Redirects are promises about where

package main

import (
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"net/http/httptest"
	"net/url"
	"runtime"
	"strconv"
	"strings"
	"sync"
	"sync/atomic"
	"time"
)

type visit struct {
	Path, Method, Body string
}

func must(err error) {
	if err != nil {
		panic(err)
	}
}

func check(ok bool, message string) {
	if !ok {
		panic(message)
	}
}

func main() {
	var foreignCalls atomic.Int64
	foreign := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		foreignCalls.Add(1)
		w.WriteHeader(http.StatusNoContent)
	}))
	defer foreign.Close()
	var mu sync.Mutex
	var visits []visit
	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		defer r.Body.Close()
		body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1024))
		must(err)
		seen := visit{r.URL.Path, r.Method, string(body)}
		mu.Lock()
		visits = append(visits, seen)
		mu.Unlock()
		if r.URL.Path == "/destination" {
			w.Header().Set("Content-Type", "application/json")
			must(json.NewEncoder(w).Encode(seen))
			return
		}
		status, location := http.StatusFound, ""
		switch r.URL.Path {
		case "/loop":
			location = "/loop"
		case "/foreign":
			location = foreign.URL + "/destination"
		case "/missing":
		default:
			status, err = strconv.Atoi(strings.TrimPrefix(r.URL.Path, "/r/"))
			must(err)
			location = "/destination"
		}
		if location != "" {
			w.Header().Set("Location", location)
		}
		w.Header().Set("Cache-Control", "no-store")
		w.WriteHeader(status)
		fmt.Fprint(w, "redirect")
	}))
	server.Config.ReadHeaderTimeout = time.Second
	server.Config.ReadTimeout = 2 * time.Second
	server.Start()
	defer server.Close()
	origin, err := url.Parse(server.URL)
	must(err)
	errOrigin := errors.New("redirect changes origin")
	errBudget := errors.New("redirect budget exhausted")
	transport := &http.Transport{}
	defer transport.CloseIdleConnections()
	client := &http.Client{Transport: transport, Timeout: 3 * time.Second,
		CheckRedirect: func(request *http.Request, via []*http.Request) error {
			if request.URL.Scheme != origin.Scheme || request.URL.Host != origin.Host {
				return errOrigin
			}
			if len(via) >= 3 {
				return errBudget
			}
			return nil
		},
	}
	read := func(response *http.Response) []byte {
		body, readError := io.ReadAll(response.Body)
		closeError := response.Body.Close()
		must(readError)
		must(closeError)
		check(response.Proto == "HTTP/1.1", "HTTP/1.1 fixture required")
		return body
	}
	request := func(route string, body io.Reader) *http.Request {
		req, err := http.NewRequest(http.MethodPost, server.URL+route, body)
		must(err)
		return req
	}
	snapshot := func() []visit {
		mu.Lock()
		defer mu.Unlock()
		return append([]visit(nil), visits...)
	}
	const payload = "action=replace"
	follow := func(status int) {
		route := "/r/" + strconv.Itoa(status)
		req := request(route, strings.NewReader(payload))
		check(req.GetBody != nil, "fixture body must be replayable")
		before := len(snapshot())
		response, err := client.Do(req)
		must(err)
		var final visit
		must(json.Unmarshal(read(response), &final))
		method, body := "POST", payload
		if status == 301 || status == 302 || status == 303 {
			method, body = "GET", ""
		}
		check(response.StatusCode == 200 && response.Request.URL.Path == "/destination", "wrong final response")
		check(final == (visit{"/destination", method, body}), "wrong redirected method/body")
		actual := snapshot()[before:]
		check(len(actual) == 2 && actual[0] == (visit{route, "POST", payload}) && actual[1] == final, "both wire hops must match")
		fmt.Printf("%d: POST -> %s body=%q\n", status, method, body)
	}
	for _, status := range []int{301, 302, 303, 307, 308} {
		follow(status)
	}
	stopped := *client
	stopped.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse }
	before := len(snapshot())
	response, err := stopped.Do(request("/r/307", strings.NewReader(payload)))
	must(err)
	check(string(read(response)) == "redirect" && response.StatusCode == 307, "inspect original redirect")
	check(response.Header.Get("Location") == "/destination" && len(snapshot()) == before+1, "no-follow must stop before target")
	fmt.Println("no-follow: 307 with relative Location; target not requested")

	before = len(snapshot())
	unreplayable := request("/r/307", io.NopCloser(strings.NewReader(payload)))
	unreplayable.ContentLength = int64(len(payload))
	check(unreplayable.GetBody == nil, "fixture must not support replay")
	response, err = client.Do(unreplayable)
	must(err)
	check(string(read(response)) == "redirect" && response.StatusCode == 307, "Go must retain the unreplayable redirect")
	check(len(snapshot()) == before+1, "unreplayable body must not reach target")
	fmt.Println("unreplayable: 307 returned without following")

	for _, test := range []struct {
		route string
		err   error
		hops  int
	}{{"/foreign", errOrigin, 1}, {"/loop", errBudget, 3}} {
		before = len(snapshot())
		response, err = client.Do(request(test.route, strings.NewReader(payload)))
		check(errors.Is(err, test.err), "wrong redirect policy error")
		if response != nil {
			_ = response.Body.Close() // Already closed by Client.Do on policy rejection.
		}
		check(len(snapshot()) == before+test.hops, "wrong number of admitted hops")
		fmt.Println(test.route, test.err)
	}
	check(foreignCalls.Load() == 0, "different-origin target must never be contacted")
	before = len(snapshot())
	response, err = client.Do(request("/missing", strings.NewReader(payload)))
	must(err)
	check(string(read(response)) == "redirect" && response.StatusCode == 302, "missing Location must retain 302")
	check(len(snapshot()) == before+1, "missing Location cannot select a target")
	fmt.Println("missing Location: original 302 returned")
	follow(307)
	check(len(snapshot()) == 19 && foreignCalls.Load() == 0, "wrong final request counts")
	fmt.Println("nineteen same-origin requests; zero different-origin requests")
	fmt.Println(runtime.Version())
}