서블릿 요청 입력

package board.servlet;

import static java.nio.charset.StandardCharsets.UTF_8;
import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertNull;

import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;
import java.util.Map;
import java.util.concurrent.atomic.AtomicReference;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.MultipartConfigElement;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.junit.jupiter.api.Test;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.SpringBootConfiguration;
import org.springframework.boot.WebApplicationType;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.web.server.servlet.context
        .ServletWebServerApplicationContext;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.boot.web.servlet.ServletRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.http.InvalidMediaTypeException;
import org.springframework.http.MediaType;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.web.util.ContentCachingRequestWrapper;
import tools.jackson.core.JacksonException;
import tools.jackson.databind.json.JsonMapper;

class EmbeddedServletRequestInputTest {
    private static final HttpClient CLIENT = HttpClient.newBuilder()
            .connectTimeout(Duration.ofSeconds(5))
            .version(HttpClient.Version.HTTP_1_1)
            .build();
    private static final String JSON_BODY =
            "{\"title\":\"HTTP\",\"content\":\"HTTP 본문\"}";

    @Test
    void addParameter는_mock_설정이지_본문_파싱이_아니다()
            throws Exception {
        var request = new MockHttpServletRequest(
                "POST",
                "/raw/input/form");
        request.setContentType("application/x-www-form-urlencoded");
        request.setContent("title=wire".getBytes(UTF_8));

        assertNull(request.getParameter("title"));

        request.addParameter("title", "preset");

        assertAll(
                () -> assertEquals(
                        "preset",
                        request.getParameter("title")),
                () -> assertEquals(
                        "title=wire",
                        new String(
                                request.getInputStream().readAllBytes(),
                                UTF_8)));
    }

    @Test
    void 실제_query_form_JSON은_서로_다른_입력_소유권을_보인다()
            throws Exception {
        assertEquals(40, JSON_BODY.getBytes(UTF_8).length);

        try (var server = RunningServer.start()) {
            var query = send(
                    server,
                    "GET",
                    "/raw/input/query?title=HTTP&tag=network&tag=spring",
                    null,
                    null,
                    Map.of());
            var form = send(
                    server,
                    "POST",
                    "/raw/input/form",
                    "application/x-www-form-urlencoded",
                    "title=%EC%9A%94%EC%B2%AD&tag=one&tag=two"
                            .getBytes(UTF_8),
                    Map.of());
            var json = send(
                    server,
                    "POST",
                    "/raw/input/json?source=query",
                    "application/json;charset=UTF-8",
                    JSON_BODY.getBytes(UTF_8),
                    Map.of());

            assertAll(
                    () -> assertEquals(200, query.statusCode()),
                    () -> assertEquals(
                            "title=HTTP;tags=network,spring",
                            query.body()),
                    () -> assertEquals(200, form.statusCode()),
                    () -> assertEquals(
                            "encoding=UTF-8;title=요청;tags=one,two;remaining=0",
                            form.body()),
                    () -> assertEquals(201, json.statusCode()),
                    () -> assertEquals(
                            "query=query;parameterTitle=<null>;bytes=40;"
                                    + "title=HTTP;content=HTTP 본문",
                            json.body()));
        }
    }

    @Test
    void reader와_inputStream은_양방향으로_상호_배타적이다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var readerFirst = send(
                    server,
                    "POST",
                    "/raw/input/reader-first",
                    "text/plain;charset=UTF-8",
                    "body".getBytes(UTF_8),
                    Map.of());
            var streamFirst = send(
                    server,
                    "POST",
                    "/raw/input/stream-first",
                    "text/plain;charset=UTF-8",
                    "body".getBytes(UTF_8),
                    Map.of());

            assertAll(
                    () -> assertEquals(200, readerFirst.statusCode()),
                    () -> assertEquals(
                            "reader->stream:IllegalStateException",
                            readerFirst.body()),
                    () -> assertEquals(200, streamFirst.statusCode()),
                    () -> assertEquals(
                            "stream->reader:IllegalStateException",
                            streamFirst.body()));
        }
    }

    @Test
    void JSON_정책은_파라미터와_application_plus_json을_구조적으로_판정한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var parameterized = send(
                    server,
                    "POST",
                    "/raw/input/json",
                    "application/json;charset=UTF-8",
                    JSON_BODY.getBytes(UTF_8),
                    Map.of());
            var suffix = send(
                    server,
                    "POST",
                    "/raw/input/json",
                    "application/problem+json;profile=error",
                    JSON_BODY.getBytes(UTF_8),
                    Map.of());
            var rejected = send(
                    server,
                    "POST",
                    "/raw/input/json",
                    "text/json",
                    JSON_BODY.getBytes(UTF_8),
                    Map.of());
            var malformed = send(
                    server,
                    "POST",
                    "/raw/input/json",
                    "application/json",
                    "{".getBytes(UTF_8),
                    Map.of());

            assertAll(
                    () -> assertEquals(201, parameterized.statusCode()),
                    () -> assertEquals(201, suffix.statusCode()),
                    () -> assertEquals(415, rejected.statusCode()),
                    () -> assertEquals(400, malformed.statusCode()));
        }
    }

    @Test
    void multipart는_구성된_part_파서와_파일_크기_게이트를_사용한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var accepted = multipart(
                    server,
                    "board-boundary-ok",
                    "12345678");
            var rejected = multipart(
                    server,
                    "board-boundary-large",
                    "123456789");

            assertAll(
                    () -> assertEquals(200, accepted.statusCode()),
                    () -> assertEquals(
                            "title=upload;file=a.txt;bytes=8;content=12345678",
                            accepted.body()),
                    () -> assertEquals(413, rejected.statusCode()));
        }
    }

    @Test
    void 직접_연결_피어와_사용자_전달_헤더는_같은_신뢰값이_아니다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var response = send(
                    server,
                    "GET",
                    "/raw/input/peer",
                    null,
                    null,
                    Map.of("X-Forwarded-For", "203.0.113.9"));

            assertAll(
                    () -> assertEquals(200, response.statusCode()),
                    () -> assertEquals(
                            "remote=127.0.0.1;forwarded=203.0.113.9",
                            response.body()));
        }
    }

    @Test
    void 애플리케이션_게이트는_선언_길이와_chunked_스트림을_모두_제한한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var exact = send(
                    server,
                    "POST",
                    "/raw/input/sized",
                    "application/octet-stream",
                    new byte[64],
                    Map.of());
            var declaredTooLarge = send(
                    server,
                    "POST",
                    "/raw/input/sized",
                    "application/octet-stream",
                    new byte[65],
                    Map.of());
            var chunkedTooLarge = sendUnknownLength(
                    server,
                    "/raw/input/sized",
                    new byte[65]);

            assertAll(
                    () -> assertEquals(204, exact.statusCode()),
                    () -> assertEquals(413, declaredTooLarge.statusCode()),
                    () -> assertEquals(413, chunkedTooLarge.statusCode()));
        }
    }

    @Test
    void contentCachingWrapper는_downstream_소비_뒤_상한까지만_기록한다()
            throws Exception {
        assertEquals(40, JSON_BODY.getBytes(UTF_8).length);

        try (var server = RunningServer.start()) {
            var response = send(
                    server,
                    "POST",
                    "/raw/input/cache",
                    "application/json",
                    JSON_BODY.getBytes(UTF_8),
                    Map.of());
            var sample = server.probe().last.get();

            assertAll(
                    () -> assertEquals(200, response.statusCode()),
                    () -> assertEquals("downstreamBytes=40", response.body()),
                    () -> assertEquals(0, sample.beforeBytes()),
                    () -> assertEquals(16, sample.afterBytes()),
                    () -> assertEquals(40, sample.declaredBytes()));
        }
    }

    private static HttpResponse<String> multipart(
            RunningServer server,
            String boundary,
            String fileContent)
            throws Exception {
        var body = ("--" + boundary + "\r\n"
                        + "Content-Disposition: form-data; name=\"title\"\r\n"
                        + "\r\n"
                        + "upload\r\n"
                        + "--" + boundary + "\r\n"
                        + "Content-Disposition: form-data; name=\"file\"; "
                        + "filename=\"a.txt\"\r\n"
                        + "Content-Type: text/plain\r\n"
                        + "\r\n"
                        + fileContent + "\r\n"
                        + "--" + boundary + "--\r\n")
                .getBytes(UTF_8);
        return send(
                server,
                "POST",
                "/raw/input/multipart",
                "multipart/form-data; boundary=" + boundary,
                body,
                Map.of());
    }

    private static HttpResponse<String> send(
            RunningServer server,
            String method,
            String path,
            String contentType,
            byte[] body,
            Map<String, String> headers)
            throws IOException, InterruptedException {
        var builder = HttpRequest.newBuilder(
                        URI.create(server.origin() + path))
                .timeout(Duration.ofSeconds(5));
        if (contentType != null) builder.header("Content-Type", contentType);
        headers.forEach(builder::header);
        var publisher = body == null
                ? HttpRequest.BodyPublishers.noBody()
                : HttpRequest.BodyPublishers.ofByteArray(body);
        return CLIENT.send(
                builder.method(method, publisher).build(),
                HttpResponse.BodyHandlers.ofString(UTF_8));
    }

    private static HttpResponse<String> sendUnknownLength(
            RunningServer server,
            String path,
            byte[] body)
            throws IOException, InterruptedException {
        var request = HttpRequest.newBuilder(
                        URI.create(server.origin() + path))
                .timeout(Duration.ofSeconds(5))
                .header("Content-Type", "application/octet-stream")
                .POST(HttpRequest.BodyPublishers.ofInputStream(
                        () -> new ByteArrayInputStream(body)))
                .build();
        return CLIENT.send(
                request,
                HttpResponse.BodyHandlers.ofString(UTF_8));
    }

    private record RunningServer(
            ServletWebServerApplicationContext context,
            String origin,
            CacheProbe probe)
            implements AutoCloseable {
        static RunningServer start() {
            var probe = new CacheProbe();
            var application = new SpringApplication(TestApplication.class);
            application.setWebApplicationType(WebApplicationType.SERVLET);
            application.setRegisterShutdownHook(false);
            application.setDefaultProperties(Map.of(
                    "server.address", "127.0.0.1",
                    "server.port", "0",
                    "server.forward-headers-strategy", "none",
                    "spring.main.banner-mode", "off",
                    "logging.level.root", "OFF"));
            application.addInitializers(context -> context
                    .getBeanFactory()
                    .registerSingleton("cacheProbe", probe));

            var context = (ServletWebServerApplicationContext)
                    application.run();
            return new RunningServer(
                    context,
                    "http://127.0.0.1:"
                            + context.getWebServer().getPort(),
                    probe);
        }

        @Override
        public void close() {
            context.close();
        }
    }

    @SpringBootConfiguration(proxyBeanMethods = false)
    @EnableAutoConfiguration
    static class TestApplication {
        @Bean
        ServletRegistrationBean<RequestInputServlet> requestInputServlet() {
            var registration = new ServletRegistrationBean<>(
                    new RequestInputServlet(),
                    "/raw/input/*");
            registration.setName("requestInputServlet");
            registration.setMultipartConfig(
                    new MultipartConfigElement("", 8, 512, 0));
            return registration;
        }

        @Bean
        FilterRegistrationBean<BoundedCacheFilter> boundedCacheFilter(
                CacheProbe probe) {
            var registration = new FilterRegistrationBean<>(
                    new BoundedCacheFilter(probe));
            registration.setName("boundedCacheFilter");
            registration.addUrlPatterns("/raw/input/cache");
            registration.setOrder(1);
            return registration;
        }
    }

    static final class RequestInputServlet extends HttpServlet {
        private static final JsonMapper JSON = JsonMapper.builder().build();
        private static final int MAX_BODY_BYTES = 64;

        @Override
        protected void doGet(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            switch (request.getRequestURI()) {
                case "/raw/input/query" -> text(
                        response,
                        200,
                        "title=" + request.getParameter("title")
                                + ";tags="
                                + String.join(
                                        ",",
                                        request.getParameterValues("tag")));
                case "/raw/input/peer" -> text(
                        response,
                        200,
                        "remote=" + request.getRemoteAddr()
                                + ";forwarded="
                                + request.getHeader("X-Forwarded-For"));
                default -> response.sendError(404);
            }
        }

        @Override
        protected void doPost(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException, ServletException {
            switch (request.getRequestURI()) {
                case "/raw/input/form" -> readForm(request, response);
                case "/raw/input/json" -> readJson(request, response);
                case "/raw/input/reader-first" -> readerFirst(
                        request,
                        response);
                case "/raw/input/stream-first" -> streamFirst(
                        request,
                        response);
                case "/raw/input/multipart" -> readMultipart(
                        request,
                        response);
                case "/raw/input/sized" -> readSized(request, response);
                case "/raw/input/cache" -> text(
                        response,
                        200,
                        "downstreamBytes="
                                + request.getInputStream()
                                        .readAllBytes()
                                        .length);
                default -> response.sendError(404);
            }
        }

        private static void readForm(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            request.setCharacterEncoding(UTF_8);
            var title = request.getParameter("title");
            var tags = request.getParameterValues("tag");
            var remaining = request.getInputStream().readAllBytes().length;
            text(
                    response,
                    200,
                    "encoding=" + request.getCharacterEncoding()
                            + ";title=" + title
                            + ";tags=" + String.join(",", tags)
                            + ";remaining=" + remaining);
        }

        private static void readJson(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            if (!supportsJson(request.getContentType())) {
                response.sendError(415, "unsupported content type");
                return;
            }

            var parameterTitle = request.getParameter("title");
            var querySource = request.getParameter("source");
            var body = request.getInputStream().readAllBytes();
            final CreatePostInput input;
            try {
                input = JSON.readValue(body, CreatePostInput.class);
            } catch (JacksonException exception) {
                response.sendError(400, "invalid JSON");
                return;
            }
            text(
                    response,
                    201,
                    "query=" + printable(querySource)
                            + ";parameterTitle="
                            + printable(parameterTitle)
                            + ";bytes=" + body.length
                            + ";title=" + input.title()
                            + ";content=" + input.content());
        }

        private static boolean supportsJson(String rawContentType) {
            if (rawContentType == null) return false;
            final MediaType mediaType;
            try {
                mediaType = MediaType.parseMediaType(rawContentType);
            } catch (InvalidMediaTypeException exception) {
                return false;
            }
            return "application".equals(mediaType.getType())
                    && ("json".equals(mediaType.getSubtype())
                            || "json".equals(
                                    mediaType.getSubtypeSuffix()));
        }

        private static void readerFirst(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            request.getReader();
            try {
                request.getInputStream();
                text(response, 500, "reader->stream:allowed");
            } catch (IllegalStateException expected) {
                text(
                        response,
                        200,
                        "reader->stream:IllegalStateException");
            }
        }

        private static void streamFirst(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            request.getInputStream();
            try {
                request.getReader();
                text(response, 500, "stream->reader:allowed");
            } catch (IllegalStateException expected) {
                text(
                        response,
                        200,
                        "stream->reader:IllegalStateException");
            }
        }

        private static void readMultipart(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException, ServletException {
            try {
                var title = request.getParameter("title");
                var file = request.getPart("file");
                var bytes = file.getInputStream().readAllBytes();
                text(
                        response,
                        200,
                        "title=" + title
                                + ";file=" + file.getSubmittedFileName()
                                + ";bytes=" + bytes.length
                                + ";content=" + new String(bytes, UTF_8));
            } catch (IllegalStateException tooLarge) {
                response.reset();
                response.sendError(413, "multipart limit exceeded");
            }
        }

        private static void readSized(
                HttpServletRequest request,
                HttpServletResponse response)
                throws IOException {
            var declared = request.getContentLengthLong();
            if (declared > MAX_BODY_BYTES) {
                response.sendError(413, "declared body is too large");
                return;
            }
            var bytes = request.getInputStream()
                    .readNBytes(MAX_BODY_BYTES + 1);
            if (bytes.length > MAX_BODY_BYTES) {
                response.sendError(413, "streamed body is too large");
                return;
            }
            response.setStatus(204);
        }

        private static String printable(String value) {
            return value == null ? "<null>" : value;
        }

        private static void text(
                HttpServletResponse response,
                int status,
                String value)
                throws IOException {
            response.setStatus(status);
            response.setContentType("text/plain");
            response.setCharacterEncoding(UTF_8);
            response.getWriter().write(value);
        }
    }

    static final class BoundedCacheFilter implements Filter {
        private static final int CACHE_LIMIT = 16;
        private final CacheProbe probe;

        BoundedCacheFilter(CacheProbe probe) {
            this.probe = probe;
        }

        @Override
        public void doFilter(
                ServletRequest request,
                ServletResponse response,
                FilterChain chain)
                throws IOException, ServletException {
            var wrapped = new ContentCachingRequestWrapper(
                    (HttpServletRequest) request,
                    CACHE_LIMIT);
            var before = wrapped.getContentAsByteArray().length;
            try {
                chain.doFilter(wrapped, response);
            } finally {
                probe.last.set(new CacheSample(
                        before,
                        wrapped.getContentAsByteArray().length,
                        request.getContentLengthLong()));
            }
        }
    }

    static final class CacheProbe {
        final AtomicReference<CacheSample> last = new AtomicReference<>();
    }

    record CacheSample(
            int beforeBytes,
            int afterBytes,
            long declaredBytes) {}

    public record CreatePostInput(String title, String content) {}
}