use http::Method;
 
fn main() {
    // CONNECT is for tunneling through proxies
    let connect_method = Method::CONNECT;
    
    // Standard resource methods
    let get_method = Method::GET;
    let post_method = Method::POST;
    let put_method = Method::PUT;
    let delete_method = Method::DELETE;
    
    // CONNECT differs from other methods:
    // 1. Request target is an authority (host:port), not a URI path
    // 2. No request body semantics (tunnel data follows headers)
    // 3. No response body semantics (tunnel data follows response)
    // 4. Not cacheable
    // 5. No safe or idempotent guarantees
    
    println!("CONNECT: {:?}", connect_method);
    println!("GET: {:?}", get_method);
}

use http::{Method, Request, Uri};
 
fn connect_request_example() {
    // CONNECT requests use authority form, not full URI
    let request = Request::builder()
        .method(Method::CONNECT)
        .uri(Uri::from_static("example.com:443")) // Authority form
        .version(http::Version::HTTP_11)
        .body(())
        .unwrap();
    
    // A CONNECT request looks like:
    // CONNECT example.com:443 HTTP/1.1
    // Host: example.com
    // Proxy-Authorization: Basic credentials
    // (empty line)
    
    // Compare to GET:
    let get_request = Request::builder()
        .method(Method::GET)
        .uri(Uri::from_static("https://example.com/path?query=value"))
        .body(())
        .unwrap();
    
    // GET requests use absolute URI or path form
    // GET /path?query=value HTTP/1.1
}
 
fn main() {
    connect_request_example();
}

// CONNECT enables HTTPS through HTTP proxies
// Without CONNECT, HTTPS cannot work through standard HTTP proxies
 
fn explain_https_tunneling() {
    // Client wants to access https://example.com through proxy
    // 
    // Step 1: Client sends CONNECT to proxy
    // CONNECT example.com:443 HTTP/1.1
    // Host: example.com
    // Proxy-Authorization: Basic credentials
    
    // Step 2: Proxy opens TCP connection to example.com:443
    
    // Step 3: Proxy responds
    // HTTP/1.1 200 Connection Established
    // (empty line)
    
    // Step 4: Tunnel is established. Client now speaks TLS directly
    // through the proxy connection. The proxy just forwards bytes.
    
    // Step 5: Client sends TLS ClientHello, server responds
    // Proxy doesn't see or modify any TLS data
    
    // This is why CONNECT is essential for HTTPS through proxies:
    // - The proxy cannot decrypt HTTPS content
    // - The proxy cannot modify HTTPS requests
    // - End-to-end encryption is preserved
}
 
fn main() {
    explain_https_tunneling();
}

use http::Method;
 
fn proxy_handling_comparison() {
    // GET through proxy - proxy sees and can modify everything
    // Client sends:
    // GET https://example.com/resource HTTP/1.1
    // 
    // Proxy can:
    // - Read headers and body
    // - Cache the response
    // - Add/modify headers (X-Forwarded-For, etc.)
    // - Filter content
    // - Log the request
    
    // POST through proxy - proxy handles request body
    // POST https://example.com/api HTTP/1.1
    // Content-Type: application/json
    // Content-Length: 42
    // 
    // {"request":"body"}
    // 
    // Proxy can:
    // - Read and validate body
    // - Apply rate limiting based on content
    // - Transform the body
    
    // CONNECT through proxy - proxy just tunnels
    // CONNECT example.com:443 HTTP/1.1
    // 
    // After 200 response:
    // [Raw TLS data flows through - proxy is blind]
    // 
    // Proxy can:
    // - Only see the target host:port
    // - Forward bytes in both directions
    // - Apply connection-level policies (timeouts, bandwidth)
    // Cannot:
    // - See request/response content (encrypted)
    // - Modify anything inside the tunnel
    // - Cache or log meaningful data
}
 
fn main() {
    proxy_handling_comparison();
}

use http::{Method, Response, StatusCode};
 
fn connect_response_example() {
    // Successful CONNECT response
    let response = Response::builder()
        .status(StatusCode::OK) // 200
        .version(http::Version::HTTP_11)
        .body(())
        .unwrap();
    
    // The actual response is minimal:
    // HTTP/1.1 200 Connection Established
    // (optional headers)
    // (empty line)
    
    // Status codes for CONNECT:
    // - 200: Tunnel established successfully
    // - 407: Proxy authentication required
    // - 403: Proxy refuses to connect to that host
    // - 502: Target host unreachable
    // - 504: Timeout connecting to target
    
    // Compare to GET response:
    // HTTP/1.1 200 OK
    // Content-Type: text/html
    // Content-Length: 1234
    // 
    // <html>...</html>
    
    // CONNECT 200 response has no meaningful body
    // Data flows through the tunnel, not in the response body
}
 
fn main() {
    connect_response_example();
}

use http::{Method, Request, Uri, HeaderValue};
 
fn websocket_tunnel() {
    // WebSocket often uses CONNECT for proxy traversal
    
    // If client needs WebSocket through proxy with HTTPS endpoint:
    // 1. CONNECT ws.example.com:443 HTTP/1.1
    // 2. Establish TLS tunnel through proxy
    // 3. Send WebSocket upgrade request THROUGH the tunnel
    
    let connect_request = Request::builder()
        .method(Method::CONNECT)
        .uri("ws.example.com:443")
        .header("Host", "ws.example.com:443")
        .body(())
        .unwrap();
    
    // After tunnel established, client sends through tunnel:
    // GET /chat HTTP/1.1
    // Host: ws.example.com
    // Upgrade: websocket
    // Connection: Upgrade
    // Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
    // Sec-WebSocket-Version: 13
    
    // Without CONNECT, the proxy would need to understand WebSocket
    // to handle the Upgrade semantics correctly
}
 
fn main() {
    websocket_tunnel();
}

use http::Method;
 
fn method_properties() {
    // Standard methods have defined properties:
    
    // GET, HEAD, OPTIONS, TRACE - Safe
    // Safe methods don't modify server state
    // Proxies can cache GET responses
    
    // GET, HEAD, PUT, DELETE, OPTIONS, TRACE - Idempotent
    // Multiple identical requests have same effect as one
    // Proxies can retry on failure
    
    // POST - Neither safe nor idempotent
    // Each POST may have different effects
    
    // CONNECT - Neither safe nor idempotent
    // - Establishes new state (a tunnel connection)
    // - Multiple CONNECT may have different results
    //   (connection state changes)
    // - Cannot be cached
    // - Cannot be automatically retried
    
    // This matters for:
    // - Proxy retry logic (CONNECT shouldn't auto-retry)
    // - Caching (CONNECT responses aren't cacheable)
    // - Logging (CONNECT requires special handling)
    
    let connect = Method::CONNECT;
    
    // Check method properties
    println!("CONNECT is safe: {}", connect.is_safe());
    println!("CONNECT is idempotent: {}", connect.is_idempotent());
}
 
fn main() {
    method_properties();
}

use http::{Method, Request, Response, StatusCode};
use tokio::net::TcpStream;
use tokio::io::{copy, split};
 
async fn handle_connect_request(
    request: Request<Vec<u8>>,
) -> Result<Response<Vec<u8>>, Box<dyn std::error::Error>> {
    // Verify method
    if request.method() != Method::CONNECT {
        return Err("Expected CONNECT method".into());
    }
    
    // Parse target from URI (authority form)
    let target = request.uri().to_string();
    let parts: Vec<&str> = target.split(':').collect();
    
    if parts.len() != 2 {
        return Ok(Response::builder()
            .status(StatusCode::BAD_REQUEST)
            .body(b"Invalid target format".to_vec())?);
    }
    
    let host = parts[0];
    let port: u16 = parts[1].parse()?;
    
    // Check allowlist/policy
    if !is_target_allowed(host, port) {
        return Ok(Response::builder()
            .status(StatusCode::FORBIDDEN)
            .body(b"Target not allowed".to_vec())?);
    }
    
    // Connect to target
    match TcpStream::connect((host, port)).await {
        Ok(_target_stream) => {
            // Send 200 Connection Established
            let response = Response::builder()
                .status(StatusCode::OK)
                .body(Vec::new())?;
            
            // After this, we would:
            // 1. Send response to client
            // 2. Start bidirectional copy between client and target
            // 3. The client_connection and target_stream would be
            //    split into read/write halves and data copied
            
            Ok(response)
        }
        Err(e) => {
            Ok(Response::builder()
                .status(StatusCode::BAD_GATEWAY)
                .body(format!("Failed to connect: {}", e).into_bytes())?)
        }
    }
}
 
fn is_target_allowed(host: &str, port: u16) -> bool {
    // Implement allowlist/blocklist logic
    // Common restrictions:
    // - Block internal IP ranges (10.x, 192.168.x, etc.)
    // - Only allow specific ports (443, 80)
    // - Host allowlist for certain networks
    
    port == 443 || port == 80 || host.ends_with(".example.com")
}
 
fn main() {}

use http::Method;
use std::time::Duration;
 
fn connect_resource_management() {
    // CONNECT tunnels hold resources (TCP connections)
    // This differs from other methods:
    
    // GET/POST - Connection can be reused or closed after response
    // CONNECT - Connection must be maintained for tunnel duration
    
    // Considerations:
    
    // 1. Timeout policies
    let connect_timeout = Duration::from_secs(30);
    let tunnel_idle_timeout = Duration::from_secs(300);
    let tunnel_max_duration = Duration::from_secs(3600);
    
    // 2. Connection limits
    // - Maximum concurrent tunnels per client
    // - Maximum tunnels per proxy instance
    // - Bandwidth limits per tunnel
    
    // 3. Monitoring
    // - Active tunnel count
    // - Tunnel duration
    // - Bytes transferred (but not content)
    
    // 4. Cleanup
    // - Kill stale tunnels
    // - Handle client disconnects gracefully
    
    // These considerations don't apply the same way to
    // GET/POST where each request is independent
}
 
fn main() {
    connect_resource_management();
}

use http::{Method, Request};
 
fn ssh_tunnel_example() {
    // CONNECT can tunnel any TCP protocol, not just HTTPS
    
    // SSH through HTTP proxy:
    // CONNECT ssh.example.com:22 HTTP/1.1
    // Host: ssh.example.com:22
    // Proxy-Authorization: Basic credentials
    
    // Proxy establishes tunnel to SSH port
    // Client speaks SSH protocol through tunnel
    
    // This is commonly used in enterprise environments:
    // - Employee needs SSH access
    // - Only HTTP proxy allows outbound connections
    // - CONNECT tunnels SSH through the proxy
    
    // Security consideration:
    // Network admins often restrict CONNECT to ports 443 and 80
    // to prevent arbitrary protocol tunneling
    
    let request = Request::builder()
        .method(Method::CONNECT)
        .uri("ssh.example.com:22")
        .body(())
        .unwrap();
    
    println!("SSH tunnel request: {:?} {}", request.method(), request.uri());
}
 
fn main() {
    ssh_tunnel_example();
}

use http::{Method, Request, StatusCode, Response};
 
fn security_considerations() {
    // CONNECT has unique security implications:
    
    // 1. Bypass network policy
    // - CONNECT tunnels can bypass content filtering
    // - Malware could use CONNECT to exfiltrate data
    // - Solution: Restrict CONNECT to specific ports/hosts
    
    // 2. Authentication required
    // - CONNECT should require proxy authentication
    // - Log who creates tunnels
    // - Rate limit per user
    
    // 3. Target validation
    // - Block private IP ranges
    // - Block metadata endpoints (169.254.169.254)
    // - Implement allowlists
    
    // 4. SSL/TLS interception considerations
    // - Some proxies MITM CONNECT for SSL inspection
    // - This breaks end-to-end security guarantees
    // - Requires client trust of proxy certificate
    
    // 5. Compared to other methods
    // - GET/POST can be inspected, filtered, logged
    // - CONNECT content is opaque to proxy
    // - More trust required in CONNECT users
    
    // Typical proxy policy for CONNECT:
    // fn can_connect(user: &User, host: &str, port: u16) -> bool {
    //     user.is_authenticated()
    //     && is_allowed_port(port)
    //     && !is_private_ip(host)
    //     && user.has_permission("connect")
    // }
}
 
fn main() {
    security_considerations();
}

use http::{Method, Version};
 
fn http2_connect() {
    // HTTP/2 handles CONNECT differently:
    
    // In HTTP/1.1, CONNECT creates a new connection state
    // In HTTP/2, CONNECT can use existing multiplexed stream
    
    // HTTP/2 CONNECT uses:
    // - :method = CONNECT
    // - :authority = target host:port
    // - Stream becomes a tunnel within the HTTP/2 connection
    
    // Key difference from HTTP/1.1:
    // - HTTP/1.1: Tunnel takes over entire connection
    // - HTTP/2: Tunnel is one stream among many
    
    // Benefits of HTTP/2 CONNECT:
    // - Can have multiple tunnels per connection
    // - Can have tunnel + regular requests on same connection
    // - Better connection utilization
    
    // The http crate represents HTTP version:
    let version = Version::HTTP_2;
    let method = Method::CONNECT;
    
    // Still the same CONNECT semantics for tunneling
    // but implemented over HTTP/2 frames
}
 
fn main() {
    http2_connect();
}

use http::Method;
 
fn method_comparison() {
    // CONNECT vs other methods:
    
    // GET - Retrieve resource
    // - Request: Path + query string
    // - Response: Resource content
    // - Proxy: Can see all content, cache, modify headers
    // - Cacheable: Yes
    // - Safe: Yes
    // - Idempotent: Yes
    
    // POST - Create/modify resource
    // - Request: Path + body
    // - Response: Result of operation
    // - Proxy: Can see content (if not HTTPS)
    // - Cacheable: Rarely
    // - Safe: No
    // - Idempotent: No
    
    // PUT - Replace resource
    // - Request: Path + body
    // - Response: Result
    // - Proxy: Can see content
    // - Cacheable: No
    // - Safe: No
    // - Idempotent: Yes
    
    // CONNECT - Establish tunnel
    // - Request: Authority (host:port)
    // - Response: Connection status
    // - Proxy: Cannot see tunnel content
    // - Cacheable: No
    // - Safe: No
    // - Idempotent: No
    
    let methods = vec![
        Method::GET,
        Method::POST,
        Method::PUT,
        Method::DELETE,
        Method::CONNECT,
    ];
    
    for method in methods {
        println!("{:?} - safe: {}, idempotent: {}", 
            method, method.is_safe(), method.is_idempotent());
    }
}
 
fn main() {
    method_comparison();
}

use http::Method;
 
// CONNECT is for tunneling, not resource operations
// Key differences from other methods:
 
// 1. Request format
// CONNECT: Authority form (host:port)
// Others: Path form (/path) or absolute URI
 
// 2. Request/Response body
// CONNECT: No body semantics, raw bytes flow after headers
// Others: Body is request/response content
 
// 3. Proxy behavior
// CONNECT: Proxy is transparent tunnel, forwards bytes blindly
// Others: Proxy sees and can modify request/response content
 
// 4. Properties
// CONNECT: Not safe, not idempotent, not cacheable
// Others: Various combinations (GET is safe+idempotent)
 
// 5. Use cases
// CONNECT: HTTPS through HTTP proxy, WebSocket, SSH tunneling
// Others: Resource retrieval, creation, modification, deletion
 
// 6. Security implications
// CONNECT: Content invisible to proxy, requires trust
// Others: Content visible, can be filtered/inspected
 
// In Rust http crate:
let connect = Method::CONNECT;
assert!(!connect.is_safe());
assert!(!connect.is_idempotent());