                format_tags_to_string(&tcp_frontend.tags)
            ));
        }
        table.printstd();
    }

    // UDP frontends
    if !frontends.udp_frontends.is_empty() {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        table.add_row(row!["UDP frontends  "]);
        table.add_row(row!["Cluster ID", "address", "tags"]);
        for udp_frontend in frontends.udp_frontends.iter() {
            table.add_row(row!(
                udp_frontend.cluster_id,
                udp_frontend.address,
                format_tags_to_string(&udp_frontend.tags)
            ));
        }
        table.printstd();
    }
    Ok(())
}

pub fn print_listeners(listeners_list: &ListenersList) -> Result<(), DisplayError> {
    println!("\nHTTP LISTENERS\n================");

    for http_listener in listeners_list.http_listeners.values() {
        println!("{http_listener}");
    }

    println!("\nHTTPS LISTENERS\n================");

    for https_listener in listeners_list.https_listeners.values() {
        println!("{https_listener}");
    }

    println!("\nTCP LISTENERS\n================");

    if !listeners_list.tcp_listeners.is_empty() {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        table.add_row(row!["TCP frontends"]);
        table.add_row(row![
            "socket address",
            "interface",
            "public address",
            "expect proxy",
            "front timeout",
            "back timeout",
            "connect timeout",
            "activated"
        ]);
        for tcp_listener in listeners_list.tcp_listeners.values() {
            table.add_row(row![
                format!("{:?}", tcp_listener.address),
                tcp_listener.interface.as_deref().unwrap_or("-"),
                format!("{:?}", tcp_listener.public_address),
                tcp_listener.expect_proxy,
                tcp_listener.front_timeout,
                tcp_listener.back_timeout,
                tcp_listener.connect_timeout,
                tcp_listener.active,
            ]);
        }
        table.printstd();
    }

    println!("\nUDP LISTENERS\n================");

    if !listeners_list.udp_listeners.is_empty() {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        table.add_row(row!["UDP listeners"]);
        // UDP has no expect_proxy / connect_timeout (no connect handshake);
        // it carries datagram-specific knobs instead.
        table.add_row(row![
            "socket address",
            "interface",
            "public address",
            "front timeout",
            "back timeout",
            "max rx datagram size",
            "max flows",
            "activated"
        ]);
        for udp_listener in listeners_list.udp_listeners.values() {
            table.add_row(row![
                format!("{:?}", udp_listener.address),
                udp_listener.interface.as_deref().unwrap_or("-"),
                format!("{:?}", udp_listener.public_address),
                udp_listener.front_timeout,
                udp_listener.back_timeout,
                udp_listener.max_rx_datagram_size,
                udp_listener.max_flows,
                udp_listener.active,
            ]);
        }
        table.printstd();
    }
    Ok(())
}

/// What a cluster keys `HRW`/`MAGLEV` selection on, for the cluster table:
/// `header:<name>`, `cookie:<name>`, or `source_ip`, the default.
fn affinity_key_label(cluster: &Cluster) -> String {
    match (&cluster.affinity_header, &cluster.affinity_cookie) {
        (Some(header), _) => format!("header:{header}"),
        (None, Some(cookie)) => format!("cookie:{cookie}"),
        (None, None) => String::from("source_ip"),
    }
}

/// A cluster's shuffle sharding, for the cluster table: `off`, or
/// `<percent>% from <min> backends, <mode>`.
fn shuffle_sharding_label(cluster: &Cluster) -> String {
    match cluster.shard_percent {
        None => String::from("off"),
        Some(percent) => format!(
            "{percent}% from {} backends, {}",
            cluster
                .shard_min_backends
                .unwrap_or(crate::config::DEFAULT_SHARD_MIN_BACKENDS),
            cluster.shard_mode().as_str_name()
        ),
    }
}

fn print_cluster_infos(worker_responses: &WorkerResponses) -> Result<(), DisplayError> {
    let mut cluster_table = create_cluster_table(
        vec![
            "id",
            "sticky_session",
            "https_redirect",
            "affinity_key",
            "shuffle_sharding",
            "max_connection_attempts",
        ],
        &worker_responses.map,
    );

    let mut tcp_frontend_table = create_cluster_table(vec!["id", "address"], &worker_responses.map);

    let mut udp_frontend_table = create_cluster_table(vec!["id", "address"], &worker_responses.map);

    let mut backend_table = create_cluster_table(
        vec!["backend id", "IP address", "Backup"],
        &worker_responses.map,
    );

    let worker_ids: HashSet<&String> = worker_responses.map.keys().collect();

    let mut cluster_infos = BTreeMap::new();
    let mut http_frontends = BTreeMap::new();
    let mut https_frontends = BTreeMap::new();
    let mut tcp_frontends = BTreeMap::new();
    let mut udp_frontends = BTreeMap::new();
    let mut backends = BTreeMap::new();

    for (worker_id, response_content) in worker_responses.map.iter() {
        if let Some(ContentType::Clusters(clusters)) = &response_content.content_type {
            for cluster in clusters.vec.iter() {
                if cluster.configuration.is_some() {
                    let entry = cluster_infos.entry(cluster).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }

                for frontend in cluster.http_frontends.iter() {
                    let entry = http_frontends.entry(frontend).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }

                for frontend in cluster.https_frontends.iter() {
                    let entry = https_frontends.entry(frontend).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }

                for frontend in cluster.tcp_frontends.iter() {
                    let entry = tcp_frontends.entry(frontend).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }

                for frontend in cluster.udp_frontends.iter() {
                    let entry = udp_frontends.entry(frontend).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }

                for backend in cluster.backends.iter() {
                    let entry = backends.entry(backend).or_insert(Vec::new());
                    entry.push(worker_id.to_owned());
                }
            }
        }
    }

    if cluster_infos.is_empty() {
        println!("no cluster found");
        return Ok(());
    }

    println!("Cluster level configuration:\n");

    for (cluster_info, workers_the_cluster_is_present_on) in cluster_infos.iter() {
        let configuration = cluster_info.configuration.as_ref();
        let mut row = vec![
            cell!(
                configuration
                    .map(|conf| conf.cluster_id.to_owned())
                    .unwrap_or_else(|| String::from("None"))
            ),
            cell!(configuration.is_some_and(|conf| conf.sticky_session)),
            cell!(configuration.is_some_and(|conf| conf.https_redirect)),
            cell!(
                configuration
                    .map(affinity_key_label)
                    .unwrap_or_else(|| String::from("-"))
            ),
            cell!(
                configuration
                    .map(shuffle_sharding_label)
                    .unwrap_or_else(|| String::from("-"))
            ),
            // `global` when the cluster inherits the worker's value.
            cell!(
                configuration
                    .and_then(|conf| conf.max_connection_attempts)
                    .map_or_else(|| String::from("global"), |attempts| attempts.to_string())
            ),
        ];

        for worker in workers_the_cluster_is_present_on {
            if worker_ids.contains(worker) {
                row.push(cell!("X"));
            } else {
                row.push(cell!(""));
            }
        }

        cluster_table.add_row(Row::new(row));
    }

    cluster_table.printstd();

    println!("\nHTTP frontends configuration for:\n");

    cluster_http_frontends_table(&http_frontends, worker_responses).printstd();

    println!("\nHTTPS frontends configuration for:\n");

    cluster_http_frontends_table(&https_frontends, worker_responses).printstd();

    println!("\nTCP frontends configuration:\n");

    for (key, values) in tcp_frontends.iter() {
        let mut row = vec![cell!(key.cluster_id), cell!(format!("{}", key.address))];

        for val in values.iter() {
            if worker_ids.contains(val) {
                row.push(cell!(String::from("X")));
            } else {
                row.push(cell!(String::from("")));
            }
        }

        tcp_frontend_table.add_row(Row::new(row));
    }

    tcp_frontend_table.printstd();

    println!("\nUDP frontends configuration:\n");

    for (key, values) in udp_frontends.iter() {
        let mut row = vec![cell!(key.cluster_id), cell!(format!("{}", key.address))];

        for val in values.iter() {
            if worker_ids.contains(val) {
                row.push(cell!(String::from("X")));
            } else {
                row.push(cell!(String::from("")));
            }
        }

        udp_frontend_table.add_row(Row::new(row));
    }

    udp_frontend_table.printstd();

    println!("\nbackends configuration:\n");

    for (key, values) in backends.iter() {
        let mut row = vec![
            cell!(key.backend_id),
            cell!(format!("{}", key.address)),
            cell!(
                key.backup
                    .map(|b| if b { "X" } else { "" })
                    .unwrap_or_else(|| "")
            ),
        ];

        for val in values {
            if worker_ids.contains(&val) {
                row.push(cell!("X"));
            } else {
                row.push(cell!(""));
            }
        }

        backend_table.add_row(Row::new(row));
    }

    backend_table.printstd();

    Ok(())
}

/// display all clusters in a simplified table showing their hashes
fn print_cluster_hashes(worker_responses: &WorkerResponses) -> Result<(), DisplayError> {
    let mut clusters_table = Table::new();
    clusters_table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    let mut header = vec![cell!("cluster id")];
    for worker_id in worker_responses.map.keys() {
        header.push(cell!(format!("worker {}", worker_id)));
    }
    header.push(cell!("desynchronized"));
    clusters_table.add_row(Row::new(header));

    let mut cluster_hashes = HashMap::new();

    for response_content in worker_responses.map.values() {
        if let Some(ContentType::ClusterHashes(hashes)) = &response_content.content_type {
            for (cluster_id, hash) in hashes.map.iter() {
                cluster_hashes
                    .entry(cluster_id)
                    .or_insert(Vec::new())
                    .push(hash);
            }
        }
    }

    for (cluster_id, hashes) in cluster_hashes.iter() {
        let mut row = vec![cell!(cluster_id)];
        for val in hashes.iter() {
            row.push(cell!(format!("{val}")));
        }

        let hs: HashSet<&u64> = hashes.iter().cloned().collect();
        if hs.len() > 1 {
            row.push(cell!("X"));
        } else {
            row.push(cell!(""));
        }

        clusters_table.add_row(Row::new(row));
    }

    clusters_table.printstd();
    Ok(())
}

fn print_responses_by_worker(
    worker_responses: &WorkerResponses,
    json: bool,
) -> Result<(), DisplayError> {
    for (worker_id, content) in worker_responses.map.iter() {
        println!("Worker {worker_id}");
        content.display(json)?;
    }

    Ok(())
}

pub fn print_certificates_with_validity(
    certs: &CertificatesWithFingerprints,
) -> Result<(), DisplayError> {
    if certs.certs.is_empty() {
        println!("No certificates match your request.");
        return Ok(());
    }

    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_CLEAN);
    table.add_row(row![
        "fingeprint",
        "valid not before",
        "valide not after",
        "domain names",
    ]);

    for (fingerprint, cert) in &certs.certs {
        let (_unparsed, pem_certificate) =
            x509_parser::pem::parse_x509_pem(cert.certificate.as_bytes())
                .expect("Could not parse pem certificate");

        let x509_certificate = pem_certificate
            .parse_x509()
            .expect("Could not parse x509 certificate");

        let validity = x509_certificate.validity();

        table.add_row(row!(
            fingerprint,
            format_datetime(validity.not_before)?,
            format_datetime(validity.not_after)?,
            concatenate_vector(&cert.names),
        ));
    }
    table.printstd();

    Ok(())
}

fn print_certificates_by_address(list: &ListOfCertificatesByAddress) -> Result<(), DisplayError> {
    for certs in list.certificates.iter() {
        println!("\t{}:", certs.address);

        for summary in certs.certificate_summaries.iter() {
            println!("\t\t{summary}");
        }
    }
    Ok(())
}

fn print_metric_detail_status(status: &MetricDetailStatus) -> Result<(), DisplayError> {
    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    table.add_row(row![
        "scope",
        "configured",
        "previous effective",
        "effective",
        "active leases"
    ]);
    table.add_row(row!(
        "main",
        status.configured().as_str_name(),
        status.previous_effective().as_str_name(),
        status.effective().as_str_name(),
        "—",
    ));
    for (worker_id, w) in &status.workers {
        table.add_row(row!(
            format!("worker:{worker_id}"),
            w.configured().as_str_name(),
            w.previous_effective().as_str_name(),
            w.effective().as_str_name(),
            w.active_lease_count,
        ));
    }
    table.printstd();
    Ok(())
}

fn print_request_counts(request_counts: &RequestCounts) -> Result<(), DisplayError> {
    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    table.add_row(row!["request type", "count"]);

    for (request_type, count) in &request_counts.map {
        table.add_row(row!(request_type, count));
    }
    table.printstd();
    Ok(())
}

fn print_health_checks(list: &HealthChecksList) -> Result<(), DisplayError> {
    if list.map.is_empty() {
        println!("No health checks configured.");
        return Ok(());
    }

    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    table.add_row(row![
        "cluster",
        "mode",
        "port",
        "uri",
        "interval",
        "timeout",
        "healthy threshold",
        "unhealthy threshold",
        "accepted statuses",
        "headers"
    ]);

    let mut entries: Vec<_> = list.map.iter().collect();
    entries.sort_by_key(|(id, _)| id.as_str());

    for (cluster_id, config) in entries {
        let (mode, uri, accepted) = match HealthCheckMode::try_from(config.mode) {
            Ok(HealthCheckMode::Http) => ("http", config.uri.as_str(), accepted_statuses(config)),
            Ok(HealthCheckMode::Tcp) => ("tcp", "-", "-".to_owned()),
            Err(_) => ("unknown", config.uri.as_str(), "-".to_owned()),
        };
        // Unset probes the backend's own data port.
        let port = config
            .port
            .map_or_else(|| "data".to_owned(), |port| port.to_string());

        table.add_row(row![
            cluster_id,
            mode,
            port,
            uri,
            format!("{}s", config.interval),
            format!("{}s", config.timeout),
            config.healthy_threshold,
            config.unhealthy_threshold,
            accepted,
            header_names(config)
        ]);
    }
    table.printstd();
    Ok(())
}

/// The custom header names of a probe with their fingerprints, in the order
/// they are sent. A config holds no value, so none can reach the terminal.
fn header_names(config: &HealthCheckConfig) -> String {
    if config.headers.is_empty() {
        return "-".to_owned();
    }
    config
        .headers
        .iter()
        .map(|header| {
            if header.fingerprint.is_empty() {
                format!("{}: (no fingerprint)", header.name)
            } else {
                format!("{}: {}", header.name, header.fingerprint)
            }
        })
        .collect::<Vec<_>>()
        .join("\n")
}

/// The statuses an HTTP-mode probe accepts, in the syntax
/// `sozu cluster health-check set --accepted-statuses` takes back.
fn accepted_statuses(config: &HealthCheckConfig) -> String {
    if !config.accepted_statuses.is_empty() {
        return config
            .accepted_statuses
            .iter()
            .map(HttpStatusRange::to_string)
            .collect::<Vec<_>>()
            .join(",");
    }
    match config.expected_status {
        0 => "2xx".to_owned(),
        status => status.to_string(),
    }
}

/// Renders the range in the syntax `parse_http_status_range`
/// (`command/src/config.rs`) parses: `404`, `2xx`, `any` or `200-399`.
impl Display for HttpStatusRange {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        if self.start == self.end {
            write!(f, "{}", self.start)
        } else if self.start == crate::config::HTTP_STATUS_MIN
            && self.end == crate::config::HTTP_STATUS_MAX
        {
            write!(f, "any")
        } else if self.start.is_multiple_of(100) && self.end == self.start + 99 {
            write!(f, "{}xx", self.start / 100)
        } else {
            write!(f, "{}-{}", self.start, self.end)
        }
    }
}

fn format_tags_to_string(tags: &BTreeMap<String, String>) -> String {
    tags.iter()
        .map(|(k, v)| format!("{k}={v}"))
        .collect::<Vec<_>>()
        .join(", ")
}

/// Render an HTTPS listener's mTLS client-authentication policy.
///
/// An operator reading `sozu listeners` must be able to tell a listener that
/// requires a client certificate from one that does not: the two are otherwise
/// indistinguishable in this table, which is exactly the confusion that turns a
/// misapplied policy into silent unauthenticated access. The rows are emitted
/// whenever any client authentication key is set, an explicit `none`
/// included, so a listener with a policy always shows it; a listener with
/// none of the keys renders as it did before client authentication existed,
/// like the other optional rows of this table.
///
/// CA and CRL entries are PEM bodies. They are summarised as counts only —
/// never rendered — matching the redaction the hand-written
/// `Debug for HttpsListenerConfig` (`command/src/proto/mod.rs`) applies to
/// `certificate` / `key`.
fn add_client_auth_rows(
    table: &mut Table,
    client_auth: &Option<i32>,
    client_ca_certificates: &[String],
    client_ca_crls: &[String],
) {
    let raw = client_auth.unwrap_or(ClientAuthMode::ClientAuthNone as i32);
    // An unknown value must not be folded to `none`: the worker rejects it at
    // listener build time, and displaying it as "none" here would hide why.
    let mode = match ClientAuthMode::try_from(raw) {
        Ok(mode) => mode.as_str_name().to_owned(),
        Err(_) => format!("UNKNOWN ({raw})"),
    };
    table.add_row(row!["client auth", mode]);
    table.add_row(row!["client CA certificates", client_ca_certificates.len()]);
    table.add_row(row!["client CA CRLs", client_ca_crls.len()]);
}

fn list_string_vec(vec: &[String]) -> String {
    let mut output = String::new();
    for item in vec.iter() {
        output.push_str(item);
        output.push('\n');
    }
    output
}

// ISO 8601
fn format_datetime(asn1_time: ASN1Time) -> Result<String, DisplayError> {
    let datetime = asn1_time.to_datetime();

    let formatted = datetime
        .format(&format_description::well_known::Iso8601::DEFAULT)
        .map_err(|_| DisplayError::DateTime)?;
    Ok(formatted)
}

/// Creates an empty table of the form
/// ```text
/// ┌────────────┬─────────────┬───────────┬────────┐
/// │            │ header      │ header    │ header │
/// ├────────────┼─────────────┼───────────┼────────┤
/// │ cluster_id │             │           │        │
/// ├────────────┼─────────────┼───────────┼────────┤
/// │ cluster_id │             │           │        │
/// ├────────────┼─────────────┼───────────┼────────┤
/// │ cluster_id │             │           │        │
/// └────────────┴─────────────┴───────────┴────────┘
/// ```
fn create_cluster_table(headers: Vec<&str>, data: &BTreeMap<String, ResponseContent>) -> Table {
    let mut table = Table::new();
    table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
    let mut row_header: Vec<_> = headers.iter().map(|h| cell!(h)).collect();
    for ref key in data.keys() {
        row_header.push(cell!(&key));
    }
    table.add_row(Row::new(row_header));
    table
}

impl Display for SocketAddress {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        write!(f, "{}", SocketAddr::from(*self))
    }
}

impl Display for ProtobufEndpoint {
    fn fmt(&self, f: &mut Formatter) -> fmt::Result {
        match &self.inner {
            Some(protobuf_endpoint::Inner::Http(HttpEndpoint {
                method,
                authority,
                path,
                status,
                ..
            })) => write!(
                f,
                "{} {} {} -> {}",
                authority.as_string_or("-"),
                method.as_string_or("-"),
                path.as_string_or("-"),
                status.as_string_or("-"),
            ),
            Some(protobuf_endpoint::Inner::Tcp(_)) => {
                write!(f, "-")
            }
            None => Ok(()),
        }
    }
}

impl Display for HttpListenerConfig {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        table.add_row(row!["socket address", format!("{:?}", self.address)]);
        table.add_row(row!["interface", self.interface.as_deref().unwrap_or("-")]);
        table.add_row(row!["public address", format!("{:?}", self.public_address),]);
        for http_answer_row in CustomHttpAnswers::to_rows(&self.http_answers) {
            table.add_row(http_answer_row);
        }
        table.add_row(row!["expect proxy", self.expect_proxy]);
        table.add_row(row!["sticky name", self.sticky_name]);
        table.add_row(row!["front timeout", self.front_timeout]);
        table.add_row(row!["back timeout", self.back_timeout]);
        table.add_row(row!["connect timeout", self.connect_timeout]);
        table.add_row(row!["request timeout", self.request_timeout]);
        table.add_row(row!["activated", self.active]);
        add_h2_flood_rows(
            &mut table,
            &self.h2_max_rst_stream_per_window,
            &self.h2_max_ping_per_window,
            &self.h2_max_settings_per_window,
            &self.h2_max_empty_data_per_window,
            &self.h2_max_window_update_stream0_per_window,
            &self.h2_max_continuation_frames,
            &self.h2_max_glitch_count,
            &self.h2_max_rst_stream_lifetime,
            &self.h2_max_rst_stream_abusive_lifetime,
            &self.h2_max_rst_stream_emitted_lifetime,
            &self.h2_max_header_list_size,
            &self.h2_max_header_table_size,
            &self.h2_max_header_fields,
            &self.h2_stream_refusal_percent,
        );
        add_h2_connection_rows(
            &mut table,
            &self.h2_initial_connection_window,
            &self.h2_max_concurrent_streams,
            &self.h2_stream_shrink_ratio,
        );
        if let Some(v) = &self.h2_stream_idle_timeout_seconds {
            table.add_row(row!["h2 stream idle timeout (seconds)", v]);
        }
        if let Some(v) = &self.h2_graceful_shutdown_deadline_seconds {
            table.add_row(row!["h2 graceful shutdown deadline (seconds)", v]);
        }
        if let Some(v) = &self.sozu_id_header {
            table.add_row(row!["Sozu-Id correlation header name", v]);
        }
        if let Some(v) = self.elide_x_real_ip {
            table.add_row(row!["elide X-Real-IP (anti-spoof)", v]);
        }
        if let Some(v) = self.send_x_real_ip {
            table.add_row(row!["send X-Real-IP (peer IP)", v]);
        }
        if let Some(v) = self.forwarded_headers {
            table.add_row(row!["forwarded headers", forwarded_headers_label(v)]);
        }
        if let Some(v) = self.h2c_prior_knowledge {
            table.add_row(row!["h2c prior knowledge", v]);
        }
        write!(f, "{table}")
    }
}

impl Display for HttpsListenerConfig {
    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
        let mut table = Table::new();
        table.set_format(*prettytable::format::consts::FORMAT_BOX_CHARS);
        let mut tls_versions = String::new();
        for tls_version in self.versions.iter() {
            tls_versions.push_str(&format!("{tls_version:?}\n"));
        }

        table.add_row(row!["socket address", format!("{:?}", self.address)]);
        table.add_row(row!["interface", self.interface.as_deref().unwrap_or("-")]);
        table.add_row(row!["public address", format!("{:?}", self.public_address)]);
        for http_answer_row in CustomHttpAnswers::to_rows(&self.http_answers) {
            table.add_row(http_answer_row);
        }
        table.add_row(row!["versions", tls_versions]);
        table.add_row(row!["cipher list", list_string_vec(&self.cipher_list),]);
        table.add_row(row!["cipher suites", list_string_vec(&self.cipher_suites),]);
        table.add_row(row![
            "signature algorithms",
            list_string_vec(&self.signature_algorithms),
        ]);
        table.add_row(row!["groups list", list_string_vec(&self.groups_list),]);
        table.add_row(row![
            "alpn protocols",
            list_string_vec(&self.alpn_protocols),
        ]);
        table.add_row(row!["key", format!("{:?}", self.key),]);
        table.add_row(row!["expect proxy", self.expect_proxy]);
        table.add_row(row!["sticky name", self.sticky_name]);
        table.add_row(row!["front timeout", self.front_timeout]);
        table.add_row(row!["back timeout", self.back_timeout]);
        table.add_row(row!["connect timeout", self.connect_timeout]);
        table.add_row(row!["request timeout", self.request_timeout]);
        table.add_row(row!["activated", self.active]);
        add_h2_flood_rows(
            &mut table,
            &self.h2_max_rst_stream_per_window,
            &self.h2_max_ping_per_window,
            &self.h2_max_settings_per_window,
            &self.h2_max_empty_data_per_window,
            &self.h2_max_window_update_stream0_per_window,
            &self.h2_max_continuation_frames,
            &self.h2_max_glitch_count,
            &self.h2_max_rst_stream_lifetime,
            &self.h2_max_rst_stream_abusive_lifetime,
            &self.h2_max_rst_stream_emitted_lifetime,
            &self.h2_max_header_list_size,
            &self.h2_max_header_table_size,
            &self.h2_max_header_fields,
            &self.h2_stream_refusal_percent,
        );
        add_h2_connection_rows(
            &mut table,
            &self.h2_initial_connection_window,
            &self.h2_max_concurrent_streams,
            &self.h2_stream_shrink_ratio,
        );
        if let Some(v) = self.strict_sni_binding {
            table.add_row(row!["strict sni binding", v]);
        }
        if let Some(v) = self.disable_http11 {
            table.add_row(row!["disable http/1.1", v]);
        }
        if let Some(v) = &self.h2_stream_idle_timeout_seconds {
            table.add_row(row!["h2 stream idle timeout (seconds)", v]);
        }
        if let Some(v) = &self.h2_graceful_shutdown_deadline_seconds {
            table.add_row(row!["h2 graceful shutdown deadline (seconds)", v]);
        }
        if let Some(v) = &self.sozu_id_header {
            table.add_row(row!["Sozu-Id correlation header name", v]);
        }
        if let Some(v) = self.elide_x_real_ip {
            table.add_row(row!["elide X-Real-IP (anti-spoof)", v]);
        }
        if let Some(v) = self.send_x_real_ip {
            table.add_row(row!["send X-Real-IP (peer IP)", v]);
        }
        if let Some(v) = self.forwarded_headers {
            table.add_row(row!["forwarded headers", forwarded_headers_label(v)]);
        }
        if self.client_auth.is_some()
            || !self.client_ca_certificates.is_empty()
            || !self.client_ca_crls.is_empty()
        {
            add_client_auth_rows(
                &mut table,
                &self.client_auth,
                &self.client_ca_certificates,
                &self.client_ca_crls,
            );
        }
        write!(f, "{table}")
    }
}

/// The TOML spelling of a `forwarded_headers` wire value, or the raw number
/// when it names no [`ForwardedHeaders`] variant.
pub fn forwarded_headers_label(value: i32) -> String {
    match ForwardedHeaders::try_from(value) {
        Ok(ForwardedHeaders::Both) => "both".to_owned(),
        Ok(ForwardedHeaders::XForwarded) => "x_forwarded".to_owned(),
        Ok(ForwardedHeaders::Rfc7239) => "rfc7239".to_owned(),
        Ok(ForwardedHeaders::None) => "none".to_owned(),
        Err(_) => format!("unknown ({value})"),
    }
}

/// Add H2 flood detection threshold rows to a display table.
/// Only shows rows for values that have been explicitly configured.
#[allow(clippy::too_many_arguments)]
fn add_h2_flood_rows(
    table: &mut Table,
    max_rst_stream: &Option<u32>,
    max_ping: &Option<u32>,
    max_settings: &Option<u32>,
    max_empty_data: &Option<u32>,
    max_window_update_stream0: &Option<u32>,
    max_continuation: &Option<u32>,
    max_glitch: &Option<u32>,
    max_rst_stream_lifetime: &Option<u64>,
    max_rst_stream_abusive_lifetime: &Option<u64>,
    max_rst_stream_emitted_lifetime: &Option<u64>,
    max_header_list_size: &Option<u32>,
    max_header_table_size: &Option<u32>,
    max_header_fields: &Option<u32>,
    stream_refusal_percent: &Option<u32>,
) {
    if let Some(v) = max_rst_stream {
        table.add_row(row!["h2 max rst_stream/window", v]);
    }
    if let Some(v) = max_ping {
        table.add_row(row!["h2 max ping/window", v]);
    }
    if let Some(v) = max_settings {
        table.add_row(row!["h2 max settings/window", v]);
    }
    if let Some(v) = max_empty_data {
        table.add_row(row!["h2 max empty_data/window", v]);
    }
    if let Some(v) = max_window_update_stream0 {
        table.add_row(row!["h2 max window_update stream0/window", v]);
    }
    if let Some(v) = max_continuation {
        table.add_row(row!["h2 max continuation frames", v]);
    }
    if let Some(v) = max_glitch {
        table.add_row(row!["h2 max glitch count", v]);
    }
    if let Some(v) = max_rst_stream_lifetime {
        table.add_row(row!["h2 max rst_stream lifetime", v]);
    }
    if let Some(v) = max_rst_stream_abusive_lifetime {
        table.add_row(row!["h2 max rst_stream abusive lifetime", v]);
    }
    if let Some(v) = max_rst_stream_emitted_lifetime {
        table.add_row(row!["h2 max rst_stream emitted lifetime", v]);
    }
    if let Some(v) = max_header_list_size {
        table.add_row(row!["h2 max header list size", v]);
    }
    if let Some(v) = max_header_table_size {
        table.add_row(row!["h2 max header table size", v]);
    }
    if let Some(v) = max_header_fields {
        table.add_row(row!["h2 max header fields", v]);
    }
    if let Some(v) = stream_refusal_percent {
        table.add_row(row!["h2 stream refusal percent", v]);
    }
}

/// Add H2 connection tuning rows to a display table.
/// Only shows rows for values that have been explicitly configured.
fn add_h2_connection_rows(
    table: &mut Table,
    window: &Option<u32>,
    max_streams: &Option<u32>,
    shrink_ratio: &Option<u32>,
) {
    if let Some(v) = window {
        table.add_row(row!["h2 initial connection window", v]);
    }
    if let Some(v) = max_streams {
        table.add_row(row!["h2 max concurrent streams", v]);
    }
    if let Some(v) = shrink_ratio {
        table.add_row(row!["h2 stream shrink ratio", v]);
    }
}

impl CustomHttpAnswers {
    fn to_rows(option: &Option<Self>) -> Vec<Row> {
        let mut rows = Vec::new();
        if let Some(answers) = option {
            if let Some(a) = &answers.answer_301 {
                rows.push(row!("301", a));
            }
            if let Some(a) = &answers.answer_400 {
                rows.push(row!("400", a));
            }
            if let Some(a) = &answers.answer_404 {
                rows.push(row!("404", a));
            }
            if let Some(a) = &answers.answer_408 {
                rows.push(row!("408", a));
            }
            if let Some(a) = &answers.answer_413 {
                rows.push(row!("413", a));
            }
            if let Some(a) = &answers.answer_421 {
                rows.push(row!("421", a));
            }
            if let Some(a) = &answers.answer_502 {
                rows.push(row!("502", a));
            }
            if let Some(a) = &answers.answer_503 {
                rows.push(row!("503", a));
            }
            if let Some(a) = &answers.answer_504 {
                rows.push(row!("504", a));
            }
            if let Some(a) = &answers.answer_507 {
                rows.push(row!("507", a));
            }
        }
        rows
    }
}

impl Display for Event {
    fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
        let kind = match self.kind() {
            EventKind::BackendDown => "backend down",
            EventKind::BackendUp => "backend up",
            EventKind::NoAvailableBackends => "no available backends",
            EventKind::RemovedBackendHasNoConnections => "removed backend has no connections",
            EventKind::ClusterAdded => "cluster added",
            EventKind::ClusterRemoved => "cluster removed",
            EventKind::FrontendAdded => "frontend added",
            EventKind::FrontendRemoved => "frontend removed",
            EventKind::CertificateAdded => "certificate added",
            EventKind::CertificateRemoved => "certificate removed",
            EventKind::CertificateReplaced => "certificate replaced",
            EventKind::ListenerActivated => "listener activated",
            EventKind::ListenerDeactivated => "listener deactivated",
            EventKind::ConfigurationReloaded => "configuration reloaded",
            EventKind::WorkerKilled => "worker killed",
            EventKind::WorkerRelaunched => "worker relaunched",
            EventKind::LoggingLevelChanged => "logging level changed",
            EventKind::MetricsConfigured => "metrics configured",
            EventKind::ListenerUpdated => "listener updated",
            EventKind::StateLoaded => "state loaded",
            EventKind::StateSaved => "state saved",
            EventKind::ListenerAdded => "listener added",
            EventKind::ListenerRemoved => "listener removed",
            EventKind::SozuStopRequested => "stop requested",
            EventKind::MainUpgraded => "main upgraded",
            EventKind::WorkerUpgraded => "worker upgraded",
            EventKind::EventsSubscribed => "events subscribed",
            EventKind::HealthCheckHealthy => "health check: backend healthy",
            EventKind::HealthCheckUnhealthy => "health check: backend unhealthy",
            EventKind::ClusterRecovered => "cluster recovered",
            EventKind::MetricDetailChanged => "metric detail changed",
        };
        let address = match &self.address {
            Some(a) => a.to_string(),
            None => String::new(),
        };
        write!(
            f,
            "{}, backend={}, cluster={}, address={}",
            kind,
            self.backend_id(),
            self.cluster_id(),
            address,
        )
    }
}

#[cfg(test)]
mod tests {
    use std::collections::BTreeMap;

    use crate::proto::command::{
        ClientAuthMode, HeaderMatchKind, HeaderPredicate, HttpsListenerConfig, PathRule,
        RequestHttpFrontend, ResponseContent, SocketAddress, WorkerResponses,
    };

    use super::{cluster_http_frontends_table, http_frontends_table};

    const CA_PEM_SENTINEL: &str = "CLIENT_CA_PEM_BODY_SENTINEL";
    const CRL_PEM_SENTINEL: &str = "CLIENT_CRL_PEM_BODY_SENTINEL";

    fn https_config(client_auth: Option<i32>, cas: &[&str], crls: &[&str]) -> HttpsListenerConfig {
        HttpsListenerConfig {
            address: SocketAddress::new_v4(127, 0, 0, 1, 8443),
            client_auth,
            client_ca_certificates: cas.iter().map(|s| s.to_string()).collect(),
            client_ca_crls: crls.iter().map(|s| s.to_string()).collect(),
            ..Default::default()
        }
    }

    #[test]
    fn listener_display_distinguishes_client_auth_modes() {
        // The regression this guards: `ListListeners` output for a listener
        // with `required` client auth used to be byte-identical to one with
        // client auth disabled, so an operator could not verify an applied
        // mTLS policy from the CLI.
        let none = format!(
            "{}",
            https_config(Some(ClientAuthMode::ClientAuthNone as i32), &[], &[])
        );
        let required = format!(
            "{}",
            https_config(
                Some(ClientAuthMode::ClientAuthRequired as i32),
                &[CA_PEM_SENTINEL],
                &[],
            )
        );

        assert!(
            none.contains(ClientAuthMode::ClientAuthNone.as_str_name()),
            "an explicit none must be visible: {none}"
        );
        // A listener with no client authentication key renders as before
        // client authentication existed.
        let unset = format!("{}", https_config(None, &[], &[]));
        assert!(
            !unset.contains("client auth"),
            "a listener without client auth keys must show no client auth row: {unset}"
        );
        assert!(
            required.contains(ClientAuthMode::ClientAuthRequired.as_str_name()),
            "required client auth must be visible: {required}"
        );
        assert_ne!(
            none, required,
            "listeners with and without client auth must not render identically"
        );
    }

    #[test]
    fn listener_display_summarises_ca_and_crl_without_rendering_pem() {
        // CA and CRL entries are PEM bodies: counts are operator-useful,
        // contents are not, and dumping them into a terminal table would be a
        // regression against the redaction applied elsewhere.
        let output = format!(
            "{}",
            https_config(
                Some(ClientAuthMode::ClientAuthOptional as i32),
                &[CA_PEM_SENTINEL, CA_PEM_SENTINEL],
                &[CRL_PEM_SENTINEL],
            )
        );

        assert!(
            !output.contains(CA_PEM_SENTINEL),
            "listener display leaked a client CA PEM body: {output}"
        );
        assert!(
            !output.contains(CRL_PEM_SENTINEL),
            "listener display leaked a client CRL PEM body: {output}"
        );
        assert!(
            output.contains("client CA certificates"),
            "missing client CA count row: {output}"
        );
        assert!(
            output.contains("client CA CRLs"),
            "missing client CRL count row: {output}"
        );
    }

    #[test]
    fn listener_display_does_not_fold_an_unknown_mode_to_none() {
        // A value the master does not recognise must stand out rather than
        // masquerade as the unauthenticated default.
        let output = format!("{}", https_config(Some(999), &[], &[]));

        assert!(
            output.contains("UNKNOWN"),
            "an unknown client_auth value must render as unknown: {output}"
        );
        assert!(
            !output.contains(ClientAuthMode::ClientAuthNone.as_str_name()),
            "an unknown client_auth value must not render as none: {output}"
        );
    }

    /// A guarded frontend must be distinguishable in both listing surfaces
    /// (`ListFrontends`, `ListClusters`) by its predicate count, without the
    /// predicate names or values being rendered.
    #[test]
    fn frontend_listings_show_header_predicate_count_only() {
        const NAME_SENTINEL: &str = "X-NAME-SENTINEL";
        const VALUE_SENTINEL: &str = "VALUE_SENTINEL";

        let guarded = RequestHttpFrontend {
            cluster_id: Some("canary".to_owned()),
            address: SocketAddress::new_v4(127, 0, 0, 1, 8080),
            hostname: "api.example.com".to_owned(),
            path: PathRule::prefix("/".to_owned()),
            header_predicates: vec![
                HeaderPredicate {
                    name: NAME_SENTINEL.to_owned(),
                    kind: HeaderMatchKind::Exact as i32,
                    value: Some(VALUE_SENTINEL.to_owned()),
                },
                HeaderPredicate {
                    name: "x-other".to_owned(),
                    kind: HeaderMatchKind::Present as i32,
                    value: None,
                },
                HeaderPredicate {
                    name: "x-third".to_owned(),
                    kind: HeaderMatchKind::Present as i32,
                    value: None,
                },
            ],
            ..Default::default()
        };

        let listed =
            http_frontends_table("HTTP frontends ", std::slice::from_ref(&guarded)).to_string();
        assert!(listed.contains("header_predicates"), "{listed}");
        assert!(
            listed.contains("│ 3 "),
            "the predicate count must be listed:\n{listed}"
        );

        let mut worker_responses = WorkerResponses::default();
        worker_responses
            .map
            .insert("0".to_owned(), ResponseContent::default());
        let mut frontends = BTreeMap::new();
        frontends.insert(&guarded, vec!["0".to_owned()]);
        let clusters = cluster_http_frontends_table(&frontends, &worker_responses).to_string();
        assert!(clusters.contains("header_predicates"), "{clusters}");
        assert!(
            clusters.contains("│ 3 "),
            "the predicate count must be listed:\n{clusters}"
        );

        for rendered in [&listed, &clusters] {
            assert!(!rendered.contains(NAME_SENTINEL), "{rendered}");
            assert!(!rendered.contains(VALUE_SENTINEL), "{rendered}");
            assert!(!rendered.to_lowercase().contains("x-other"), "{rendered}");
        }
    }
}