file_upload.cpp

/*
     This file is part of libhttpserver
     Copyright (C) 2011-2019 Sebastiano Merlino

     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Lesser General Public
     License as published by the Free Software Foundation; either
     version 2.1 of the License, or (at your option) any later version.

     This library is distributed in the hope that it will be useful,
     but WITHOUT ANY WARRANTY; without even the implied warranty of
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
     Lesser General Public License for more details.

     You should have received a copy of the GNU Lesser General Public
     License along with this library; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301
     USA
*/

#include <curl/curl.h>
#include <sys/stat.h>
#ifdef _WIN32
#include <direct.h>
#define MKDIR(path) _mkdir(path)
#else
#include <unistd.h>  // unlink/rmdir; previously reachable transitively via <httpserver.hpp> -> <sys/socket.h>
#define MKDIR(path) mkdir(path, 0755)
#endif
#include <cassert>
#include <cstddef>
#include <cstdio>
#include <fstream>
#include <map>
#include <memory>
#include <random>
#include <sstream>
#include <stdexcept>
#include <string>
#include <tuple>
#include <utility>
#include <vector>

#include "./httpserver.hpp"
#include "httpserver/string_utilities.hpp"
#include "./littletest.hpp"
#include "./test_utils.hpp"

using std::string;
using std::string_view;
using std::map;
using std::shared_ptr;
using std::vector;
using std::stringstream;

using httpserver::http_resource;
using httpserver::http_request;
using httpserver::http_response;
using httpserver::webserver;
using httpserver::create_webserver;
using httpserver::http::arg_map;

#define STR2(p) #p
#define STR(p) STR2(p)

#ifdef HTTPSERVER_DATA_ROOT
#define ROOT STR(HTTPSERVER_DATA_ROOT)
#else
#define ROOT "."
#endif  // HTTPSERVER_DATA_ROOT

static const char* TEST_CONTENT_FILENAME = "test_content";
static const char* TEST_CONTENT_FILEPATH = ROOT "/test_content";
static const char* FILENAME_IN_GET_CONTENT = "filename=\"test_content\"";
static const char* TEST_CONTENT = "test content of file\n";
static const char* TEST_KEY = "file";
static size_t TEST_CONTENT_SIZE = 21;

static const char* TEST_CONTENT_FILENAME_2 = "test_content_2";
static const char* TEST_CONTENT_FILEPATH_2 = ROOT "/test_content_2";
static const char* FILENAME_IN_GET_CONTENT_2 = "filename=\"test_content_2\"";
static const char* TEST_CONTENT_2 = "test content of second file\n";
static const char* TEST_KEY_2 = "file2";
static size_t TEST_CONTENT_SIZE_2 = 28;

static const char* TEST_PARAM_KEY = "param_key";
static const char* TEST_PARAM_VALUE = "Value of test param";

// The large file test_content_large is large enough to ensure
// that MHD splits the underlying request into several chunks.
static const char* LARGE_FILENAME_IN_GET_CONTENT = "filename=\"test_content_large\"";
static const char* LARGE_CONTENT_FILEPATH = ROOT "/test_content_large";
static const char* LARGE_KEY = "large_file";

static bool file_exists(const string &path) {
    struct stat sb;

    return (stat(path.c_str(), &sb) == 0);
}

static std::pair<CURLcode, int32_t> send_file_to_webserver(int port, bool add_second_file, bool append_parameters) {
    curl_global_init(CURL_GLOBAL_ALL);

    CURL *curl = curl_easy_init();

    curl_mime *form = curl_mime_init(curl);
    curl_mimepart *field = curl_mime_addpart(form);
    curl_mime_name(field, TEST_KEY);
    curl_mime_filedata(field, TEST_CONTENT_FILEPATH);
    if (add_second_file) {
        field = curl_mime_addpart(form);
        curl_mime_name(field, TEST_KEY_2);
        curl_mime_filedata(field, TEST_CONTENT_FILEPATH_2);
    }

    if (append_parameters) {
        field = curl_mime_addpart(form);
        curl_mime_name(field, TEST_PARAM_KEY);
        curl_mime_data(field, TEST_PARAM_VALUE, CURL_ZERO_TERMINATED);
    }

    CURLcode res;
    const std::string url = "localhost:" + std::to_string(port) + "/upload";
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);

    res = curl_easy_perform(curl);
    long http_code = 0;   // NOLINT [runtime/int]
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);

    curl_easy_cleanup(curl);
    curl_mime_free(form);
    return {res, http_code};
}

// Send file with explicit content-type and transfer-encoding headers
static std::pair<CURLcode, int32_t> send_file_with_content_type(int port, const char* content_type) {
    curl_global_init(CURL_GLOBAL_ALL);

    CURL *curl = curl_easy_init();

    curl_mime *form = curl_mime_init(curl);
    curl_mimepart *field = curl_mime_addpart(form);
    curl_mime_name(field, TEST_KEY);
    curl_mime_filedata(field, TEST_CONTENT_FILEPATH);
    // Set explicit content-type for the file part
    curl_mime_type(field, content_type);
    // Add transfer-encoding header
    struct curl_slist *headers = nullptr;
    headers = curl_slist_append(headers, "Content-Transfer-Encoding: binary");
    curl_mime_headers(field, headers, 1);  // 1 means take ownership

    CURLcode res;
    std::string url = "localhost:" + std::to_string(port) + "/upload";
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);

    res = curl_easy_perform(curl);
    long http_code = 0;   // NOLINT [runtime/int]
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);

    curl_easy_cleanup(curl);
    curl_mime_free(form);
    return {res, http_code};
}

static std::pair<CURLcode, int32_t> send_large_file(int port, string* content, std::string args = "") {
    // Generate a large (100K) file of random bytes. Upload the file with
    // a curl request, then delete the file. The default chunk size of MHD
    // appears to be around 16K, so 100K should be enough to trigger the
    // behavior. Return the content via the pointer parameter so that test
    // cases can make required checks for the content.
    curl_global_init(CURL_GLOBAL_ALL);

    CURL *curl = curl_easy_init();

    curl_mime *form = curl_mime_init(curl);
    curl_mimepart *field = curl_mime_addpart(form);

    std::ifstream infile(LARGE_CONTENT_FILEPATH);
    std::stringstream buffer;
    buffer << infile.rdbuf();
    infile.close();
    *content = buffer.str();

    curl_mime_name(field, LARGE_KEY);
    curl_mime_filedata(field, LARGE_CONTENT_FILEPATH);

    std::string url = "localhost:" + std::to_string(port) + "/upload";
    if (!args.empty()) {
        url.append(args);
    }
    CURLcode res;
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);

    res = curl_easy_perform(curl);
    long http_code = 0;   // NOLINT [runtime/int]
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);

    curl_easy_cleanup(curl);
    curl_mime_free(form);

    return {res, http_code};
}

static std::tuple<bool, CURLcode, int32_t> send_file_via_put(int port) {
    curl_global_init(CURL_GLOBAL_ALL);

    CURL *curl;
    CURLcode res;
    struct stat file_info;
    FILE *fd;

    fd = fopen(TEST_CONTENT_FILEPATH, "rb");
    if (!fd) {
        return {false, CURLcode{}, 0L};
    }

    if (fstat(fileno(fd), &file_info) != 0) {
        return {false, CURLcode{}, 0L};
    }

    curl = curl_easy_init();
    if (!curl) {
        fclose(fd);
        return {false, CURLcode{}, 0L};
    }

    const std::string url = "localhost:" + std::to_string(port) + "/upload";
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
    curl_easy_setopt(curl, CURLOPT_READDATA, fd);
    curl_easy_setopt(curl, CURLOPT_INFILESIZE_LARGE, (curl_off_t) file_info.st_size);

    res = curl_easy_perform(curl);
    long http_code = 0;   // NOLINT [runtime/int]
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);

    curl_easy_cleanup(curl);

    fclose(fd);

    return {true, res, http_code};
}

class print_file_upload_resource : public http_resource {
 public:
     http_response render_post(const http_request& req) {
         content = req.get_content();
         // get_args() returns a const& -- read-only iteration
         // here, so bind by const reference. The body still copies into the
         // owning `args` member because req goes out of scope after render.
         const auto& args_view = req.get_args();
         for (auto const& item : args_view) {
            for (auto const & value : item.second.get_all_values()) {
                args[string(item.first)].push_back(string(value));
            }
         }
         // Deliberate copy: req goes out of scope after render() returns,
         // so we snapshot the file table into the resource's owning member.
         files = req.get_files();
         return http_response::string("OK").with_status(201);
     }

     http_response render_put(const http_request& req) {
         content = req.get_content();
         const auto& args_view = req.get_args();
         for (auto const& item : args_view) {
            for (auto const & value : item.second.get_all_values()) {
                args[string(item.first)].push_back(string(value));
            }
         }
         // Deliberate copy: req goes out of scope after render() returns,
         // so we snapshot the file table into the resource's owning member.
         files = req.get_files();
         return http_response::string("OK");
     }

     const std::map<string, std::vector<string>, httpserver::http::arg_comparator> get_args() const {
         return args;
     }

     const map<string, map<string, httpserver::http::file_info>> get_files() const {
          return files;
     }

     const string get_content() const {
         return content;
     }

 private:
     std::map<std::string, std::vector<std::string>, httpserver::http::arg_comparator> args;
     map<string, map<string, httpserver::http::file_info>> files;
     string content;
};

// Raw multipart bytes preserve the missing name attribute; curl_mime would
// supply a name and conceal this malformed-input regression.
// libcurl requires long for POSTFIELDSIZE and the response-code output.
static std::pair<CURLcode, long> send_raw_multipart(int port, const string& body) {  // NOLINT(runtime/int)
    CURL* curl = curl_easy_init();
    const string url = "http://127.0.0.1:" + std::to_string(port) + "/anything";
    curl_slist* headers = curl_slist_append(nullptr,
        "Content-Type: multipart/form-data; boundary=BOUNDARY");
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_HTTPHEADER, headers);
    curl_easy_setopt(curl, CURLOPT_POSTFIELDS, body.data());
    curl_easy_setopt(curl, CURLOPT_POSTFIELDSIZE, static_cast<long>(body.size()));  // NOLINT(runtime/int)
    curl_easy_setopt(curl, CURLOPT_TIMEOUT, 5L);
    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION,
        +[](char*, size_t size, size_t count, void*) -> size_t { return size * count; });
    const CURLcode result = curl_easy_perform(curl);
    long status = 0;  // NOLINT(runtime/int)
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &status);
    curl_easy_cleanup(curl);
    curl_slist_free_all(headers);
    return {result, status};
}

LT_BEGIN_SUITE(file_upload_suite)
    void set_up() {
    }

    void tear_down() {
    }
LT_END_SUITE(file_upload_suite)

LT_BEGIN_AUTO_TEST(file_upload_suite, check_files)
  std::ifstream it;
  it.open(TEST_CONTENT_FILEPATH);
  LT_CHECK_EQ(it.is_open(), true);

  it.open(TEST_CONTENT_FILEPATH_2);
  LT_CHECK_EQ(it.is_open(), true);

  it.open(LARGE_CONTENT_FILEPATH);
  LT_CHECK_EQ(it.is_open(), true);
LT_END_AUTO_TEST(check_files)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_and_disk)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_AND_DISK)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_CONTENT) != string::npos, true);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 1);
    auto arg = args.begin();
    LT_CHECK_EQ(arg->first, TEST_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, map<string, httpserver::http::file_info>>::iterator file_key = files.begin();
    LT_CHECK_EQ(file_key->first, TEST_KEY);
    LT_CHECK_EQ(file_key->second.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = file_key->second.begin();
    LT_CHECK_EQ(file->first, TEST_CONTENT_FILENAME);
    LT_CHECK_EQ(file->second.get_file_size(), TEST_CONTENT_SIZE);
    LT_CHECK_EQ(file->second.get_content_type(), httpserver::http::http_utils::application_octet_stream);

    string expected_filename = upload_directory +
                               httpserver::http::http_utils::path_separator +
                               httpserver::http::http_utils::upload_filename_template;
    LT_CHECK_EQ(file->second.get_file_system_file_name().substr(0, file->second.get_file_system_file_name().size() - 6),
                expected_filename.substr(0, expected_filename.size() - 6));
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_upload_memory_and_disk)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_and_disk_via_put)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_AND_DISK)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto ret = send_file_via_put(port);
    LT_CHECK_EQ(std::get<1>(ret), 0);
    LT_CHECK_EQ(std::get<2>(ret), 200);
    LT_ASSERT_EQ(std::get<0>(ret), true);

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content, TEST_CONTENT);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 0);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 0);

    ws->stop();
LT_END_AUTO_TEST(file_upload_memory_and_disk_via_put)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_and_disk_additional_params)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_AND_DISK)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, true);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_PARAM_KEY) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_PARAM_VALUE) != string::npos, true);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 2);
    auto arg = args.begin();
    LT_CHECK_EQ(arg->first, TEST_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT);
    arg++;
    LT_CHECK_EQ(arg->first, TEST_PARAM_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_PARAM_VALUE);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, map<string, httpserver::http::file_info>>::iterator file_key = files.begin();
    LT_CHECK_EQ(file_key->first, TEST_KEY);
    LT_CHECK_EQ(file_key->second.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = file_key->second.begin();
    LT_CHECK_EQ(file->first, TEST_CONTENT_FILENAME);
    LT_CHECK_EQ(file->second.get_file_size(), TEST_CONTENT_SIZE);
    LT_CHECK_EQ(file->second.get_content_type(), httpserver::http::http_utils::application_octet_stream);

    string expected_filename = upload_directory +
                               httpserver::http::http_utils::path_separator +
                               httpserver::http::http_utils::upload_filename_template;
    LT_CHECK_EQ(file->second.get_file_system_file_name().substr(0, file->second.get_file_system_file_name().size() - 6),
                expected_filename.substr(0, expected_filename.size() - 6));
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_upload_memory_and_disk_additional_params)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_and_disk_two_files)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_AND_DISK)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, true, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(FILENAME_IN_GET_CONTENT_2) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_CONTENT_2) != string::npos, true);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 2);
    auto arg = args.begin();
    LT_CHECK_EQ(arg->first, TEST_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT);
    arg++;
    LT_CHECK_EQ(arg->first, TEST_KEY_2);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT_2);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 2);
    map<string, map<string, httpserver::http::file_info>>::iterator file_key = files.begin();
    LT_CHECK_EQ(file_key->first, TEST_KEY);
    LT_CHECK_EQ(file_key->second.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = file_key->second.begin();
    LT_CHECK_EQ(file->first, TEST_CONTENT_FILENAME);
    LT_CHECK_EQ(file->second.get_file_size(), TEST_CONTENT_SIZE);
    LT_CHECK_EQ(file->second.get_content_type(), httpserver::http::http_utils::application_octet_stream);

    string expected_filename = upload_directory +
                               httpserver::http::http_utils::path_separator +
                               httpserver::http::http_utils::upload_filename_template;
    LT_CHECK_EQ(file->second.get_file_system_file_name().substr(0, file->second.get_file_system_file_name().size() - 6),
                expected_filename.substr(0, expected_filename.size() - 6));
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);

    file_key++;
    LT_CHECK_EQ(file_key->first, TEST_KEY_2);
    LT_CHECK_EQ(file_key->second.size(), 1);
    file = file_key->second.begin();
    LT_CHECK_EQ(file->first, TEST_CONTENT_FILENAME_2);
    LT_CHECK_EQ(file->second.get_file_size(), TEST_CONTENT_SIZE_2);
    LT_CHECK_EQ(file->second.get_content_type(), httpserver::http::http_utils::application_octet_stream);

    expected_filename = upload_directory +
                               httpserver::http::http_utils::path_separator +
                               httpserver::http::http_utils::upload_filename_template;
    LT_CHECK_EQ(file->second.get_file_system_file_name().substr(0, file->second.get_file_system_file_name().size() - 6),
                expected_filename.substr(0, expected_filename.size() - 6));
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_upload_memory_and_disk_two_files)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_disk_only)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content(false)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.size(), 0);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 0);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, map<string, httpserver::http::file_info>>::iterator file_key = files.begin();
    LT_CHECK_EQ(file_key->first, TEST_KEY);
    LT_CHECK_EQ(file_key->second.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = file_key->second.begin();
    LT_CHECK_EQ(file->first, TEST_CONTENT_FILENAME);
    LT_CHECK_EQ(file->second.get_file_size(), TEST_CONTENT_SIZE);
    LT_CHECK_EQ(file->second.get_content_type(), httpserver::http::http_utils::application_octet_stream);

    string expected_filename = upload_directory +
                               httpserver::http::http_utils::path_separator +
                               httpserver::http::http_utils::upload_filename_template;
    LT_CHECK_EQ(file->second.get_file_system_file_name().substr(0, file->second.get_file_system_file_name().size() - 6),
                expected_filename.substr(0, expected_filename.size() - 6));
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_upload_disk_only)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_only_incl_content)
    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_ONLY));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(TEST_CONTENT) != string::npos, true);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 1);
    auto arg = args.begin();
    LT_CHECK_EQ(arg->first, TEST_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(resource->get_files().size(), 0);

    ws->stop();
LT_END_AUTO_TEST(file_upload_memory_only_incl_content)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_large_content)
    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_ONLY));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Upload a large file to trigger the chunking behavior of MHD.
    std::string file_content;
    auto res = send_large_file(port, &file_content);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(LARGE_FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(file_content) != string::npos, true);

    // The chunks of the file should be concatenated into the first
    // arg value of the key.
    auto const args = resource->get_args();
    LT_CHECK_EQ(args.size(), 1);
    auto const file_arg_iter = args.find(std::string_view(LARGE_KEY));
    if (file_arg_iter == args.end()) {
        LT_FAIL("file arg not found");
    }
    LT_CHECK_EQ(file_arg_iter->second.size(), 1);
    LT_CHECK_EQ(file_arg_iter->second[0], file_content);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(resource->get_files().size(), 0);

    ws->stop();
LT_END_AUTO_TEST(file_upload_large_content)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_large_content_with_args)
    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content()
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_ONLY));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Upload a large file to trigger the chunking behavior of MHD.
    // Include some additional args to make sure those are processed as well.
    std::string file_content;
    auto res = send_large_file(port, &file_content, "?arg1=hello&arg1=world");
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.find(LARGE_FILENAME_IN_GET_CONTENT) != string::npos, true);
    LT_CHECK_EQ(actual_content.find(file_content) != string::npos, true);

    auto const args = resource->get_args();
    LT_CHECK_EQ(args.size(), 2);
    auto const file_arg_iter = args.find(std::string_view(LARGE_KEY));
    if (file_arg_iter == args.end()) {
        LT_FAIL("file arg not found");
    }
    LT_CHECK_EQ(file_arg_iter->second.size(), 1);
    LT_CHECK_EQ(file_arg_iter->second[0], file_content);
    auto const other_arg_iter = args.find(std::string_view("arg1"));
    if (other_arg_iter == args.end()) {
        LT_FAIL("other arg(s) not found");
    }
    LT_CHECK_EQ(other_arg_iter->second.size(), 2);
    LT_CHECK_EQ(other_arg_iter->second[0], "hello");
    LT_CHECK_EQ(other_arg_iter->second[1], "world");

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(resource->get_files().size(), 0);

    ws->stop();
LT_END_AUTO_TEST(file_upload_large_content_with_args)

LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_memory_only_excl_content)
    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .put_processed_data_to_content(false)
                       .file_upload_target(httpserver::FILE_UPLOAD_MEMORY_ONLY));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    string actual_content = resource->get_content();
    LT_CHECK_EQ(actual_content.size(), 0);

    auto args = resource->get_args();
    LT_CHECK_EQ(args.size(), 1);
    auto arg = args.begin();
    LT_CHECK_EQ(arg->first, TEST_KEY);
    LT_CHECK_EQ(arg->second[0], TEST_CONTENT);

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 0);

    ws->stop();
LT_END_AUTO_TEST(file_upload_memory_only_excl_content)

// Test that file cleanup callback returning true causes file deletion (default behavior)
LT_BEGIN_AUTO_TEST(file_upload_suite, file_cleanup_callback_returns_true)
    string upload_directory = ".";

    // Track callback invocations
    std::vector<std::tuple<string, string, size_t>> callback_invocations;

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload()
                       .file_cleanup_callback([&callback_invocations](
                           const std::string& key,
                           const std::string& filename,
                           const httpserver::http::file_info& info) {
                           callback_invocations.push_back({key, filename, info.get_file_size()});
                           return true;  // Delete the file
                       }));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    // Verify callback was called with correct parameters
    LT_CHECK_EQ(callback_invocations.size(), 1);
    LT_CHECK_EQ(std::get<0>(callback_invocations[0]), TEST_KEY);
    LT_CHECK_EQ(std::get<1>(callback_invocations[0]), TEST_CONTENT_FILENAME);
    LT_CHECK_EQ(std::get<2>(callback_invocations[0]), TEST_CONTENT_SIZE);

    // Verify file was deleted (callback returned true)
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = files.begin()->second.begin();
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_cleanup_callback_returns_true)

// Test that file cleanup callback returning false keeps the file
LT_BEGIN_AUTO_TEST(file_upload_suite, file_cleanup_callback_returns_false)
    string upload_directory = ".";
    string kept_file_path;

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload()
                       .file_cleanup_callback([&kept_file_path](
                           const std::string& key,
                           const std::string& filename,
                           const httpserver::http::file_info& info) {
                           (void)key;
                           (void)filename;
                           kept_file_path = info.get_file_system_file_name();
                           return false;  // Keep the file
                       }));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    // Verify file still exists (callback returned false)
    LT_CHECK_EQ(file_exists(kept_file_path), true);

    // Cleanup: manually delete the file
    remove(kept_file_path.c_str());
    LT_CHECK_EQ(file_exists(kept_file_path), false);
LT_END_AUTO_TEST(file_cleanup_callback_returns_false)

// Test selective cleanup: callback can keep some files and delete others
LT_BEGIN_AUTO_TEST(file_upload_suite, file_cleanup_callback_selective)
    string upload_directory = ".";
    string kept_file_path;

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload()
                       .file_cleanup_callback([&kept_file_path](
                           const std::string& key,
                           const std::string& filename,
                           const httpserver::http::file_info& info) {
                           (void)filename;
                           // Keep first file, delete second
                           if (key == TEST_KEY) {
                               kept_file_path = info.get_file_system_file_name();
                               return false;  // Keep
                           }
                           return true;  // Delete
                       }));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Upload two files
    auto res = send_file_to_webserver(port, true, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 2);

    // First file should exist (callback returned false)
    LT_CHECK_EQ(file_exists(kept_file_path), true);

    // Second file should be deleted (callback returned true)
    auto file_key_2 = files.find(TEST_KEY_2);
    LT_ASSERT_EQ(file_key_2 != files.end(), true);
    string deleted_file_path = file_key_2->second.begin()->second.get_file_system_file_name();
    LT_CHECK_EQ(file_exists(deleted_file_path), false);

    // Cleanup: manually delete the kept file
    remove(kept_file_path.c_str());
LT_END_AUTO_TEST(file_cleanup_callback_selective)

// Test that exception in callback defaults to deleting the file
LT_BEGIN_AUTO_TEST(file_upload_suite, file_cleanup_callback_throws)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload()
                       .file_cleanup_callback([](
                           const std::string& key,
                           const std::string& filename,
                           const httpserver::http::file_info& info) -> bool {
                           (void)key;
                           (void)filename;
                           (void)info;
                           throw std::runtime_error("Test exception");
                       }));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    // Verify file was deleted (exception causes default delete behavior)
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = files.begin()->second.begin();
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_cleanup_callback_throws)

// Test that no callback defaults to deleting files (backward compatibility)
LT_BEGIN_AUTO_TEST(file_upload_suite, file_cleanup_no_callback_deletes)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    // No file_cleanup_callback set
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    ws->stop();

    // Verify file was deleted (default behavior)
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = files.begin()->second.begin();
    LT_CHECK_EQ(file_exists(file->second.get_file_system_file_name()), false);
LT_END_AUTO_TEST(file_cleanup_no_callback_deletes)

// Test file upload keeping original filename (without random generation)
LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_original_filename)
    // Use a subdirectory to avoid overwriting the test input file
    string upload_directory = "upload_test_dir";
    MKDIR(upload_directory.c_str());

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory));
    // Note: NOT using generate_random_filename_on_upload()
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    auto res = send_file_to_webserver(port, false, false);
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    // Verify file was created with original name
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    map<string, httpserver::http::file_info>::iterator file = files.begin()->second.begin();
    // The filename should be upload_directory/test_content (the original name)
    string expected_path = upload_directory + "/" + TEST_CONTENT_FILENAME;
    LT_CHECK_EQ(file->second.get_file_system_file_name(), expected_path);

    ws->stop();

    // Clean up the file and directory
    unlink(expected_path.c_str());
    rmdir(upload_directory.c_str());
LT_END_AUTO_TEST(file_upload_original_filename)

// Test file upload with explicit content-type header
// This exercises the content_type != nullptr branch in webserver.cpp post_iterator
LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_with_content_type)
    string upload_directory = ".";

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory)
                       .generate_random_filename_on_upload());
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Send file with explicit content-type "text/plain"
    auto res = send_file_with_content_type(port, "text/plain");
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    // Verify file_info has the correct content-type
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    auto file_key = files.find(TEST_KEY);
    LT_CHECK_EQ(file_key != files.end(), true);
    auto file = file_key->second.begin();
    // The content-type should be what we set
    LT_CHECK_EQ(file->second.get_content_type(), "text/plain");

    // Clean up the uploaded file
    unlink(file->second.get_file_system_file_name().c_str());

    ws->stop();
LT_END_AUTO_TEST(file_upload_with_content_type)

// Send file with a crafted filename for path traversal testing
static std::pair<CURLcode, int32_t> send_file_with_traversal_name(int port, const char* crafted_filename) {
    curl_global_init(CURL_GLOBAL_ALL);

    CURL *curl = curl_easy_init();

    curl_mime *form = curl_mime_init(curl);
    curl_mimepart *field = curl_mime_addpart(form);
    curl_mime_name(field, TEST_KEY);
    // Use the real file for data, but override the filename
    curl_mime_filedata(field, TEST_CONTENT_FILEPATH);
    curl_mime_filename(field, crafted_filename);

    CURLcode res;
    std::string url = "localhost:" + std::to_string(port) + "/upload";
    curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
    curl_easy_setopt(curl, CURLOPT_MIMEPOST, form);

    res = curl_easy_perform(curl);
    long http_code = 0;   // NOLINT [runtime/int]
    curl_easy_getinfo(curl, CURLINFO_RESPONSE_CODE, &http_code);

    curl_easy_cleanup(curl);
    curl_mime_free(form);
    return {res, http_code};
}

// Test that path traversal filenames are rejected
LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_path_traversal_rejected)
    string upload_directory = "upload_test_dir";
    MKDIR(upload_directory.c_str());

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory));
    // NOT using generate_random_filename_on_upload - this is the vulnerable path
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Attempt path traversal with "../escape"
    send_file_with_traversal_name(port, "../escape");
    // The server should reject the upload (MHD_NO causes connection close)
    // The key check is that no file was created outside the upload dir
    LT_CHECK_EQ(file_exists("escape"), false);
    LT_CHECK_EQ(file_exists("./escape"), false);

    ws->stop();

    // Clean up
    rmdir(upload_directory.c_str());
LT_END_AUTO_TEST(file_upload_path_traversal_rejected)

// Test that sanitize keeps the basename for normal filenames
LT_BEGIN_AUTO_TEST(file_upload_suite, file_upload_sanitize_keeps_basename)
    string upload_directory = "upload_test_dir";
    MKDIR(upload_directory.c_str());

    auto ws = std::make_unique<webserver>(create_webserver(0)
                       .file_upload_target(httpserver::FILE_UPLOAD_DISK_ONLY)
                       .file_upload_dir(upload_directory));
    ws->start(false);
    LT_CHECK_EQ(ws->is_running(), true);
    const uint16_t port = ws->get_bound_port();

    auto resource = std::make_shared<print_file_upload_resource>();
    ws->register_path("upload", resource);

    // Upload with a path-like filename — should strip to just "myfile.txt"
    auto res = send_file_with_traversal_name(port, "some/path/myfile.txt");
    LT_ASSERT_EQ(res.first, 0);
    LT_ASSERT_EQ(res.second, 201);

    // The file should be created with only the basename
    map<string, map<string, httpserver::http::file_info>> files = resource->get_files();
    LT_CHECK_EQ(files.size(), 1);
    auto file = files.begin()->second.begin();
    string expected_path = upload_directory + "/myfile.txt";
    LT_CHECK_EQ(file->second.get_file_system_file_name(), expected_path);

    ws->stop();

    // Clean up
    unlink(expected_path.c_str());
    rmdir(upload_directory.c_str());
LT_END_AUTO_TEST(file_upload_sanitize_keeps_basename)

LT_BEGIN_AUTO_TEST(file_upload_suite, unnamed_multipart_file_keeps_server_alive)
    curl_global_init(CURL_GLOBAL_ALL);
    webserver ws{create_webserver(0)};
    ws.on_get("/hello", [](const http_request&) {
        return http_response::string("hello");
    });
    ws.start(false);
    LT_CHECK_EQ(ws.is_running(), true);
    const int port = ws.get_bound_port();
    for (const char* disposition : {"filename=\"x\"", "filename=\"\"",
                                    "name=\"f\"; filename=\"x\""}) {
        const string body = string("--BOUNDARY\r\nContent-Disposition: form-data; ")
            + disposition + "\r\n\r\ndata\r\n--BOUNDARY--\r\n";
        const auto result = send_raw_multipart(port, body);
        LT_CHECK_EQ(result.first, CURLE_OK);
        LT_CHECK_EQ(result.second, 404L);
        // A second HTTP request proves the daemon still handles connections.
        const auto followup = send_raw_multipart(port,
            "--BOUNDARY\r\nContent-Disposition: form-data; name=\"f\"\r\n"
            "\r\nok\r\n--BOUNDARY--\r\n");
        LT_CHECK_EQ(followup.first, CURLE_OK);
        LT_CHECK_EQ(followup.second, 404L);
    }
    ws.stop();
    curl_global_cleanup();
LT_END_AUTO_TEST(unnamed_multipart_file_keeps_server_alive)

LT_BEGIN_AUTO_TEST_ENV()
    AUTORUN_TESTS()
LT_END_AUTO_TEST_ENV()