initial commit

internal/proxy/engine_test.go

@@ -0,0 +1,825 @@
+package proxy
+
+import (
+	"bytes"
+	"crypto/tls"
+	"encoding/base64"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"helix-proxy/internal/certificate"
+	"helix-proxy/internal/config"
+	"helix-proxy/internal/store"
+)
+
+// --- pure helper tests (table driven as recommended) ---
+
+func TestItoa(t *testing.T) {
+	if itoa(80) != "80" || itoa(0) != "0" || itoa(443) != "443" {
+		t.Error("itoa wrong")
+	}
+}
+
+func TestIsWebsocketRequest(t *testing.T) {
+	tests := []struct {
+		name string
+		h    http.Header
+		want bool
+	}{
+		{"none", http.Header{}, false},
+		{"upgrade ws conn upgrade", http.Header{"Upgrade": []string{"websocket"}, "Connection": []string{"Upgrade"}}, true},
+		{"case insen", http.Header{"Upgrade": []string{"WebSocket"}, "Connection": []string{"keep-alive, Upgrade"}}, true},
+		{"no upgrade header", http.Header{"Connection": []string{"Upgrade"}}, false},
+		{"no conn upgrade", http.Header{"Upgrade": []string{"websocket"}}, false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			r := &http.Request{Header: tt.h}
+			if got := isWebsocketRequest(r); got != tt.want {
+				t.Errorf("isWebsocketRequest() = %v want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestGetRealClientIP(t *testing.T) {
+	tests := []struct {
+		name  string
+		r     *http.Request
+		trust bool
+		want  string
+	}{
+		{"xff first (trust)", &http.Request{Header: http.Header{"X-Forwarded-For": []string{"1.2.3.4, 5.6.7.8"}}, RemoteAddr: "9.9.9.9:1"}, true, "1.2.3.4"},
+		{"xff ignored when !trust", &http.Request{Header: http.Header{"X-Forwarded-For": []string{"1.2.3.4, 5.6.7.8"}}, RemoteAddr: "9.9.9.9:1"}, false, "9.9.9.9"},
+		{"no xff use remote", &http.Request{RemoteAddr: "10.0.0.1:1234"}, true, "10.0.0.1"},
+		{"remote no port", &http.Request{RemoteAddr: "10.0.0.2"}, false, "10.0.0.2"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := getRealClientIP(tt.r, tt.trust); got != tt.want {
+				t.Errorf("getRealClientIP() = %v want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func TestParseAdvancedConfig(t *testing.T) {
+	tests := []struct {
+		name      string
+		adv       string
+		wantSets  map[string]string
+		wantAdds  map[string]string
+		wantHides []string
+	}{
+		{"empty", "", map[string]string{}, map[string]string{}, []string{}},
+		{"comment and blank", "# foo\n\n  ", map[string]string{}, map[string]string{}, []string{}},
+		{"set_header", "proxy_set_header X-Foo bar baz", map[string]string{"X-Foo": "bar baz"}, map[string]string{}, []string{}},
+		{"add_header quoted", `add_header X-Bar "val with space";`, map[string]string{}, map[string]string{"X-Bar": "val with space"}, []string{}},
+		{"hide", "proxy_hide_header X-Baz\nproxy_hide_header X-Qux", map[string]string{}, map[string]string{}, []string{"X-Baz", "X-Qux"}},
+		{"mixed sep ; and nl", "proxy_set_header A 1; add_header B 2; proxy_hide_header C", map[string]string{"A": "1"}, map[string]string{"B": "2"}, []string{"C"}},
+		{"unknown ignored", "set $foo bar\nproxy_redirect / /", map[string]string{}, map[string]string{}, []string{}},
+		{"trim quotes in add", `add_header X "v";`, map[string]string{}, map[string]string{"X": "v"}, []string{}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			sets, adds, hides := parseAdvancedConfig(tt.adv)
+			if !mapsEqual(sets, tt.wantSets) {
+				t.Errorf("reqSets = %v want %v", sets, tt.wantSets)
+			}
+			if !mapsEqual(adds, tt.wantAdds) {
+				t.Errorf("respAdds = %v want %v", adds, tt.wantAdds)
+			}
+			if !slicesEqual(hides, tt.wantHides) {
+				t.Errorf("respHides = %v want %v", hides, tt.wantHides)
+			}
+		})
+	}
+}
+
+func TestResolveProxyHeaders(t *testing.T) {
+	structured := store.ProxyHost{
+		RequestHeaders:  []store.HeaderRule{{Name: "X-Req", Value: "1"}},
+		ResponseHeaders: []store.HeaderRule{{Name: "X-Resp", Value: "2"}},
+		HideHeaders:     []string{"X-Hide"},
+	}
+	sets, adds, hides := resolveProxyHeaders(structured)
+	if !mapsEqual(sets, map[string]string{"X-Req": "1"}) {
+		t.Errorf("structured reqSets = %v", sets)
+	}
+	if !mapsEqual(adds, map[string]string{"X-Resp": "2"}) {
+		t.Errorf("structured respAdds = %v", adds)
+	}
+	if !slicesEqual(hides, []string{"X-Hide"}) {
+		t.Errorf("structured respHides = %v", hides)
+	}
+
+	legacy := store.ProxyHost{AdvancedConfig: "proxy_set_header A 1\nadd_header B 2;\nproxy_hide_header C"}
+	sets, adds, hides = resolveProxyHeaders(legacy)
+	if !mapsEqual(sets, map[string]string{"A": "1"}) || !mapsEqual(adds, map[string]string{"B": "2"}) || !slicesEqual(hides, []string{"C"}) {
+		t.Errorf("legacy fallback failed: sets=%v adds=%v hides=%v", sets, adds, hides)
+	}
+
+	// structured fields take precedence over legacy advancedConfig
+	both := store.ProxyHost{
+		RequestHeaders: []store.HeaderRule{{Name: "New", Value: "v"}},
+		AdvancedConfig: "proxy_set_header Old 1",
+	}
+	sets, _, _ = resolveProxyHeaders(both)
+	if !mapsEqual(sets, map[string]string{"New": "v"}) {
+		t.Errorf("structured should win over legacy: %v", sets)
+	}
+}
+
+func mapsEqual(a, b map[string]string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for k, v := range a {
+		if b[k] != v {
+			return false
+		}
+	}
+	return true
+}
+
+func slicesEqual(a, b []string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	for i := range a {
+		if a[i] != b[i] {
+			return false
+		}
+	}
+	return true
+}
+
+func TestCheckAccess(t *testing.T) {
+	tests := []struct {
+		name       string
+		clients    []store.AccessClient
+		satisfyAny bool
+		ip         string
+		want       bool
+	}{
+		{"no clients allow", nil, false, "1.2.3.4", true},
+		{"empty allow", []store.AccessClient{}, false, "1.2.3.4", true},
+		{"deny all", []store.AccessClient{{Address: "all", Directive: "deny"}}, false, "9.9.9.9", false},
+		{"allow all", []store.AccessClient{{Address: "all", Directive: "allow"}}, false, "1.1.1.1", true},
+		{"exact allow", []store.AccessClient{{Address: "10.0.0.1", Directive: "allow"}}, false, "10.0.0.1:123", true},
+		{"exact deny", []store.AccessClient{{Address: "10.0.0.1", Directive: "deny"}}, false, "10.0.0.1", false},
+		{"cidr allow", []store.AccessClient{{Address: "192.168.0.0/16", Directive: "allow"}}, false, "192.168.1.2", true},
+		{"cidr deny", []store.AccessClient{{Address: "192.168.0.0/16", Directive: "deny"}}, false, "192.168.1.2", false},
+		{"satisfyAny: one allow sufficient", []store.AccessClient{{Address: "1.1.1.1", Directive: "allow"}, {Address: "2.2.2.2", Directive: "allow"}}, true, "1.1.1.1", true},
+		{"satisfyAny: no allow", []store.AccessClient{{Address: "1.1.1.1", Directive: "deny"}}, true, "9.9.9.9", false},
+		{"satisfy all (default): denies block even if allow present", []store.AccessClient{{Address: "1.1.1.1", Directive: "allow"}, {Address: "1.1.1.1", Directive: "deny"}}, false, "1.1.1.1", false},
+		{"bad ip", []store.AccessClient{{Address: "all", Directive: "allow"}}, false, "not-an-ip", false},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := checkAccess(tt.clients, tt.satisfyAny, tt.ip)
+			if got != tt.want {
+				t.Errorf("checkAccess(%v, %v, %q) = %v want %v", tt.clients, tt.satisfyAny, tt.ip, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestEngineReloadClearsCache(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	eng.cacheMu.Lock()
+	eng.cache["k"] = struct {
+		body    []byte
+		headers http.Header
+		status  int
+		expires time.Time
+	}{body: []byte("x")}
+	eng.cacheMu.Unlock()
+
+	// use public ReloadFromStore (exercises the cache clear inside it)
+	eng.ReloadFromStore()
+
+	eng.cacheMu.Lock()
+	if len(eng.cache) != 0 {
+		t.Error("reload did not clear cache")
+	}
+	eng.cacheMu.Unlock()
+}
+
+// --- helpers for handler tests ---
+func newTestEngine(t *testing.T) (*Engine, store.Store) {
+	t.Helper()
+	tmp := t.TempDir()
+	config.ResetForTest()
+	t.Setenv("DATA_DIR", tmp)
+	_ = config.EnsureDataDirs()
+	st, err := store.New()
+	if err != nil {
+		t.Fatalf("test store: %v", err)
+	}
+	eng := NewEngine(st)
+	eng.ReloadFromStore()
+	return eng, st
+}
+
+func doReq(h http.Handler, method, host, path string, headers http.Header, body []byte) *httptest.ResponseRecorder {
+	req := httptest.NewRequest(method, path, bytes.NewReader(body))
+	req.Host = host
+	if headers != nil {
+		req.Header = headers.Clone()
+	}
+	rr := httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	return rr
+}
+
+// TestEngineHandler_HostMatchingRedirsDeadsDefaults exercises core routing branches.
+func TestEngineHandler_HostMatchingRedirsDeadsDefaults(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer func() {
+		if c, ok := st.(interface{ Close() error }); ok {
+			c.Close()
+		}
+	}()
+
+	h := eng.Handler()
+
+	// no hosts: default congratulations (or index if present)
+	rr := doReq(h, "GET", "nohost.local", "/", nil, nil)
+	if rr.Code != 200 || !strings.Contains(rr.Body.String(), "Welcome to Helix Proxy") {
+		t.Errorf("default congrats: code=%d body=%s", rr.Code, rr.Body.String()[:min(100, rr.Body.Len())])
+	}
+
+	// set default 404
+	st.SetSetting("default_site", "404")
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "nohost.local", "/", nil, nil)
+	if rr.Code != 404 {
+		t.Errorf("default 404: %d", rr.Code)
+	}
+
+	// 444
+	st.SetSetting("default_site", "444")
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "nohost.local", "/", nil, nil)
+	if rr.Code != 444 {
+		t.Errorf("default 444: %d", rr.Code)
+	}
+
+	// redirect default
+	st.SetSetting("default_site", "redirect")
+	st.SetSetting("default_site_redirect", "https://def.example")
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "nohost.local", "/", nil, nil)
+	if rr.Code != 302 || !strings.Contains(rr.Header().Get("Location"), "def.example") {
+		t.Errorf("default redirect: %d %s", rr.Code, rr.Header().Get("Location"))
+	}
+
+	// create a redir host
+	rh := store.RedirectionHost{
+		DomainNames:       []string{"redir.example"},
+		ForwardHTTPCode:   301,
+		ForwardScheme:     "https",
+		ForwardDomainName: "target.example",
+		PreservePath:      true,
+		Enabled:           true,
+	}
+	_, _ = st.CreateRedirectionHost(rh)
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "redir.example", "/foo?x=1", nil, nil)
+	if rr.Code != 301 || !strings.Contains(rr.Header().Get("Location"), "https://target.example/foo?x=1") {
+		t.Errorf("redir preserve: %d loc=%s", rr.Code, rr.Header().Get("Location"))
+	}
+
+	// dead host plain
+	dh := store.DeadHost{DomainNames: []string{"dead.example"}, Enabled: true}
+	_, _ = st.CreateDeadHost(dh)
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "dead.example", "/", nil, nil)
+	if rr.Code != 404 || !strings.Contains(rr.Body.String(), "dead/blocked") {
+		t.Errorf("dead plain: %d %s", rr.Code, rr.Body.String())
+	}
+
+	// dead with meta.html
+	dh2 := store.DeadHost{DomainNames: []string{"deadhtml.example"}, Enabled: true, Meta: map[string]any{"html": "<h1>custom dead</h1>"}}
+	_, _ = st.CreateDeadHost(dh2)
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "deadhtml.example", "/", nil, nil)
+	if rr.Code != 404 || !strings.Contains(rr.Body.String(), "custom dead") {
+		t.Errorf("dead meta html: %d %s", rr.Code, rr.Body.String())
+	}
+
+	// custom 404.html file fallback (not just meta)
+	wwwDir := config.Resolve("www")
+	_ = os.MkdirAll(wwwDir, 0o755)
+	_ = os.WriteFile(filepath.Join(wwwDir, "404.html"), []byte("<h1>CUSTOM 404 FILE</h1>"), 0o644)
+	dh3 := store.DeadHost{DomainNames: []string{"deadfile.example"}, Enabled: true}
+	_, _ = st.CreateDeadHost(dh3)
+	eng.ReloadFromStore()
+	rr = doReq(h, "GET", "deadfile.example", "/", nil, nil)
+	if rr.Code != 404 || !strings.Contains(rr.Body.String(), "CUSTOM 404 FILE") {
+		t.Errorf("dead custom 404.html: %d %s", rr.Code, rr.Body.String())
+	}
+}
+
+// TestEngineHandler_ProxyHostBasic + locations + ssl + block + hsts + ws + xforward
+func TestEngineHandler_ProxyBasics(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	// create a simple proxy host (no backend will 502 but we can check early behaviors before proxy)
+	ph := store.ProxyHost{
+		DomainNames:         []string{"proxy.example"},
+		ForwardScheme:       "http",
+		ForwardHost:         "127.0.0.1",
+		ForwardPort:         9, // invalid to not actually connect in test
+		Enabled:             true,
+		SslForced:           true,
+		BlockExploits:       true,
+		HstsEnabled:         true,
+		HstsSubdomains:      true,
+		TrustForwardedProto: true,
+		RequestHeaders:      []store.HeaderRule{{Name: "X-Custom", Value: "reqval"}},
+		ResponseHeaders:     []store.HeaderRule{{Name: "X-Resp", Value: "respval"}},
+		HideHeaders:         []string{"X-HideMe"},
+	}
+	created, _ := st.CreateProxyHost(ph)
+	_ = created
+	eng.ReloadFromStore()
+
+	h := eng.Handler()
+
+	// ssl forced on plain
+	rr := doReq(h, "GET", "proxy.example", "/path", http.Header{"X-Forwarded-Proto": []string{"http"}}, nil)
+	if rr.Code != 301 || !strings.HasPrefix(rr.Header().Get("Location"), "https://") {
+		t.Errorf("ssl_forced: %d %s", rr.Code, rr.Header().Get("Location"))
+	}
+
+	// block exploits - use TLS set on req to bypass ssl_forced redirect (which is before block check)
+	req := httptest.NewRequest("GET", "/.env", nil)
+	req.Host = "proxy.example"
+	req.TLS = &tls.ConnectionState{} // simulate https so no ssl redirect
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if rr.Code != 403 || !strings.Contains(rr.Body.String(), "exploits") {
+		t.Errorf("block_exploits: %d %s", rr.Code, rr.Body.String())
+	}
+
+	// HSTS set on response (simulate https to reach hsts code)
+	req = httptest.NewRequest("GET", "/ok", nil)
+	req.Host = "proxy.example"
+	req.TLS = &tls.ConnectionState{}
+	rr = httptest.NewRecorder()
+	h.ServeHTTP(rr, req)
+	if hs := rr.Header().Get("Strict-Transport-Security"); !strings.Contains(hs, "includeSubDomains") {
+		t.Errorf("hsts not set or missing sub: %q", hs)
+	}
+
+	// X-Forwarded injection happens in director, but since we hit error backend we may not see, test via other means later
+	// for now check advanced req set happens early? but applied in director too.
+}
+
+// Test locations forwardPath rewrite
+func TestEngineHandler_Locations(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	ph := store.ProxyHost{
+		DomainNames:   []string{"loc.example"},
+		ForwardScheme: "http",
+		ForwardHost:   "127.0.0.1",
+		ForwardPort:   80,
+		Enabled:       true,
+		Locations: []store.Location{
+			{Path: "/api", ForwardScheme: "http", ForwardHost: "backend", ForwardPort: 9000, ForwardPath: "/v2"},
+		},
+	}
+	_, _ = st.CreateProxyHost(ph)
+	eng.ReloadFromStore()
+
+	h := eng.Handler()
+	// we can't easily assert the rewritten without real backend or spying, but at least no panic and host match
+	rr := doReq(h, "GET", "loc.example", "/api/foo", nil, nil)
+	// expect 502 from revproxy to bad host, but routing happened
+	if rr.Code == 404 {
+		t.Error("location host not matched, got 404 default")
+	}
+}
+
+// Test access lists IP + basic auth + passauth
+func TestEngineHandler_AccessLists(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	al := store.AccessList{
+		Name:       "acl1",
+		SatisfyAny: false,
+		Clients:    []store.AccessClient{{Address: "10.0.0.0/8", Directive: "allow"}, {Address: "1.2.3.4", Directive: "deny"}},
+		Items:      []store.AccessItem{{Username: "user", Password: "pass"}},
+		PassAuth:   false,
+	}
+	alCreated, _ := st.CreateAccessList(al)
+
+	ph := store.ProxyHost{
+		DomainNames:         []string{"acl.example"},
+		ForwardHost:         "127.0.0.1",
+		ForwardPort:         80,
+		Enabled:             true,
+		AccessListID:        alCreated.ID,
+		TrustForwardedProto: true, // enable XFF for spoof tests in access list (default false would ignore XFF)
+	}
+	_, _ = st.CreateProxyHost(ph)
+
+	// ph with default TrustForwardedProto=false for testing XFF spoof ignored in access + clientIP
+	phNoTrust := store.ProxyHost{
+		DomainNames:  []string{"acl-notrust.example"},
+		ForwardHost:  "127.0.0.1",
+		ForwardPort:  80,
+		Enabled:      true,
+		AccessListID: alCreated.ID,
+		// TrustForwardedProto: false (default) => XFF ignored, use RemoteAddr for access decisions/injection
+	}
+	_, _ = st.CreateProxyHost(phNoTrust)
+	eng.ReloadFromStore()
+
+	h := eng.Handler()
+
+	// deny via explicit deny client (note: 11.x would be allowed under !satisfyAny if no deny hit; use the deny addr)
+	rr := doReq(h, "GET", "acl.example", "/", http.Header{"X-Forwarded-For": []string{"1.2.3.4"}}, nil)
+	if rr.Code != 403 {
+		t.Errorf("access deny exact: %d", rr.Code)
+	}
+
+	// trust=false + spoof XFF (deny addr): should ignore XFF (use Remote which doesn't match deny) => no 403, reaches auth
+	rr = doReq(h, "GET", "acl-notrust.example", "/", http.Header{"X-Forwarded-For": []string{"1.2.3.4"}}, nil)
+	if rr.Code != 401 {
+		t.Errorf("TrustForwardedProto=false should ignore XFF spoof (reaches auth 401); got %d", rr.Code)
+	}
+
+	// allow by cidr via xff
+	rr = doReq(h, "GET", "acl.example", "/", http.Header{"X-Forwarded-For": []string{"10.1.2.3"}}, nil)
+	// will 401 because basic auth required next
+	if rr.Code != 401 {
+		t.Errorf("access allow but no auth expected 401: %d", rr.Code)
+	}
+
+	// basic auth fail
+	rr = doReq(h, "GET", "acl.example", "/", http.Header{
+		"X-Forwarded-For": []string{"10.1.2.3"},
+		"Authorization":   []string{"Basic " + basic("bad", "bad")},
+	}, nil)
+	if rr.Code != 401 {
+		t.Errorf("basic bad: %d", rr.Code)
+	}
+
+	// basic good, passauth false so stripped
+	rr = doReq(h, "GET", "acl.example", "/", http.Header{
+		"X-Forwarded-For": []string{"10.1.2.3"},
+		"Authorization":   []string{"Basic " + basic("user", "pass")},
+	}, nil)
+	if rr.Code == 401 {
+		t.Error("basic good should not 401")
+	}
+	// (502 later ok)
+}
+
+func basic(u, p string) string {
+	return base64.StdEncoding.EncodeToString([]byte(u + ":" + p))
+}
+
+func TestEngineHandler_Caching(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	upstream := NewWhoami(t, WhoamiConfig{
+		DefaultHeaders: map[string]string{
+			"Cache-Control": "max-age=3600",
+			"X-Upstream":    "yes",
+		},
+		Routes: map[string]WhoamiRoute{
+			"/cpath": {Body: "CACHED-BODY-FOR-/cpath"},
+		},
+	})
+	_, _ = st.CreateProxyHost(store.ProxyHost{
+		DomainNames:    []string{"cache.example"},
+		ForwardScheme:  "http",
+		ForwardHost:    upstream.Hostname,
+		ForwardPort:    upstream.Port,
+		Enabled:        true,
+		CachingEnabled: true,
+	})
+	eng.ReloadFromStore()
+	h := eng.Handler()
+
+	rr1 := doReq(h, "GET", "cache.example", "/cpath", nil, nil)
+	if rr1.Code != 200 || !strings.Contains(rr1.Body.String(), "CACHED-BODY") || rr1.Header().Get("X-Proxy-Cache") != "MISS" {
+		t.Errorf("first MISS: code=%d cache=%s body=%s", rr1.Code, rr1.Header().Get("X-Proxy-Cache"), rr1.Body.String())
+	}
+
+	rr2 := doReq(h, "GET", "cache.example", "/cpath", nil, nil)
+	if rr2.Header().Get("X-Proxy-Cache") != "HIT" || rr2.Body.String() != rr1.Body.String() {
+		t.Errorf("second HIT: cache=%s body=%s", rr2.Header().Get("X-Proxy-Cache"), rr2.Body.String())
+	}
+
+	noStore := NewWhoami(t, WhoamiConfig{
+		DefaultHeaders: map[string]string{"Cache-Control": "no-store"},
+		Routes:         map[string]WhoamiRoute{"/p": {Body: "NO-STORE-BODY"}},
+	})
+	_, _ = st.CreateProxyHost(store.ProxyHost{
+		DomainNames:    []string{"cache-nostore.example"},
+		ForwardScheme:  "http",
+		ForwardHost:    noStore.Hostname,
+		ForwardPort:    noStore.Port,
+		Enabled:        true,
+		CachingEnabled: true,
+	})
+	eng.ReloadFromStore()
+	h = eng.Handler()
+
+	rr3 := doReq(h, "GET", "cache-nostore.example", "/p", nil, nil)
+	if rr3.Header().Get("X-Proxy-Cache") != "" {
+		t.Error("no-store should not set X-Proxy-Cache")
+	}
+	rr4 := doReq(h, "GET", "cache-nostore.example", "/p", nil, nil)
+	if rr4.Header().Get("X-Proxy-Cache") == "HIT" {
+		t.Error("no-store response should not have been cached for HIT")
+	}
+
+	eng.ReloadFromStore()
+}
+
+// Test X-Forwarded* injection (respects trust), ws header munging via whoami upstream.
+func TestEngineHandler_ForwardedAndWS(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	up := NewWhoami(t, WhoamiConfig{})
+	_, _ = st.CreateProxyHost(store.ProxyHost{
+		DomainNames:           []string{"fwd.example"},
+		ForwardScheme:         "http",
+		ForwardHost:           up.Hostname,
+		ForwardPort:           up.Port,
+		Enabled:               true,
+		TrustForwardedProto:   true,
+		AllowWebsocketUpgrade: true,
+	})
+	eng.ReloadFromStore()
+	h := eng.Handler()
+
+	hdrs := http.Header{
+		"X-Forwarded-For":   []string{"10.9.8.7"},
+		"X-Forwarded-Proto": []string{"https"},
+		"Connection":        []string{"Upgrade"},
+		"Upgrade":           []string{"websocket"},
+	}
+	rr := doReq(h, "GET", "fwd.example", "/ws", hdrs, nil)
+	if rr.Code != 200 {
+		t.Fatalf("forwarded/ws proxy: code=%d", rr.Code)
+	}
+	got, ok := up.LastRequest()
+	if !ok {
+		t.Fatal("upstream saw no request")
+	}
+	if !strings.Contains(got.HeaderValue("X-Forwarded-For"), "10.9.8.7") || got.HeaderValue("X-Forwarded-Proto") != "https" {
+		t.Errorf("X-Forwarded* injection: ff=%s proto=%s", got.HeaderValue("X-Forwarded-For"), got.HeaderValue("X-Forwarded-Proto"))
+	}
+	if got.HeaderValue("Connection") != "Upgrade" || got.HeaderValue("Upgrade") != "websocket" {
+		t.Errorf("ws munging: conn=%s up=%s", got.HeaderValue("Connection"), got.HeaderValue("Upgrade"))
+	}
+}
+
+// Test ACME challenge serving (before host)
+func TestEngineHandler_ACME(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	h := eng.Handler()
+
+	chDir := config.Resolve("letsencrypt-acme-challenge")
+	acmeFileDir := filepath.Join(chDir, ".well-known", "acme-challenge")
+	_ = os.MkdirAll(acmeFileDir, 0o755)
+	token := "testtoken123"
+	content := "challenge-content-xyz"
+	if err := os.WriteFile(filepath.Join(acmeFileDir, token), []byte(content), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	rr := doReq(h, "GET", "anyhost", "/.well-known/acme-challenge/"+token, nil, nil)
+	if rr.Code != 200 || rr.Body.String() != content {
+		t.Errorf("acme serve: code=%d body=%q", rr.Code, rr.Body.String())
+	}
+
+	rr = doReq(h, "GET", "anyhost", "/.well-known/acme-challenge/missing", nil, nil)
+	if rr.Code != 404 {
+		t.Errorf("acme missing: %d", rr.Code)
+	}
+}
+
+// Test loadCerts / GetCertificate (SNI, compat keys)
+func TestEngine_LoadCertsGetCertificate(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	// create via cert manager's test path (dev mode makes *all* LE certs self-signed test certs)
+	config.ResetForTest()
+	t.Setenv("DATA_DIR", config.DataDir()) // already set in newTest
+	t.Setenv("PROXY_MODE", "development")
+	cm := certificate.NewManager(st)
+	certRec := store.Certificate{
+		Provider:    "letsencrypt",
+		DomainNames: []string{"sni.example"},
+		Meta:        map[string]any{},
+	}
+	created, _ := st.CreateCertificate(certRec)
+	email := cm.GetEmailForCert(created)
+	if err := cm.Issue(created, email); err != nil {
+		t.Fatalf("issue test cert for load: %v", err)
+	}
+	// now attach to host
+	ph := store.ProxyHost{
+		DomainNames:   []string{"sni.example"},
+		ForwardHost:   "127.0.0.1",
+		ForwardPort:   80,
+		Enabled:       true,
+		CertificateID: created.ID,
+	}
+	_, _ = st.CreateProxyHost(ph)
+
+	eng.ReloadFromStore()
+
+	// loadCerts called in reload; should succeed with real PEMs
+	cert, err := eng.GetCertificate(&tls.ClientHelloInfo{ServerName: "sni.example"})
+	if err != nil {
+		t.Fatalf("GetCertificate: %v", err)
+	}
+	if cert == nil {
+		t.Error("nil cert")
+	}
+	// fallback any (there is one now)
+	_, _ = eng.GetCertificate(&tls.ClientHelloInfo{ServerName: "unknown"})
+}
+
+// Test streams reload (at least lifecycle no panic)
+func TestEngine_StreamsReload(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	strm := store.Stream{
+		IncomingPort:   0, // use high? but test may bind fail; use invalid port to just test start path without real listen success
+		ForwardingHost: "127.0.0.1",
+		ForwardingPort: 9,
+		TCPForwarding:  true,
+		Enabled:        true,
+	}
+	// port 0 not good; pick a likely free high port for test? but to avoid bind in CI, just create disabled first
+	strm.IncomingPort = 19999 + (int(time.Now().UnixNano()) % 1000) // somewhat unique
+	_, _ = st.CreateStream(strm)
+	eng.ReloadFromStore()
+	runtime := eng.StreamStatus(strm.IncomingPort)
+	if !runtime.Listening {
+		t.Fatalf("expected stream listening on port %d: %+v", strm.IncomingPort, runtime)
+	}
+	// now disable and reload to exercise cancel path
+	strm.Enabled = false
+	_, _ = st.UpdateStream(strm)
+	eng.ReloadFromStore()
+	// ok if no crash
+}
+
+func TestEngine_StreamListenFailure(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	port := 19800 + (int(time.Now().UnixNano()) % 1000)
+	ln, err := net.Listen("tcp", net.JoinHostPort("127.0.0.1", strconv.Itoa(port)))
+	if err != nil {
+		t.Fatalf("bind probe port: %v", err)
+	}
+	defer ln.Close()
+
+	strm := store.Stream{
+		IncomingPort:   port,
+		ForwardingHost: "127.0.0.1",
+		ForwardingPort: 9,
+		TCPForwarding:  true,
+		Enabled:        true,
+	}
+	_, _ = st.CreateStream(strm)
+	eng.ReloadFromStore()
+
+	runtime := eng.StreamStatus(port)
+	if runtime.Listening {
+		t.Fatal("expected stream not listening when port is taken")
+	}
+	if runtime.ListenError == "" {
+		t.Fatal("expected listen error when port is taken")
+	}
+}
+
+func TestEngine_StreamReloadSamePort(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	port := 19700 + (int(time.Now().UnixNano()) % 1000)
+	strm := store.Stream{
+		IncomingPort:   port,
+		ForwardingHost: "127.0.0.1",
+		ForwardingPort: 9,
+		TCPForwarding:  true,
+		Enabled:        true,
+	}
+	created, _ := st.CreateStream(strm)
+	eng.ReloadFromStore()
+
+	runtime := eng.StreamStatus(port)
+	if !runtime.Listening {
+		t.Fatalf("expected stream listening after initial reload: %+v", runtime)
+	}
+
+	created.ForwardingPort = 10
+	_, _ = st.UpdateStream(created)
+	eng.ReloadFromStore()
+
+	runtime = eng.StreamStatus(port)
+	if !runtime.Listening {
+		t.Fatalf("expected stream still listening after edit reload on same port: %+v", runtime)
+	}
+}
+
+func TestEngine_StreamReloadLeavesOthersRunning(t *testing.T) {
+	eng, st := newTestEngine(t)
+	defer closeStore(st)
+
+	base := 19600 + (int(time.Now().UnixNano()) % 1000)
+	portA := base
+	portB := base + 1
+
+	a, _ := st.CreateStream(store.Stream{
+		IncomingPort: portA, ForwardingHost: "127.0.0.1", ForwardingPort: 9,
+		TCPForwarding: true, Enabled: true,
+	})
+	b, _ := st.CreateStream(store.Stream{
+		IncomingPort: portB, ForwardingHost: "127.0.0.1", ForwardingPort: 9,
+		TCPForwarding: true, Enabled: true,
+	})
+	eng.ReloadFromStore()
+
+	if st := eng.StreamStatus(portA); !st.Listening {
+		t.Fatalf("stream A not listening: %+v", st)
+	}
+	if st := eng.StreamStatus(portB); !st.Listening {
+		t.Fatalf("stream B not listening: %+v", st)
+	}
+
+	a.ForwardingPort = 10
+	_, _ = st.UpdateStream(a)
+	eng.ReloadFromStore()
+
+	if st := eng.StreamStatus(portA); !st.Listening {
+		t.Fatalf("stream A not listening after edit: %+v", st)
+	}
+	if st := eng.StreamStatus(portB); !st.Listening {
+		t.Fatalf("stream B should still be listening after editing A: %+v", st)
+	}
+	_ = b
+}
+
+func TestDuplicateStreamListenPorts(t *testing.T) {
+	desired := map[int]store.Stream{
+		1: {ID: 1, IncomingPort: 9000, TCPForwarding: true},
+		2: {ID: 2, IncomingPort: 9000, TCPForwarding: true},
+		3: {ID: 3, IncomingPort: 9001, TCPForwarding: true},
+	}
+	conflicts := duplicateStreamListenPorts(desired)
+	if len(conflicts) != 2 {
+		t.Fatalf("expected 2 conflicts, got %d: %v", len(conflicts), conflicts)
+	}
+	if conflicts[1] == "" || conflicts[2] == "" {
+		t.Fatalf("expected errors for streams 1 and 2, got %v", conflicts)
+	}
+	if _, ok := conflicts[3]; ok {
+		t.Fatalf("stream 3 should not conflict: %v", conflicts)
+	}
+}
+
+func closeStore(s store.Store) {
+	if c, ok := s.(interface{ Close() error }); ok {
+		c.Close()
+	}
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}