Merge branch 'main' into dependabot/github_actions/github/codeql-action/analyze-4.38.0

Author: garrytrinder

.github/copilot-instructions.md

@@ -6,7 +6,7 @@ Dev Proxy is a cross-platform .NET API simulator and proxy for testing how appli
 
 ## Critical (Non-Obvious)
 
-- **Proxy engine:** Uses [svrooij/unobtanium-web-proxy](https://github.com/svrooij/unobtanium-web-proxy) (fork of Titanium.Web.Proxy)
+- **Proxy engine:** Built on [ASP.NET Core Kestrel](https://learn.microsoft.com/aspnet/core/fundamentals/servers/kestrel) (a custom forward-proxy + MITM engine; see `DevProxy.Proxy.Kestrel`)
 - **Config tokens:** Paths in config files can use `~appFolder` for resolution
 - **MCP Server:** Use [@devproxy/mcp](https://www.npmjs.com/package/@devproxy/mcp) to programmatically retrieve up-to-date docs and JSON schemas
 

.github/policies/dev-proxy-branch-protection.yml

@@ -38,8 +38,8 @@ configuration:
     requiredStatusChecks:
     - CodeQL
     # Require branches to be up to date before merging. boolean
-    requiresStrictStatusChecks: true
+    requiresStrictStatusChecks: false
     # Indicates whether there are restrictions on who can push. boolean. Should be set with whoCanPush.
     restrictsPushes: false
     # Restrict who can dismiss pull request reviews. boolean
-    restrictsReviewDismissals: false
+    restrictsReviewDismissals: false

.github/workflows/create-release.yml

@@ -35,16 +35,16 @@ jobs:
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
-      - name: Rename executable for beta
-        if: contains(github.ref_name, '-beta')
+      - name: Rename executable for prerelease
+        if: contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha')
         run: |
           pushd
           cd ./DevProxy
           $content = Get-Content DevProxy.csproj
           $content -replace '<AssemblyName>devproxy</AssemblyName>', '<AssemblyName>devproxy-beta</AssemblyName>' | Set-Content DevProxy.csproj
           popd
-      - name: Set newVersionNotification for beta
-        if: contains(github.ref_name, '-beta')
+      - name: Set newVersionNotification for prerelease
+        if: contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha')
         run: |
           pushd
           cd ./DevProxy
@@ -138,21 +138,21 @@ jobs:
       - name: Add installer icon
         if: contains(matrix.architecture, 'win-')
         run: |
-          if ('${{ github.ref_name }}'.Contains('beta')) {
+          if ('${{ github.ref_name }}'.Contains('beta') -or '${{ github.ref_name }}'.Contains('alpha')) {
             cp ./media/icon-beta.ico ./${{ env.release }}
           } else {
             cp ./media/icon.ico ./${{ env.release }}
           }
-      - name: Update version in beta installer
-        if: contains(matrix.architecture, 'win-') && contains(github.ref_name, '-beta')
+      - name: Update version in prerelease installer
+        if: contains(matrix.architecture, 'win-') && (contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha'))
         run: |
           $content = Get-Content ./install-beta.iss
           $content -replace '#define MyAppVersion .*', "#define MyAppVersion `"$("${{ github.ref_name }}".Substring(1))`"" | Set-Content ./install-beta.iss
       - name: Set installer file name
         id: installer
         if: contains(matrix.architecture, 'win-')
         run: |
-          if ('${{ github.ref_name }}'.Contains('beta')) {
+          if ('${{ github.ref_name }}'.Contains('beta') -or '${{ github.ref_name }}'.Contains('alpha')) {
               Write-Output "filename=install-beta.iss" >> $env:GITHUB_OUTPUT
           } else {
               Write-Output "filename=install.iss" >> $env:GITHUB_OUTPUT
@@ -247,7 +247,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           DRAFT_RELEASE: "false"
-          PRE_RELEASE: "false"
+          PRE_RELEASE: "${{ contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha') }}"
           CHANGELOG_FILE: "CHANGELOG.md"
           ALLOW_EMPTY_CHANGELOG: "true"
         with:
@@ -289,14 +289,15 @@ jobs:
             latest=false
           tags: |
             type=semver,pattern={{version}}
-            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') }}
+            type=raw,value=latest,enable=${{ !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-alpha') }}
             type=raw,value=beta,enable=${{ contains(github.ref_name, '-beta') }}
+            type=raw,value=alpha,enable=${{ contains(github.ref_name, '-alpha') }}
           labels: |
             org.opencontainers.image.description=${{ env.APP_DESCRIPTION }}
           annotations: |
             org.opencontainers.image.description=${{ env.APP_DESCRIPTION }}
       - name: Build and push Docker image
-        if: "!contains(github.ref_name, '-beta')"
+        if: ${{ !contains(github.ref_name, '-beta') && !contains(github.ref_name, '-alpha') }}
         id: push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
@@ -308,8 +309,8 @@ jobs:
           platforms: linux/amd64,linux/arm64
           build-args: |
             DEVPROXY_VERSION=${{ steps.meta.outputs.version }}
-      - name: Build and push beta Docker image
-        if: contains(github.ref_name, '-beta')
+      - name: Build and push prerelease Docker image
+        if: contains(github.ref_name, '-beta') || contains(github.ref_name, '-alpha')
         id: push_beta
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:

CONTRIBUTING.md

@@ -28,4 +28,4 @@ Typos are embarrassing! Most PRs that fix typos will be accepted immediately. To
 
 ## Our foundation
 
-The Dev Proxy is built with .NET 9 and uses the [Unobtanium Web Proxy](https://github.com/svrooij/unobtanium-web-proxy).
+The Dev Proxy is built with .NET and uses [ASP.NET Core Kestrel](https://learn.microsoft.com/aspnet/core/fundamentals/servers/kestrel) for its forward-proxy engine.

DevProxy.Abstractions.Tests/DevProxy.Abstractions.Tests.csproj

@@ -0,0 +1,24 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+    <!-- Underscored Method_Scenario_Expectation test names are idiomatic; inline literal
+         arrays in assertions are fine in tests. -->
+    <NoWarn>$(NoWarn);CA1707;CA1861</NoWarn>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.12.0" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2" />
+  </ItemGroup>
+
+  <ItemGroup>
+    <ProjectReference Include="..\DevProxy.Abstractions\DevProxy.Abstractions.csproj" />
+  </ItemGroup>
+
+</Project>

DevProxy.Abstractions.Tests/Proxy/Http/ForwardingInvariantsTests.cs

@@ -0,0 +1,32 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using DevProxy.Abstractions.Proxy.Http;
+using Xunit;
+
+namespace DevProxy.Abstractions.Tests.Proxy.Http;
+
+public class ForwardingInvariantsTests
+{
+    [Theory]
+    [InlineData("Connection")]
+    [InlineData("proxy-connection")]
+    [InlineData("KEEP-ALIVE")]
+    [InlineData("Transfer-Encoding")]
+    [InlineData("te")]
+    [InlineData("Trailer")]
+    [InlineData("Upgrade")]
+    [InlineData("Proxy-Authenticate")]
+    [InlineData("Proxy-Authorization")]
+    public void HopByHopHeaders_ContainsExpected_CaseInsensitive(string name) =>
+        Assert.Contains(name, (IReadOnlySet<string>)ForwardingInvariants.HopByHopHeaders);
+
+    [Theory]
+    [InlineData("Content-Type")]
+    [InlineData("Host")]
+    [InlineData("Set-Cookie")]
+    [InlineData("Authorization")]
+    public void HopByHopHeaders_ExcludesEndToEndHeaders(string name) =>
+        Assert.DoesNotContain(name, (IReadOnlySet<string>)ForwardingInvariants.HopByHopHeaders);
+}

DevProxy.Abstractions.Tests/Proxy/Http/HeaderCollectionTests.cs

@@ -0,0 +1,105 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using DevProxy.Abstractions.Proxy.Http;
+using Xunit;
+
+namespace DevProxy.Abstractions.Tests.Proxy.Http;
+
+public class HeaderCollectionTests
+{
+    [Fact]
+    public void Add_PreservesWireOrderAndDuplicates()
+    {
+        var headers = new HeaderCollection();
+        headers.Add("Set-Cookie", "a=1");
+        headers.Add("Set-Cookie", "b=2");
+
+        var all = headers.GetAll("set-cookie").ToList();
+
+        Assert.Equal(2, all.Count);
+        Assert.Equal("a=1", all[0].Value);
+        Assert.Equal("b=2", all[1].Value);
+    }
+
+    [Fact]
+    public void Contains_And_GetFirst_AreCaseInsensitive()
+    {
+        var headers = new HeaderCollection();
+        headers.Add("Content-Type", "application/json");
+
+        Assert.True(headers.Contains("content-type"));
+        Assert.Equal("application/json", headers.GetFirst("CONTENT-TYPE")!.Value);
+    }
+
+    [Fact]
+    public void GetFirst_ReturnsNull_WhenAbsent()
+    {
+        var headers = new HeaderCollection();
+        Assert.Null(headers.GetFirst("X-Missing"));
+        Assert.Empty(headers.GetAll("X-Missing"));
+    }
+
+    [Fact]
+    public void Replace_CollapsesDuplicatesToSingleValue()
+    {
+        var headers = new HeaderCollection();
+        headers.Add("X-Test", "old1");
+        headers.Add("X-Test", "old2");
+
+        headers.Replace("x-test", "new");
+
+        var all = headers.GetAll("X-Test").ToList();
+        Assert.Single(all);
+        Assert.Equal("new", all[0].Value);
+    }
+
+    [Fact]
+    public void Replace_AddsWhenAbsent()
+    {
+        var headers = new HeaderCollection();
+        headers.Replace("X-New", "value");
+        Assert.Equal("value", headers.GetFirst("X-New")!.Value);
+    }
+
+    [Fact]
+    public void Remove_RemovesAllOccurrences_AndReportsResult()
+    {
+        var headers = new HeaderCollection();
+        headers.Add("X-Dup", "1");
+        headers.Add("X-Dup", "2");
+
+        Assert.True(headers.Remove("x-dup"));
+        Assert.Equal(0, headers.Count);
+        Assert.False(headers.Remove("x-dup"));
+    }
+
+    [Fact]
+    public void AddRange_And_Linq_Work()
+    {
+        var headers = new HeaderCollection(new[]
+        {
+            new HttpHeader("A", "1"),
+            new HttpHeader("B", "2"),
+        });
+        headers.AddRange(new[] { new HttpHeader("C", "3") });
+
+        Assert.Equal(3, headers.Count);
+        Assert.Contains(headers, h => h.Name == "C");
+        Assert.Equal("1", headers.First(h => h.Name == "A").Value);
+    }
+
+    [Fact]
+    public void SeedingConstructor_PreservesOrder()
+    {
+        var headers = new HeaderCollection(new[]
+        {
+            new HttpHeader("First", "1"),
+            new HttpHeader("Second", "2"),
+        });
+
+        var names = headers.Select(h => h.Name).ToList();
+        Assert.Equal(new[] { "First", "Second" }, names);
+    }
+}

DevProxy.Abstractions.Tests/Proxy/RootTrustPolicyTests.cs

@@ -0,0 +1,99 @@
+// Licensed to the .NET Foundation under one or more agreements.
+// The .NET Foundation licenses this file to you under the MIT license.
+// See the LICENSE file in the project root for more information.
+
+using DevProxy.Abstractions.Proxy;
+using Xunit;
+
+namespace DevProxy.Abstractions.Tests.Proxy;
+
+public class RootTrustPolicyTests
+{
+    // ── installCert gate ────────────────────────────────────────────────
+    [Theory]
+    [InlineData(true, false)]   // mac
+    [InlineData(false, true)]   // windows
+    [InlineData(false, false)]  // linux
+    public void Decide_InstallCertFalse_AlwaysSkips(bool isMac, bool isWindows)
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac, isWindows, installCert: false, noFirstRun: false, isFirstRun: true, firstRunAnswer: "y");
+
+        Assert.Equal(RootTrustAction.Skip, action);
+    }
+
+    // ── Windows ─────────────────────────────────────────────────────────
+    [Theory]
+    [InlineData(true, false)]   // first run, ignored on Windows
+    [InlineData(false, true)]   // noFirstRun, ignored on Windows
+    public void Decide_Windows_InstallCert_AlwaysTrustsStore(bool isFirstRun, bool noFirstRun)
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: false, isWindows: true, installCert: true, noFirstRun: noFirstRun, isFirstRun: isFirstRun, firstRunAnswer: null);
+
+        Assert.Equal(RootTrustAction.TrustWindowsStore, action);
+    }
+
+    // ── macOS first-run flow ────────────────────────────────────────────
+    [Fact]
+    public void Decide_Mac_FirstRun_EmptyAnswer_Trusts()
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: true, isWindows: false, installCert: true, noFirstRun: false, isFirstRun: true, firstRunAnswer: "");
+
+        Assert.Equal(RootTrustAction.TrustMacKeychain, action);
+    }
+
+    [Theory]
+    [InlineData("y")]
+    [InlineData("Y")]
+    [InlineData("yes")]
+    [InlineData("anything")]
+    public void Decide_Mac_FirstRun_NonNoAnswer_Trusts(string answer)
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: true, isWindows: false, installCert: true, noFirstRun: false, isFirstRun: true, firstRunAnswer: answer);
+
+        Assert.Equal(RootTrustAction.TrustMacKeychain, action);
+    }
+
+    [Theory]
+    [InlineData("n")]
+    [InlineData("N")]
+    [InlineData(" n ")]
+    public void Decide_Mac_FirstRun_AnswerNo_Skips(string answer)
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: true, isWindows: false, installCert: true, noFirstRun: false, isFirstRun: true, firstRunAnswer: answer);
+
+        Assert.Equal(RootTrustAction.Skip, action);
+    }
+
+    [Fact]
+    public void Decide_Mac_NotFirstRun_Skips()
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: true, isWindows: false, installCert: true, noFirstRun: false, isFirstRun: false, firstRunAnswer: "y");
+
+        Assert.Equal(RootTrustAction.Skip, action);
+    }
+
+    [Fact]
+    public void Decide_Mac_NoFirstRun_Skips()
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: true, isWindows: false, installCert: true, noFirstRun: true, isFirstRun: true, firstRunAnswer: "y");
+
+        Assert.Equal(RootTrustAction.Skip, action);
+    }
+
+    // ── Linux ───────────────────────────────────────────────────────────
+    [Fact]
+    public void Decide_Linux_InstallCert_IsManual()
+    {
+        var action = RootTrustPolicy.Decide(
+            isMac: false, isWindows: false, installCert: true, noFirstRun: false, isFirstRun: true, firstRunAnswer: "y");
+
+        Assert.Equal(RootTrustAction.ManualLinux, action);
+    }
+}