#![cfg_attr(not(test), allow(dead_code))]use crate::config::NetworkProxyConfig;use crate::policy::normalize_host;use anyhow::Context as _;use anyhow::Result;use anyhow::anyhow;use codex_utils_absolute_path::AbsolutePathBuf;use globset::GlobBuilder;use globset::GlobMatcher;use rama_http::HeaderValue;use rama_http::Request;use rama_http::header::HeaderName;use serde::Deserialize;use serde::Serialize;use std::collections::BTreeMap;use std::env;use std::fs;use std::path::Path;use url::form_urlencoded;const PATTERN_PREFIX: &str = "pattern:";const LITERAL_PREFIX: &str = "literal:";#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq)]#[serde(default)]pub struct MitmHookConfig {    pub host: String,    #[serde(rename = "match", default)]    pub matcher: MitmHookMatchConfig,    #[serde(default)]    pub actions: MitmHookActionsConfig,}#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq)]#[serde(default)]pub struct MitmHookMatchConfig {    pub methods: Vec<String>,    pub path_prefixes: Vec<String>,    pub query: BTreeMap<String, Vec<String>>,    pub headers: BTreeMap<String, Vec<String>>,    pub body: Option<MitmHookBodyConfig>,}#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq)]#[serde(default)]pub struct MitmHookActionsConfig {    pub strip_request_headers: Vec<String>,    pub inject_request_headers: Vec<InjectedHeaderConfig>,}#[derive(Debug, Clone, Serialize, Deserialize, Default, PartialEq, Eq)]#[serde(default)]pub struct InjectedHeaderConfig {    pub name: String,    pub secret_env_var: Option<String>,    pub secret_file: Option<String>,    pub prefix: Option<String>,}#[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]#[serde(transparent)]pub struct MitmHookBodyConfig(pub serde_json::Value);#[derive(Debug, Clone, PartialEq, Eq)]pub struct MitmHook {    pub host: String,    pub matcher: MitmHookMatcher,    pub actions: MitmHookActions,}#[derive(Debug, Clone, PartialEq, Eq)]pub struct MitmHookMatcher {    pub methods: Vec<String>,    pub path_prefixes: Vec<PathMatcher>,    pub query: Vec<QueryConstraint>,    pub headers: Vec<HeaderConstraint>,    pub body: Option<MitmHookBodyMatcher>,}#[derive(Debug, Clone, PartialEq, Eq)]pub struct QueryConstraint {    pub name: String,    pub allowed_values: Vec<ValueMatcher>,}#[derive(Debug, Clone, PartialEq, Eq)]pub struct HeaderConstraint {    pub name: HeaderName,    pub allowed_values: Vec<ValueMatcher>,}#[derive(Debug, Clone, PartialEq, Eq)]pub struct MitmHookActions {    pub strip_request_headers: Vec<HeaderName>,    pub inject_request_headers: Vec<ResolvedInjectedHeader>,}#[derive(Debug, Clone, PartialEq, Eq)]pub struct ResolvedInjectedHeader {    pub name: HeaderName,    pub value: HeaderValue,    pub source: SecretSource,}#[derive(Debug, Clone, PartialEq, Eq)]pub enum SecretSource {    EnvVar(String),    File(AbsolutePathBuf),}#[derive(Debug, Clone, PartialEq, Eq)]pub struct MitmHookBodyMatcher {    pub raw: serde_json::Value,}#[derive(Debug, Clone, PartialEq, Eq)]pub enum PathMatcher {    Prefix(String),    Glob(CompiledGlobMatcher),}#[derive(Debug, Clone, PartialEq, Eq)]pub enum ValueMatcher {    Exact(String),    Glob(CompiledGlobMatcher),}enum MatcherPattern<'a> {    Literal(&'a str),    Glob(&'a str),}#[derive(Clone)]pub struct CompiledGlobMatcher {    pattern: String,    matcher: GlobMatcher,}impl std::fmt::Debug for CompiledGlobMatcher {    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {        f.debug_struct("CompiledGlobMatcher")            .field("pattern", &self.pattern)            .finish()    }}impl PartialEq for CompiledGlobMatcher {    fn eq(&self, other: &Self) -> bool {        self.pattern == other.pattern    }}impl Eq for CompiledGlobMatcher {}impl CompiledGlobMatcher {    fn is_match(&self, candidate: &str) -> bool {        self.matcher.is_match(candidate)    }}pub type MitmHooksByHost = BTreeMap<String, Vec<MitmHook>>;#[derive(Debug, Clone, PartialEq, Eq)]pub enum HookEvaluation {    NoHooksForHost,    Matched { actions: MitmHookActions },    HookedHostNoMatch,}pub(crate) fn validate_mitm_hook_config(config: &NetworkProxyConfig) -> Result<()> {    let hooks = &config.network.mitm_hooks;    if hooks.is_empty() {        return Ok(());    }    if !config.network.mitm {        return Err(anyhow!("network.mitm_hooks requires network.mitm = true"));    }    for (hook_index, hook) in hooks.iter().enumerate() {        let host = normalize_hook_host(&hook.host)            .with_context(|| format!("invalid network.mitm_hooks[{hook_index}].host"))?;        let methods = normalize_methods(&hook.matcher.methods)            .with_context(|| format!("invalid network.mitm_hooks[{hook_index}].match.methods"))?;        if methods.is_empty() {            return Err(anyhow!(                "network.mitm_hooks[{hook_index}].match.methods must not be empty"            ));        }        let path_prefixes =            compile_path_matchers(&hook.matcher.path_prefixes).with_context(|| {                format!("invalid network.mitm_hooks[{hook_index}].match.path_prefixes")            })?;        if path_prefixes.is_empty() {            return Err(anyhow!(                "network.mitm_hooks[{hook_index}].match.path_prefixes must not be empty"            ));        }        if let Some(body) = hook.matcher.body.as_ref() {            let _ = body;            return Err(anyhow!(                "network.mitm_hooks[{hook_index}].match.body is reserved for a future release and is not yet supported"            ));        }        validate_query_constraints(&hook.matcher.query)            .with_context(|| format!("invalid network.mitm_hooks[{hook_index}].match.query"))?;        validate_header_constraints(&hook.matcher.headers)            .with_context(|| format!("invalid network.mitm_hooks[{hook_index}].match.headers"))?;        validate_strip_request_headers(&hook.actions.strip_request_headers).with_context(|| {            format!("invalid network.mitm_hooks[{hook_index}].actions.strip_request_headers")        })?;        validate_injected_headers(&hook.actions.inject_request_headers).with_context(|| {            format!("invalid network.mitm_hooks[{hook_index}].actions.inject_request_headers")        })?;        if host.is_empty() {            return Err(anyhow!(                "network.mitm_hooks[{hook_index}].host must not be empty"            ));        }    }    Ok(())}pub(crate) fn compile_mitm_hooks(config: &NetworkProxyConfig) -> Result<MitmHooksByHost> {    compile_mitm_hooks_with_resolvers(        config,        |name| env::var(name).ok(),        |path| {            let value = fs::read_to_string(path.as_path()).with_context(|| {                format!("failed to read secret file {}", path.as_path().display())            })?;            Ok(value.trim().to_string())        },    )}pub(crate) fn evaluate_mitm_hooks(    hooks_by_host: &MitmHooksByHost,    host: &str,    req: &Request,) -> HookEvaluation {    let normalized_host = normalize_host(host);    let Some(hooks) = hooks_by_host.get(&normalized_host) else {        return HookEvaluation::NoHooksForHost;    };    for hook in hooks {        if hook_matches(hook, req) {            return HookEvaluation::Matched {                actions: hook.actions.clone(),            };        }    }    HookEvaluation::HookedHostNoMatch}fn compile_mitm_hooks_with_resolvers<EnvFn, FileFn>(    config: &NetworkProxyConfig,    resolve_env_var: EnvFn,    read_secret_file: FileFn,) -> Result<MitmHooksByHost>where    EnvFn: Fn(&str) -> Option<String>,    FileFn: Fn(&AbsolutePathBuf) -> Result<String>,{    validate_mitm_hook_config(config)?;    let mut hooks_by_host = MitmHooksByHost::new();    for hook in &config.network.mitm_hooks {        let host = normalize_hook_host(&hook.host)?;        let methods = normalize_methods(&hook.matcher.methods)?;        let path_prefixes = compile_path_matchers(&hook.matcher.path_prefixes)?;        let query = hook            .matcher            .query            .iter()            .map(|(name, values)| {                Ok(QueryConstraint {                    name: normalize_query_name(name)?,                    allowed_values: compile_value_matchers(values)?,                })            })            .collect::<Result<Vec<_>>>()?;        let headers = hook            .matcher            .headers            .iter()            .map(|(name, values)| {                Ok(HeaderConstraint {                    name: parse_header_name(name)?,                    allowed_values: compile_value_matchers(values)?,                })            })            .collect::<Result<Vec<_>>>()?;        let strip_request_headers = hook            .actions            .strip_request_headers            .iter()            .map(|name| parse_header_name(name))            .collect::<Result<Vec<_>>>()?;        let inject_request_headers = hook            .actions            .inject_request_headers            .iter()            .map(|header| {                compile_injected_header(header, &resolve_env_var, &read_secret_file)                    .with_context(|| format!("failed to compile injected header {}", header.name))            })            .collect::<Result<Vec<_>>>()?;        hooks_by_host            .entry(host.clone())            .or_default()            .push(MitmHook {                host,                matcher: MitmHookMatcher {                    methods,                    path_prefixes,                    query,                    headers,                    body: None,                },                actions: MitmHookActions {                    strip_request_headers,                    inject_request_headers,                },            });    }    Ok(hooks_by_host)}fn compile_injected_header<EnvFn, FileFn>(    header: &InjectedHeaderConfig,    resolve_env_var: &EnvFn,    read_secret_file: &FileFn,) -> Result<ResolvedInjectedHeader>where    EnvFn: Fn(&str) -> Option<String>,    FileFn: Fn(&AbsolutePathBuf) -> Result<String>,{    let name = parse_header_name(&header.name)?;    let (secret, source) = match (        header.secret_env_var.as_deref(),        header.secret_file.as_deref(),    ) {        (Some(env_var), None) => {            let value = resolve_env_var(env_var)                .ok_or_else(|| anyhow!("missing required environment variable {env_var}"))?;            (value, SecretSource::EnvVar(env_var.to_string()))        }        (None, Some(secret_file)) => {            let path = parse_secret_file(secret_file)?;            let value = read_secret_file(&path)?;            (value, SecretSource::File(path))        }        _ => {            return Err(anyhow!(                "expected exactly one of secret_env_var or secret_file"            ));        }    };    let prefix = header.prefix.clone().unwrap_or_default();    let value = HeaderValue::from_str(&format!("{prefix}{secret}"))        .with_context(|| format!("invalid value for injected header {}", header.name))?;    Ok(ResolvedInjectedHeader {        name,        value,        source,    })}fn hook_matches(hook: &MitmHook, req: &Request) -> bool {    let method = req.method().as_str().to_ascii_uppercase();    if !hook        .matcher        .methods        .iter()        .any(|allowed| allowed == &method)    {        return false;    }    let path = req.uri().path();    if !path_matches(&hook.matcher.path_prefixes, path) {        return false;    }    if !query_matches(&hook.matcher.query, req) {        return false;    }    headers_match(&hook.matcher.headers, req)}fn query_matches(query_constraints: &[QueryConstraint], req: &Request) -> bool {    if query_constraints.is_empty() {        return true;    }    let actual_query = req.uri().query().unwrap_or_default();    let mut actual_values: BTreeMap<String, Vec<String>> = BTreeMap::new();    for (name, value) in form_urlencoded::parse(actual_query.as_bytes()) {        actual_values            .entry(name.into_owned())            .or_default()            .push(value.into_owned());    }    query_constraints.iter().all(|constraint| {        actual_values.get(&constraint.name).is_some_and(|actual| {            actual.iter().any(|candidate| {                constraint                    .allowed_values                    .iter()                    .any(|allowed| allowed.matches(candidate))            })        })    })}fn headers_match(header_constraints: &[HeaderConstraint], req: &Request) -> bool {    header_constraints.iter().all(|constraint| {        let actual = req.headers().get_all(&constraint.name);        if actual.iter().next().is_none() {            return false;        }        if constraint.allowed_values.is_empty() {            return true;        }        actual.iter().any(|value| {            value.to_str().ok().is_some_and(|candidate| {                constraint                    .allowed_values                    .iter()                    .any(|allowed| allowed.matches(candidate))            })        })    })}fn path_matches(path_prefixes: &[PathMatcher], path: &str) -> bool {    path_prefixes.iter().any(|matcher| matcher.matches(path))}impl PathMatcher {    fn matches(&self, candidate: &str) -> bool {        match self {            Self::Prefix(prefix) => candidate.starts_with(prefix),            Self::Glob(glob) => glob.is_match(candidate),        }    }}impl ValueMatcher {    fn matches(&self, candidate: &str) -> bool {        match self {            Self::Exact(value) => value == candidate,            Self::Glob(glob) => glob.is_match(candidate),        }    }}fn compile_path_matchers(path_prefixes: &[String]) -> Result<Vec<PathMatcher>> {    path_prefixes        .iter()        .map(|prefix| {            match parse_matcher_pattern(prefix)? {                MatcherPattern::Literal(prefix) => {                    if prefix.is_empty() {                        return Err(anyhow!("path_prefixes must not contain empty entries"));                    }                    Ok(PathMatcher::Prefix(prefix.to_string()))                }                MatcherPattern::Glob(glob_pattern) => Ok(PathMatcher::Glob(compile_glob_matcher(                    glob_pattern,                    /*literal_separator*/ true,                )?)),            }        })        .collect()}fn compile_value_matchers(values: &[String]) -> Result<Vec<ValueMatcher>> {    values        .iter()        .map(|value| match parse_matcher_pattern(value)? {            MatcherPattern::Literal(value) => Ok(ValueMatcher::Exact(value.to_string())),            MatcherPattern::Glob(glob_pattern) => Ok(ValueMatcher::Glob(compile_glob_matcher(                glob_pattern,                /*literal_separator*/ false,            )?)),        })        .collect()}fn parse_matcher_pattern(pattern: &str) -> Result<MatcherPattern<'_>> {    if let Some(literal) = pattern.strip_prefix(LITERAL_PREFIX) {        return Ok(MatcherPattern::Literal(literal));    }    let Some(glob_pattern) = pattern.strip_prefix(PATTERN_PREFIX) else {        return Ok(MatcherPattern::Literal(pattern));    };    if glob_pattern.is_empty() {        return Err(anyhow!("glob pattern must not be empty"));    }    Ok(MatcherPattern::Glob(glob_pattern))}fn compile_glob_matcher(pattern: &str, literal_separator: bool) -> Result<CompiledGlobMatcher> {    let mut builder = GlobBuilder::new(pattern);    builder        .backslash_escape(true)        .literal_separator(literal_separator);    builder        .build()        .map(|glob| CompiledGlobMatcher {            pattern: pattern.to_string(),            matcher: glob.compile_matcher(),        })        .map_err(|err| anyhow!("invalid glob pattern {pattern:?}: {err}"))}fn normalize_hook_host(host: &str) -> Result<String> {    let normalized = normalize_host(host);    if normalized.is_empty() {        return Err(anyhow!("host must not be empty"));    }    if normalized.contains('*') {        return Err(anyhow!(            "MITM hook hosts must be exact hosts and cannot contain wildcards"        ));    }    Ok(normalized)}fn normalize_methods(methods: &[String]) -> Result<Vec<String>> {    methods        .iter()        .map(|method| {            let normalized = method.trim().to_ascii_uppercase();            if normalized.is_empty() {                return Err(anyhow!("methods must not contain empty entries"));            }            Ok(normalized)        })        .collect()}fn validate_query_constraints(query: &BTreeMap<String, Vec<String>>) -> Result<()> {    for (name, values) in query {        let normalized = normalize_query_name(name)?;        if normalized.is_empty() {            return Err(anyhow!("query keys must not be empty"));        }        if values.is_empty() {            return Err(anyhow!(                "query key {name:?} must list at least one allowed value"            ));        }        let _ = compile_value_matchers(values)            .with_context(|| format!("invalid matcher for query key {name:?}"))?;    }    Ok(())}fn normalize_query_name(name: &str) -> Result<String> {    if name.is_empty() {        return Err(anyhow!("query keys must not be empty"));    }    Ok(name.to_string())}fn validate_header_constraints(headers: &BTreeMap<String, Vec<String>>) -> Result<()> {    for (name, values) in headers {        let _ = parse_header_name(name)?;        let _ = compile_value_matchers(values)            .with_context(|| format!("invalid matcher for header {name:?}"))?;    }    Ok(())}fn validate_strip_request_headers(header_names: &[String]) -> Result<()> {    for name in header_names {        let _ = parse_header_name(name)?;    }    Ok(())}fn validate_injected_headers(headers: &[InjectedHeaderConfig]) -> Result<()> {    for header in headers {        let _ = parse_header_name(&header.name)?;        match (            header.secret_env_var.as_deref(),            header.secret_file.as_deref(),        ) {            (Some(secret_env_var), None) => {                if secret_env_var.trim().is_empty() {                    return Err(anyhow!("secret_env_var must not be empty"));                }            }            (None, Some(secret_file)) => {                let _ = parse_secret_file(secret_file)?;            }            _ => {                return Err(anyhow!(                    "expected exactly one of secret_env_var or secret_file"                ));            }        }    }    Ok(())}fn parse_header_name(name: &str) -> Result<HeaderName> {    HeaderName::from_bytes(name.as_bytes())        .map_err(|err| anyhow!("invalid header name {name:?}: {err}"))}fn parse_secret_file(path: &str) -> Result<AbsolutePathBuf> {    if path.trim().is_empty() {        return Err(anyhow!("secret_file must not be empty"));    }    let path = Path::new(path);    if !path.is_absolute() {        return Err(anyhow!("secret_file must be an absolute path: {path:?}"));    }    AbsolutePathBuf::from_absolute_path(path)        .with_context(|| format!("secret_file must be an absolute path: {path:?}"))}#[cfg(test)]mod tests {    use super::*;    use crate::NetworkMode;    use crate::config::NetworkProxySettings;    use pretty_assertions::assert_eq;    use rama_http::Body;    use rama_http::Method;    use tempfile::NamedTempFile;    fn base_config() -> NetworkProxyConfig {        NetworkProxyConfig {            network: NetworkProxySettings {                mitm: true,                mode: NetworkMode::Limited,                ..NetworkProxySettings::default()            },        }    }    fn github_hook() -> MitmHookConfig {        MitmHookConfig {            host: "api.github.com".to_string(),            matcher: MitmHookMatchConfig {                methods: vec!["POST".to_string(), "PUT".to_string()],                path_prefixes: vec!["/repos/openai/".to_string()],                ..MitmHookMatchConfig::default()            },            actions: MitmHookActionsConfig {                strip_request_headers: vec!["authorization".to_string()],                inject_request_headers: vec![InjectedHeaderConfig {                    name: "authorization".to_string(),                    secret_env_var: Some("CODEX_GITHUB_TOKEN".to_string()),                    secret_file: None,                    prefix: Some("Bearer ".to_string()),                }],            },        }    }    #[test]    fn validate_requires_mitm_for_hooks() {        let mut config = base_config();        config.network.mitm = false;        config.network.mitm_hooks = vec![github_hook()];        let err = validate_mitm_hook_config(&config).expect_err("hooks require mitm");        assert!(            err.to_string()                .contains("network.mitm_hooks requires network.mitm = true")        );    }    #[test]    fn validate_allows_hooks_in_full_mode() {        let mut config = base_config();        config.network.mode = NetworkMode::Full;        config.network.mitm_hooks = vec![github_hook()];        validate_mitm_hook_config(&config).expect("hooks should be allowed in full mode");    }    #[test]    fn validate_rejects_body_matchers_for_now() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.body = Some(MitmHookBodyConfig(serde_json::json!({            "repository": "openai/codex"        })));        config.network.mitm_hooks = vec![hook];        let err = validate_mitm_hook_config(&config).expect_err("body matchers are reserved");        assert!(err.to_string().contains("match.body is reserved"));    }    #[test]    fn validate_rejects_relative_secret_file() {        let mut config = base_config();        let mut hook = github_hook();        hook.actions.inject_request_headers[0].secret_env_var = None;        hook.actions.inject_request_headers[0].secret_file = Some("token.txt".to_string());        config.network.mitm_hooks = vec![hook];        let err = validate_mitm_hook_config(&config).expect_err("secret file must be absolute");        assert!(format!("{err:#}").contains("secret_file must be an absolute path"));    }    #[test]    fn validate_rejects_dual_secret_sources() {        let mut config = base_config();        let mut hook = github_hook();        hook.actions.inject_request_headers[0].secret_file = Some("/tmp/github-token".to_string());        config.network.mitm_hooks = vec![hook];        let err = validate_mitm_hook_config(&config).expect_err("dual secret sources invalid");        assert!(format!("{err:#}").contains("exactly one of secret_env_var or secret_file"));    }    #[test]    fn compile_resolves_env_backed_injected_headers() {        let mut config = base_config();        config.network.mitm_hooks = vec![github_hook()];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |name| (name == "CODEX_GITHUB_TOKEN").then(|| "ghp-secret".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let compiled = hooks.get("api.github.com").unwrap();        assert_eq!(compiled.len(), 1);        assert_eq!(            compiled[0].actions.inject_request_headers[0].source,            SecretSource::EnvVar("CODEX_GITHUB_TOKEN".to_string())        );        assert_eq!(            compiled[0].actions.inject_request_headers[0].value,            HeaderValue::from_static("Bearer ghp-secret")        );    }    #[test]    fn compile_resolves_file_backed_injected_headers() {        let secret_file = NamedTempFile::new().unwrap();        std::fs::write(secret_file.path(), "ghp-file-secret\n").unwrap();        let mut config = base_config();        let mut hook = github_hook();        hook.actions.inject_request_headers[0].secret_env_var = None;        hook.actions.inject_request_headers[0].secret_file =            Some(secret_file.path().display().to_string());        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks(&config).unwrap();        let compiled = hooks.get("api.github.com").unwrap();        assert_eq!(            compiled[0].actions.inject_request_headers[0].value,            HeaderValue::from_static("Bearer ghp-file-secret")        );    }    #[test]    fn evaluate_returns_first_matching_hook() {        let mut config = base_config();        let mut first = github_hook();        first.matcher.path_prefixes = vec!["/repos/openai/".to_string()];        let mut second = github_hook();        second.actions.inject_request_headers[0].prefix = Some("Token ".to_string());        config.network.mitm_hooks = vec![first, second];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues")            .header("x-trace", "1")            .body(Body::empty())            .unwrap();        let evaluation = evaluate_mitm_hooks(&hooks, "api.github.com", &req);        let HookEvaluation::Matched { actions } = evaluation else {            panic!("expected a matching hook");        };        assert_eq!(            actions.inject_request_headers[0].value,            HeaderValue::from_static("Bearer abc")        );    }    #[test]    fn evaluate_matches_query_and_header_constraints() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.query = BTreeMap::from([(            "state".to_string(),            vec!["open".to_string(), "triage".to_string()],        )]);        hook.matcher.headers = BTreeMap::from([(            "x-github-api-version".to_string(),            vec!["2022-11-28".to_string()],        )]);        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues?state=open&per_page=10")            .header("x-github-api-version", "2022-11-28")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &req),            HookEvaluation::Matched {                actions: hooks.get("api.github.com").unwrap()[0].actions.clone(),            }        );    }    #[test]    fn evaluate_matches_wildcard_path_query_and_header_constraints() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.path_prefixes = vec!["pattern:/repos/*/codex/issues*".to_string()];        hook.matcher.query =            BTreeMap::from([("state".to_string(), vec!["pattern:op*".to_string()])]);        hook.matcher.headers = BTreeMap::from([(            "x-github-api-version".to_string(),            vec!["pattern:2022*preview".to_string()],        )]);        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues?state=open")            .header("x-github-api-version", "2022-11-28-preview")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &req),            HookEvaluation::Matched {                actions: hooks.get("api.github.com").unwrap()[0].actions.clone(),            }        );    }    #[test]    fn validate_rejects_invalid_wildcard_path_pattern() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.path_prefixes = vec!["pattern:/repos/[".to_string()];        config.network.mitm_hooks = vec![hook];        let err = validate_mitm_hook_config(&config).expect_err("invalid glob should fail");        assert!(format!("{err:#}").contains("invalid glob pattern"));    }    #[test]    fn evaluate_path_wildcard_does_not_cross_segment_boundaries() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.path_prefixes = vec!["pattern:/repos/*/codex/issues*".to_string()];        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let nested_req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/private/codex/issues")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &nested_req),            HookEvaluation::HookedHostNoMatch        );    }    #[test]    fn evaluate_treats_glob_metacharacters_as_literal_without_glob_prefix() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.path_prefixes = vec!["/repos/[draft]/".to_string()];        hook.matcher.query = BTreeMap::from([("state".to_string(), vec!["op*".to_string()])]);        hook.matcher.headers = BTreeMap::from([(            "x-github-api-version".to_string(),            vec!["2022-11-28[preview]".to_string()],        )]);        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let exact_req = Request::builder()            .method(Method::POST)            .uri("/repos/[draft]/codex/issues?state=op*")            .header("x-github-api-version", "2022-11-28[preview]")            .body(Body::empty())            .unwrap();        let non_literal_req = Request::builder()            .method(Method::POST)            .uri("/repos/draft/codex/issues?state=open")            .header("x-github-api-version", "2022-11-28-preview")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &exact_req),            HookEvaluation::Matched {                actions: hooks.get("api.github.com").unwrap()[0].actions.clone(),            }        );        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &non_literal_req),            HookEvaluation::HookedHostNoMatch        );    }    #[test]    fn evaluate_allows_literal_values_with_reserved_prefixes() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.query =            BTreeMap::from([("state".to_string(), vec!["literal:pattern:*".to_string()])]);        hook.matcher.headers = BTreeMap::from([(            "x-github-api-version".to_string(),            vec!["literal:pattern:*".to_string()],        )]);        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let exact_req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues?state=pattern%3A%2A")            .header("x-github-api-version", "pattern:*")            .body(Body::empty())            .unwrap();        let non_literal_req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues?state=pattern%3Aopen")            .header("x-github-api-version", "pattern:preview")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &exact_req),            HookEvaluation::Matched {                actions: hooks.get("api.github.com").unwrap()[0].actions.clone(),            }        );        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &non_literal_req),            HookEvaluation::HookedHostNoMatch        );    }    #[test]    fn evaluate_returns_hooked_host_no_match_when_query_constraint_fails() {        let mut config = base_config();        let mut hook = github_hook();        hook.matcher.query = BTreeMap::from([("state".to_string(), vec!["open".to_string()])]);        config.network.mitm_hooks = vec![hook];        let hooks = compile_mitm_hooks_with_resolvers(            &config,            |_| Some("abc".to_string()),            |_| Err(anyhow!("unexpected file lookup")),        )        .unwrap();        let req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues?state=closed")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&hooks, "api.github.com", &req),            HookEvaluation::HookedHostNoMatch        );    }    #[test]    fn evaluate_returns_no_hooks_for_unconfigured_host() {        let req = Request::builder()            .method(Method::POST)            .uri("/repos/openai/codex/issues")            .body(Body::empty())            .unwrap();        assert_eq!(            evaluate_mitm_hooks(&MitmHooksByHost::new(), "api.github.com", &req),            HookEvaluation::NoHooksForHost        );    }}