AWS SDK

rev. 5268f3bc6a0eb20fb020dfdb4b4f92f6181f2eed

Files changed:

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/common/h2.rs

@@ -65,65 +124,125 @@

-65
 #[derive(Clone, Copy, Debug, Eq, Hash, Ord, PartialEq, PartialOrd)]
 pub(crate) struct H2ConnectionId(u64);
-68
 #[derive(Clone, Debug, Eq, PartialEq)]
 pub(crate) enum H2Event {
     TcpAccepted {
         connection_id: H2ConnectionId,
         peer_addr: SocketAddr,
     },
     TlsNegotiated {
         connection_id: H2ConnectionId,
         alpn: Option<Vec<u8>>,
     },
     TlsHandshakeAbandoned {
         connection_id: H2ConnectionId,
         error: String,
     },
     H2HandshakeAbandoned {
         connection_id: H2ConnectionId,

         error: String,
     },
     H2Ready {
         connection_id: H2ConnectionId,
     },
     StreamAccepted {
         connection_id: H2ConnectionId,
         stream_id: u32,
         method: Method,
         path: String,
         proxy_authorization: Option<String>,
     },
     ResponseCompleted {
         connection_id: H2ConnectionId,
         stream_id: u32,
     },
     ResetSent {
         connection_id: H2ConnectionId,
         stream_id: u32,
         reason: Reason,
     },

↧ Expand context

     ClientResetObserved {
         connection_id: H2ConnectionId,
         stream_id: u32,
         reason: Reason,
     },
     GoAwaySent {
         connection_id: H2ConnectionId,
         last_stream_id: u32,
         reason: Reason,
     },
     ConnectionClosed {
         connection_id: H2ConnectionId,
         reason: ConnectionCloseReason,
     },
-120
+}
-121
 #[derive(Clone, Debug)]
 pub(crate) enum H2BodyPlan {
     Complete(Bytes),
     Gated {

@@ -384,385 +444,446 @@

↥ Expand context

         connection_id: H2ConnectionId,
     ) -> Option<mpsc::UnboundedSender<ConnectionCommand>> {
         self.controls
             .lock()
             .unwrap_or_else(|err| err.into_inner())
             .get(&connection_id)
             .cloned()
-392
+    }
-393
+}
-394
 #[derive(Debug)]
 enum ConnectionCommand {
     GracefulShutdown(oneshot::Sender<()>),
-398
+}
-399
 #[derive(Debug, Default)]
 pub(crate) struct H2ServerBuilder {
     connections: Option<H2ConnectionPlan>,
-403
+}
-404

 impl H2ServerBuilder {
     pub(crate) fn connections(mut self, connections: H2ConnectionPlan) -> Self {
         self.connections = Some(connections);
         self
-409
+    }
-410
     pub(crate) async fn start(self) -> Result<H2TestServer, H2HarnessError> {
         let connections = self
             .connections
             .ok_or_else(|| H2HarnessError::new("an H2 connection plan is required"))?;
         let tls_acceptor = tls::server_tls_acceptor(&[b"h2"])
         let tls_acceptor = tls::SERVER_IDENTITY
             .acceptor(&[b"h2"])
             .map_err(|err| H2HarnessError::new(format!("failed to configure TLS: {err}")))?;
         let listener = TcpListener::bind("127.0.0.1:0")
             .await
             .map_err(|err| H2HarnessError::new(format!("failed to bind H2 listener: {err}")))?;
         let listen_addr = listener.local_addr().map_err(|err| {
             H2HarnessError::new(format!("failed to read H2 listener address: {err}"))
         })?;
         let state = Arc::new(SharedState::new());
         let (shutdown, shutdown_rx) = watch::channel(false);
         let listener_state = state.clone();

↧ Expand context

         let listener_task = tokio::spawn(run_listener(
             listener,
             tls_acceptor,
             connections,
             listener_state,
             shutdown_rx,
         ));
-434
         Ok(H2TestServer {
             listen_addr,
             state,
             shutdown,
             listener_task: Some(listener_task),
         })
-441
+    }
-442
+}
-443
 #[derive(Debug)]
 pub(crate) struct H2TestServer {
     listen_addr: SocketAddr,

@@ -739,741 +803,810 @@

↥ Expand context

     let mut graceful_shutdown = script.goaway_on_ready;
     let mut control_open = true;
     // Tracks whether the connection ended because the client closed it (accept returned None)
     // vs. a scripted GOAWAY completing.
     let mut client_initiated_close = false;
-746
     loop {
         tokio::select! {
             changed = shutdown.changed(), if !shutting_down => {
                 if changed.is_err() || *shutdown.borrow() {
                     shutting_down = true;
                     connection.abrupt_shutdown(Reason::NO_ERROR);
-753
+                }
-754
+            }
             command = control.recv(), if control_open => {
                 match command {
                     Some(ConnectionCommand::GracefulShutdown(acknowledged)) => {
                         graceful_shutdown = true;
                         connection.graceful_shutdown();
                         let _ = acknowledged.send(());

-761
+                    }
                     None => control_open = false,
-763
+                }
-764
+            }
             accepted = connection.accept() => {
                 match accepted {
                     Some(Ok((request, mut respond))) => {
                         let stream_id = respond.stream_id().as_u32();
                         let method = request.method().clone();
                         let path = request.uri().path().to_string();
                         let proxy_authorization = request
                             .headers()
                             .get(http_1x::header::PROXY_AUTHORIZATION)
                             .map(|value| value.to_str().unwrap_or_default().to_string());
                         state.record_event(H2Event::StreamAccepted {
                             connection_id,
                             stream_id,
                             method,
                             path: path.clone(),
                             proxy_authorization,
                         });
                         let Some(stream_script) = script.script_for(&path) else {
                             respond.send_reset(Reason::PROTOCOL_ERROR);
                             return Err(H2HarnessError::new(format!(
                                 "connection {connection_id:?} received unscripted H2 path {path:?}"
                             )));
                         };
                         let held_request = match &stream_script {
                             H2StreamScript::RespondBeforeReceivingRequestBody { receive, .. } => {
                                 Some((request.into_body(), receive.clone()))

↧ Expand context

-791
+                            }
                             _ => {
                                 drop(request);
                                 None
-795
+                            }
                         };
                         // Most scripts cover the response side only. Dropping their
                         // `RecvStream` marks the stream as no longer receiving: h2
                         // then discards incoming DATA without charging the stream
                         // window and releases connection capacity, so a client
                         // streaming a request body runs to completion.
                         //
                         // A lifetime contract may retain a pending request body
                         // behind a gate without reading DATA. General request-body
                         // scripts must drive `RecvStream` and call
                         // `release_capacity()` as chunks are consumed.
                         stream_tasks.spawn(run_stream(
                             connection_id,
                             stream_id,
                             stream_script,

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/common/proxy.rs

@@ -0,1 +0,480 @@

 /*
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-+
 //! HTTP proxy and tunneled-origin support for integration tests.
-+
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 use aws_smithy_runtime_api::client::dns::{DnsFuture, ResolveDns, ResolveDnsError};
 use base64::Engine;
 use http_1x::{Request, Response, StatusCode};
 use hyper::body::Incoming;
 use hyper::service::service_fn;
 use hyper_util::rt::TokioIo;
 use std::collections::HashMap;
 use std::convert::Infallible;
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 use std::net::IpAddr;
 use std::net::SocketAddr;
 use std::sync::{Arc, Mutex};
 use tokio::net::TcpListener;
 use tokio::sync::oneshot;
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use http_body_util::Full;
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use hyper::body::Bytes;
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use tokio::io::copy_bidirectional;
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use tokio::net::TcpStream;
-+
 /// One request observed by a test server.
 #[derive(Clone, Debug)]
 pub(crate) struct RecordedRequest {
     pub(crate) method: String,
     pub(crate) uri: String,
     pub(crate) headers: HashMap<String, String>,
-+
+}
-+
 impl RecordedRequest {
     fn from_request(request: &Request<Incoming>) -> Self {
         Self {
             method: request.method().to_string(),
             uri: request.uri().to_string(),
             headers: request
                 .headers()
                 .iter()
                 .map(|(name, value)| {
-+
+                    (
                         name.to_string(),
                         value.to_str().unwrap_or_default().to_string(),
-+
+                    )
                 })
                 .collect(),
-+
+        }
-+
+    }
-+
+}
-+
 /// DNS resolver that maps one expected hostname to a test server.
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 #[derive(Clone, Debug)]
 pub(crate) struct RecordingDnsResolver {
     hostname: String,
     address: IpAddr,
     lookups: Arc<Mutex<Vec<String>>>,
-+
+}
-+
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 impl RecordingDnsResolver {
     fn new(hostname: impl Into<String>, address: IpAddr) -> Self {
         Self {
             hostname: hostname.into(),
             address,
             lookups: Arc::new(Mutex::new(Vec::new())),
-+
+        }
-+
+    }
-+
     pub(crate) fn lookups(&self) -> Vec<String> {
         self.lookups
             .lock()
             .expect("DNS lookup log is not poisoned")
             .clone()
-+
+    }
-+
+}
-+
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 impl ResolveDns for RecordingDnsResolver {
     fn resolve_dns<'a>(&'a self, name: &'a str) -> DnsFuture<'a> {
         self.lookups
             .lock()
             .expect("DNS lookup log is not poisoned")
             .push(name.to_string());
         if name == self.hostname {
             DnsFuture::ready(Ok(vec![self.address]))
         } else {
             DnsFuture::ready(Err(ResolveDnsError::new(std::io::Error::other(format!(
                 "unexpected DNS lookup for {name}"
             )))))
-+
+        }
-+
+    }
-+
+}
-+
 /// HTTP/1 server used as either a forward proxy or a direct origin.
 #[derive(Debug)]
 pub(crate) struct MockHttpServer {
     connections: Arc<()>,
     addr: SocketAddr,
     shutdown: Option<oneshot::Sender<()>>,
     requests: Arc<Mutex<Vec<RecordedRequest>>>,
-+
+}
-+
 impl MockHttpServer {
     pub(crate) async fn new<F>(handler: F) -> Self
     where
         F: Fn(RecordedRequest) -> Response<String> + Send + Sync + 'static,
-+
+    {
         let listener = TcpListener::bind("127.0.0.1:0")
             .await
             .expect("test server should bind");
         let addr = listener.local_addr().expect("listener has an address");
         let (shutdown, mut shutdown_rx) = oneshot::channel();
         let requests = Arc::new(Mutex::new(Vec::new()));
         let server_requests = requests.clone();
         let connections = Arc::new(());
         let server_connections = connections.clone();
         let handler = Arc::new(handler);
-+
         tokio::spawn(async move {
             loop {
                 tokio::select! {
                     accepted = listener.accept() => {
                         let Ok((stream, _)) = accepted else {
                             break;
                         };
                         let handler = handler.clone();
                         let requests = server_requests.clone();
                         let connection = server_connections.clone();
                         tokio::spawn(async move {
                             let _connection = connection;
                             let service = service_fn(move |request: Request<Incoming>| {
                                 let handler = handler.clone();
                                 let requests = requests.clone();
                                 async move {
                                     let request = RecordedRequest::from_request(&request);
                                     requests
                                         .lock()
                                         .expect("request log is not poisoned")
                                         .push(request.clone());
                                     Ok::<_, Infallible>(handler(request))
-+
+                                }
                             });
                             if let Err(error) = hyper::server::conn::http1::Builder::new()
                                 .serve_connection(TokioIo::new(stream), service)
                                 .await
-+
+                            {
                                 tracing::debug!(%error, "test HTTP server connection ended");
-+
+                            }
                         });
-+
+                    }
                     _ = &mut shutdown_rx => break,
-+
+                }
-+
+            }
         });
-+
         Self {
             connections,
             addr,
             shutdown: Some(shutdown),
             requests,
-+
+        }
-+
+    }
-+
     pub(crate) async fn with_response(status: StatusCode, body: &str) -> Self {
         let body = body.to_string();
         Self::new(move |_| {
             Response::builder()
                 .status(status)
                 .body(body.clone())
                 .expect("valid response")
         })
         .await
-+
+    }
-+
     pub(crate) async fn with_auth_validation(user: &str, password: &str) -> Self {
         let expected = basic_authorization(user, password);
         Self::new(move |request| {
             if request.headers.get("proxy-authorization") == Some(&expected) {
                 Response::builder()
                     .status(StatusCode::OK)
                     .body("authenticated".to_string())
                     .expect("valid response")
             } else {
                 Response::builder()
                     .status(StatusCode::PROXY_AUTHENTICATION_REQUIRED)
                     .header("proxy-authenticate", "Basic realm=\"proxy\"")
                     .body("authentication required".to_string())
                     .expect("valid response")
-+
+            }
         })
         .await
-+
+    }
-+
     pub(crate) fn addr(&self) -> SocketAddr {
         self.addr
-+
+    }
-+
     #[cfg(any(
         feature = "rustls-aws-lc",
         feature = "rustls-aws-lc-fips",
         feature = "rustls-ring",
         feature = "s2n-tls"
     ))]
     pub(crate) fn dns_resolver(&self, hostname: impl Into<String>) -> RecordingDnsResolver {
         RecordingDnsResolver::new(hostname, self.addr.ip())
-+
+    }
-+
     pub(crate) fn requests(&self) -> Vec<RecordedRequest> {
         self.requests
             .lock()
             .expect("request log is not poisoned")
             .clone()
-+
+    }
-+
     pub(crate) fn connection_count(&self) -> usize {
         // The server and this handle each retain one reference.
         Arc::strong_count(&self.connections)
             .checked_sub(2)
             .expect("server references remain")
-+
+    }
-+
+}
-+
 impl Drop for MockHttpServer {
     fn drop(&mut self) {
         if let Some(shutdown) = self.shutdown.take() {
             let _ = shutdown.send(());
-+
+        }
-+
+    }
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 #[derive(Debug)]
 pub(crate) struct MockConnectProxy {
     addr: SocketAddr,
     shutdown: Option<oneshot::Sender<()>>,
     requests: Arc<Mutex<Vec<RecordedRequest>>>,
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 impl MockConnectProxy {
     /// Starts a proxy that accepts CONNECT and relays bytes to one fixed origin.
     pub(crate) async fn relay_to(
         origin: SocketAddr,
         expected_authorization: Option<String>,
     ) -> Self {
         let listener = TcpListener::bind("127.0.0.1:0")
             .await
             .expect("CONNECT proxy should bind");
         let addr = listener.local_addr().expect("listener has an address");
         let (shutdown, mut shutdown_rx) = oneshot::channel();
         let requests = Arc::new(Mutex::new(Vec::new()));
         let server_requests = requests.clone();
-+
         tokio::spawn(async move {
             loop {
                 tokio::select! {
                     accepted = listener.accept() => {
                         let Ok((stream, _)) = accepted else {
                             break;
                         };
                         let requests = server_requests.clone();
                         let expected_authorization = expected_authorization.clone();
                         tokio::spawn(async move {
                             let service = service_fn(move |mut request: Request<Incoming>| {
                                 let requests = requests.clone();
                                 let expected_authorization = expected_authorization.clone();
                                 async move {
                                     let recorded = RecordedRequest::from_request(&request);
                                     requests
                                         .lock()
                                         .expect("request log is not poisoned")
                                         .push(recorded.clone());
-+
                                     if recorded.method != "CONNECT" {
                                         return Ok::<_, Infallible>(empty_response(
                                             StatusCode::METHOD_NOT_ALLOWED,
                                         ));
-+
+                                    }
                                     if expected_authorization.as_ref()
                                         != recorded.headers.get("proxy-authorization")
-+
+                                    {
                                         return Ok(empty_response(
                                             StatusCode::PROXY_AUTHENTICATION_REQUIRED,
                                         ));
-+
+                                    }
-+
                                     let upgraded = hyper::upgrade::on(&mut request);
                                     tokio::spawn(async move {
                                         let Ok(upgraded) = upgraded.await else {
                                             return;
                                         };
                                         let Ok(mut upstream) = TcpStream::connect(origin).await else {
                                             return;
                                         };
                                         let mut downstream = TokioIo::new(upgraded);
                                         let _ = copy_bidirectional(&mut downstream, &mut upstream).await;
                                     });
-+
                                     Ok(empty_response(StatusCode::OK))
-+
+                                }
                             });
                             let connection = hyper::server::conn::http1::Builder::new()
                                 .serve_connection(TokioIo::new(stream), service)
                                 .with_upgrades();
                             if let Err(error) = connection.await {
                                 tracing::debug!(%error, "CONNECT proxy connection ended");
-+
+                            }
                         });
-+
+                    }
                     _ = &mut shutdown_rx => break,
-+
+                }
-+
+            }
         });
-+
         Self {
             addr,
             shutdown: Some(shutdown),
             requests,
-+
+        }
-+
+    }
-+
     pub(crate) fn addr(&self) -> SocketAddr {
         self.addr
-+
+    }
-+
     pub(crate) fn requests(&self) -> Vec<RecordedRequest> {
         self.requests
             .lock()
             .expect("request log is not poisoned")
             .clone()
-+
+    }
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 impl Drop for MockConnectProxy {
     fn drop(&mut self) {
         if let Some(shutdown) = self.shutdown.take() {
             let _ = shutdown.send(());
-+
+        }
-+
+    }
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 #[derive(Debug)]
 pub(crate) struct MockTlsOrigin {
     addr: SocketAddr,
     shutdown: Option<oneshot::Sender<()>>,
     requests: Arc<Mutex<Vec<RecordedRequest>>>,
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 impl MockTlsOrigin {
     pub(crate) async fn new(body: &str) -> Self {
         let listener = TcpListener::bind("127.0.0.1:0")
             .await
             .expect("TLS origin should bind");
         let addr = listener.local_addr().expect("listener has an address");
         let acceptor = super::tls::SERVER_IDENTITY
             .acceptor(&[b"http/1.1"])
             .expect("test TLS configuration should load");
         let (shutdown, mut shutdown_rx) = oneshot::channel();
         let requests = Arc::new(Mutex::new(Vec::new()));
         let server_requests = requests.clone();
         let body = body.to_string();
-+
         tokio::spawn(async move {
             loop {
                 tokio::select! {
                     accepted = listener.accept() => {
                         let Ok((stream, _)) = accepted else {
                             break;
                         };
                         let acceptor = acceptor.clone();
                         let requests = server_requests.clone();
                         let body = body.clone();
                         tokio::spawn(async move {
                             let Ok(stream) = acceptor.accept(stream).await else {
                                 return;
                             };
                             let service = service_fn(move |request: Request<Incoming>| {
                                 let requests = requests.clone();
                                 let body = body.clone();
                                 async move {
                                     requests
                                         .lock()
                                         .expect("request log is not poisoned")
                                         .push(RecordedRequest::from_request(&request));
                                     Ok::<_, Infallible>(Response::new(Full::new(Bytes::from(body))))
-+
+                                }
                             });
                             if let Err(error) = hyper::server::conn::http1::Builder::new()
                                 .serve_connection(TokioIo::new(stream), service)
                                 .await
-+
+                            {
                                 tracing::debug!(%error, "TLS origin connection ended");
-+
+                            }
                         });
-+
+                    }
                     _ = &mut shutdown_rx => break,
-+
+                }
-+
+            }
         });
-+
         Self {
             addr,
             shutdown: Some(shutdown),
             requests,
-+
+        }
-+
+    }
-+
     pub(crate) fn addr(&self) -> SocketAddr {
         self.addr
-+
+    }
-+
     pub(crate) fn requests(&self) -> Vec<RecordedRequest> {
         self.requests
             .lock()
             .expect("request log is not poisoned")
             .clone()
-+
+    }
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 impl Drop for MockTlsOrigin {
     fn drop(&mut self) {
         if let Some(shutdown) = self.shutdown.take() {
             let _ = shutdown.send(());
-+
+        }
-+
+    }
-+
+}
-+
 pub(crate) fn basic_authorization(user: &str, password: &str) -> String {
     format!(
         "Basic {}",
         base64::prelude::BASE64_STANDARD.encode(format!("{user}:{password}"))
-+
+    )
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 fn empty_response(status: StatusCode) -> Response<Full<Bytes>> {
     Response::builder()
         .status(status)
         .body(Full::default())
         .expect("valid response")
-+
+}

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/common/tls.rs

@@ -1,1 +68,93 @@

 /*
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-5
 //! TLS setup shared by integration-test servers and clients.
 //! TLS identity and configuration shared by integration tests.
-7
 use aws_smithy_http_client::tls::{TlsContext, TrustStore};
 use aws_smithy_http_client::tls::{TlsContext, TlsContextBuilder, TrustStore};
 use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 use std::fs;
 use std::io;
 use std::sync::Arc;
 use tokio_rustls::{rustls, rustls::ServerConfig, TlsAcceptor};
-14
 const SERVER_CERT_PATH: &str = "tests/server.pem";
 const SERVER_KEY_PATH: &str = "tests/server.rsa";
 /// PEM-backed identity used by integration-test TLS servers.
 ///
 /// The certificate contains `localhost` and `sdktest.com` as subject
 /// alternative names.
 pub(crate) const SERVER_IDENTITY: TestTlsIdentity =
     TestTlsIdentity::from_pem("tests/server.pem", "tests/server.rsa");
-21
 pub(crate) fn server_tls_acceptor(alpn_protocols: &[&[u8]]) -> io::Result<TlsAcceptor> {
     // Set the process-wide crypto provider used by the test server.
     let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
 /// Certificate and private-key material for one test TLS identity.
 #[derive(Clone, Copy, Debug)]
 pub(crate) struct TestTlsIdentity {
     certificate_path: &'static str,
     private_key_path: &'static str,
-+
+}
-28
     let certs = load_certs(SERVER_CERT_PATH)?;
     let key = load_private_key(SERVER_KEY_PATH)?;
     let mut server_config = ServerConfig::builder()
         .with_no_client_auth()
         .with_single_cert(certs, key)
         .map_err(|err| error(err.to_string()))?;
     server_config.alpn_protocols = alpn_protocols
         .iter()
         .map(|protocol| protocol.to_vec())
         .collect();
 impl TestTlsIdentity {
     const fn from_pem(certificate_path: &'static str, private_key_path: &'static str) -> Self {
         Self {
             certificate_path,
             private_key_path,
-+
+        }
-+
+    }
-36
     Ok(TlsAcceptor::from(Arc::new(server_config)))
--
+}
     /// Builds a server acceptor using this identity and ALPN protocol list.
     pub(crate) fn acceptor(&self, alpn_protocols: &[&[u8]]) -> io::Result<TlsAcceptor> {
         // The test server uses one process-wide rustls crypto provider.
         let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
-41
 pub(crate) fn server_tls_context() -> TlsContext {
     TlsContext::builder()
         .with_trust_store(server_trust_store())
         .build()
         .expect("failed to build TlsContext with test server certificate")
--
+}
         let certs = load_certs(self.certificate_path)?;
         let key = load_private_key(self.private_key_path)?;
         let mut server_config = ServerConfig::builder()
             .with_no_client_auth()
             .with_single_cert(certs, key)
             .map_err(|err| error(err.to_string()))?;
         server_config.alpn_protocols = alpn_protocols
             .iter()
             .map(|protocol| protocol.to_vec())
             .collect();
-+
         Ok(TlsAcceptor::from(Arc::new(server_config)))
-+
+    }
-+
     /// Returns a client TLS context builder that trusts this identity.
     pub(crate) fn client_context_builder(&self) -> TlsContextBuilder {
         TlsContext::builder().with_trust_store(self.trust_store())
-+
+    }
-+
     /// Builds a client TLS context that trusts this identity.
     pub(crate) fn client_context(&self) -> TlsContext {
         self.client_context_builder()
             .build()
             .expect("test TLS identity produces a valid client context")
-+
+    }
-67
 /// A [`TrustStore`] containing only the test server certificate.
 pub(crate) fn server_trust_store() -> TrustStore {
     let pem_contents =
         fs::read(SERVER_CERT_PATH).expect("failed to read server certificate for test TLS context");
     TrustStore::empty().with_pem_certificate(pem_contents)
     fn trust_store(&self) -> TrustStore {
         let pem_contents =
             fs::read(self.certificate_path).expect("failed to read test TLS identity certificate");
         TrustStore::empty().with_pem_certificate(pem_contents)
-+
+    }
-73
+}
-74
 fn error(err: String) -> io::Error {
     io::Error::other(err)
-77
+}
-78
 fn load_certs(filename: &str) -> io::Result<Vec<CertificateDer<'static>>> {
     let certfile = fs::File::open(filename)
         .map_err(|err| error(format!("failed to open {filename}: {err}")))?;
     let mut reader = io::BufReader::new(certfile);

↧ Expand context

     rustls_pemfile::certs(&mut reader).collect()
-84
+}
-85
 fn load_private_key(filename: &str) -> io::Result<PrivateKeyDer<'static>> {
     let keyfile = fs::File::open(filename)
         .map_err(|err| error(format!("failed to open {filename}: {err}")))?;
     let mut reader = io::BufReader::new(keyfile);
-90
     rustls_pemfile::private_key(&mut reader)
         .map(|key| key.expect("no private key found in PEM file"))
-93
+}

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/connection_pool_test.rs

@@ -16,16 +75,108 @@

↥ Expand context

     pub(crate) mod client;
-17
+}
-18
 use aws_smithy_http_client::pool::{
     Client, ConnectionPool, ConnectionReuseScope, Partition, PartitionId, TokioDriverSpawner,
 };
 use aws_smithy_http_client::test_util::wire::connection::{
     BodyPlan, ConnectionCloseReason, ConnectionEvent, ConnectionTestHarness, EndpointPlan,
     Http1Response, Http1Script, ManualGate,
 };
 use aws_smithy_runtime_api::client::http::{SharedHttpClient, SharedHttpConnector};
 use aws_smithy_runtime_api::client::orchestrator::HttpRequest;
 use common::client as test_client;
 use std::net::{IpAddr, Ipv4Addr};
 use std::time::Duration;
-31
 const IP1: IpAddr = IpAddr::V4(Ipv4Addr::LOCALHOST);
-33
 /// Resolves one declared partition through the public Smithy client boundary.
 fn shared_client(pool: &ConnectionPool, partition: PartitionId) -> SharedHttpClient {

     SharedHttpClient::new(
         Client::from_partition(pool, partition).expect("declared partition should resolve"),
-38
+    )
-39
+}
-40
 /// Builds an operation connector with the shared test runtime components.
 fn connector(client: &SharedHttpClient) -> SharedHttpConnector {
     test_client::connector(client)
-44
+}
-45
 #[tokio::test]
 async fn custom_dns_resolver_is_used_for_explicit_partition_connections() {
     const HOST: &str = "partition-dns.test";
-+
     let harness = ConnectionTestHarness::builder()
         .endpoint(
             IP1,
             Http1Script::responses([Http1Response::ok().body("custom dns")]),
-+
+        )
         .dns(HOST, [IP1])
         .build()
         .await
         .expect("harness should start");
     let partition = PartitionId::from_index(1);
     let pool = ConnectionPool::builder()
         .partitions([Partition::new(partition, TokioDriverSpawner::current())])
         .dns_resolver(harness.dns_resolver())
         .build_http()
         .expect("valid pool");
     let client = shared_client(&pool, partition);
     let connector = connector(&client);
     let url = format!("http://{HOST}:{}/custom-dns", harness.port());
-+
     let (status, body) = test_client::get_and_collect(&connector, &url).await;
     assert_eq!((status, body.as_slice()), (200, b"custom dns".as_slice()));
     assert_eq!(1, harness.dns_lookup_count());
-+
     drop(connector);
     drop(client);
     drop(pool);
     harness.shutdown().await.expect("clean harness shutdown");
-+
+}
-+
 #[tokio::test]
 async fn bounded_waiter_proceeds_after_the_active_h1_returns() {
     let body_gate = ManualGate::new();
     let harness = ConnectionTestHarness::builder()
         .endpoint(
             IP1,
             Http1Script::responses([
                 Http1Response::ok().body_plan(BodyPlan::split_at_gate(
                     "first-",
                     body_gate.waiter(),

↧ Expand context

                     "body",
                 )),
                 Http1Response::ok().body("second"),
             ]),
-93
+        )
         .build()
         .await
         .expect("harness should start");
     let pool = ConnectionPool::builder()
         .max_connections_per_host(1)
         .build_http()
         .expect("valid pool");
     let client = SharedHttpClient::new(Client::new(&pool).expect("anonymous partition"));
     let connector = connector(&client);
-103
     let first = test_client::send_request(
         &connector,
         HttpRequest::get(harness.endpoint_url()).expect("valid request"),
-107
+    )
     .await

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/h1_connection_behavior_test.rs

@@ -1,1 +114,85 @@

↥ Expand context

 /*
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-5
 //! HTTP/1.1 connection behavior contracts for Smithy HTTP client implementations.
 //!
 //! Covers connection reuse and lifecycle, request routing, connection metadata, failure and
 //! timeout classification, HTTP semantics that affect reusability, concurrency, and DNS
 //! resolution.
 //!
 //! Each contract has an implementation-neutral scenario followed by an explicit test runner for
 //! every backend that must satisfy it.
 //!
 //! A contract function without a corresponding runner becomes dead code, and CI builds
 //! with `RUSTFLAGS: -D warnings` turn that into a compile error. This makes orphaned
 //! contracts self-detecting without a test registry. Macros are deliberately avoided so
 //! that each runner is independently discoverable by IDEs and `--exact` filtering.
-19
 #![cfg(all(feature = "wire-mock", feature = "default-client"))]

-21
 // This inline module form selectively includes only the `client` submodule from
 // `tests/common/`. Using `mod common;` (which goes through `common/mod.rs`) would
 // also pull in the `h2` and `tls` submodules, generating dead-code warnings under
 // `--all-features` since those modules contain items only the h2 and TLS tests use.
 mod common {
     pub(crate) mod client;
-28
+}
-29
 use aws_smithy_async::assert_elapsed;
 use aws_smithy_http_client::pool::{Client as PoolClient, ConnectionPool};
 use aws_smithy_http_client::test_util::wire::connection::{
     BodyPlan, ConnectionCloseReason, ConnectionEvent, ConnectionId, ConnectionScript,
     ConnectionTestHarness, EndpointPlan, HarnessError, Http1Response, Http1Script, ManualGate,
     SocketScript,
 };
 use aws_smithy_http_client::Builder;
 use aws_smithy_runtime_api::client::connection::{
     CaptureSmithyConnection, ConnectionMetadata as SmithyConnectionMetadata,
 };
 use aws_smithy_runtime_api::client::http::{
     HttpConnectorSettings, SharedHttpClient, SharedHttpConnector,
 };
 use aws_smithy_runtime_api::client::orchestrator::HttpRequest;
 use aws_smithy_types::body::SdkBody;
 use aws_smithy_types::retry::ErrorKind;
 use common::client as test_client;
 use common::client::{BackendConfig, HyperUtilLegacyPool};
 use common::client::{
     BackendConfig, HttpClientBackend, HyperUtilLegacyPool, PartitionedConnectionPool,
 };
 use http_body_util::BodyExt;
 use std::collections::HashSet;
 use std::net::{IpAddr, Ipv4Addr};
 use std::time::Duration;
-53
 const IP1: IpAddr = IpAddr::V4(Ipv4Addr::LOCALHOST);
-55
 trait HttpClientBackend {
     fn build(&self, config: BackendConfig) -> SharedHttpClient;
--
+}
--
 impl HttpClientBackend for HyperUtilLegacyPool {
     fn build(&self, config: BackendConfig) -> SharedHttpClient {
         let mut builder = Builder::new();
         if let Some(pool_idle_timeout) = config.pool_idle_timeout {
             builder = builder.pool_idle_timeout(pool_idle_timeout);
--
+        }
         builder.build_http()
--
+    }
--
+}
--
 #[derive(Clone, Copy, Debug)]
 struct PartitionedConnectionPool;
--
 impl HttpClientBackend for PartitionedConnectionPool {
     fn build(&self, config: BackendConfig) -> SharedHttpClient {
         let mut builder = ConnectionPool::builder();
         if let Some(pool_idle_timeout) = config.pool_idle_timeout {
             builder = builder.idle_timeout(pool_idle_timeout);
--
+        }
         let pool = builder.build_http().expect("valid connection-pool config");
         let client = PoolClient::new(&pool).expect("anonymous partition exists");
         SharedHttpClient::new(client)
--
+    }
--
+}
--
 fn request_with_body(url: &str, body: &[u8]) -> HttpRequest {
     let mut request = HttpRequest::new(SdkBody::from(body.to_vec()));
     request.set_method("POST").expect("valid HTTP method");
     request.set_uri(url).expect("valid HTTP URI");
     request
         .headers_mut()
         .insert("content-length", body.len().to_string());
     request
-64
+}
-65

↧ Expand context

 async fn get_and_collect_with_capture(
     connector: &SharedHttpConnector,
     url: &str,
 ) -> (u16, Vec<u8>, SmithyConnectionMetadata) {
     let capture = CaptureSmithyConnection::new();
     let mut request = HttpRequest::get(url).expect("valid HTTP request");
     request.add_extension(capture.clone());
     let (status, body) = test_client::send_and_collect(connector, request).await;
     let metadata = capture
         .get()
         .expect("CaptureSmithyConnection should contain connection metadata");
     (status, body, metadata)
-78
+}
-79
 /// Drops the client-side handles, then shuts the harness down and reports failures.
 ///
 /// The drop must come first. Shutdown cancels connection tasks promptly, so a script
 /// parked in `await_client_close()` stops reading as soon as the signal arrives -- and
 /// that read is what detects bytes the client should never have sent, such as a
 /// pipelined request. Shutting down while the client still holds pooled connections

@@ -230,201 +289,261 @@

↥ Expand context

             .await
             .expect("clean harness shutdown");
-203
+    }
-204
     #[tokio::test]
     async fn test_fully_consumed_responses_reuse_connection_with_hyper_util_legacy_pool() {
         fully_consumed_responses_reuse_connection(&HyperUtilLegacyPool).await;
-208
+    }
-209
     #[tokio::test]
     async fn test_fully_consumed_responses_reuse_connection_with_partitioned_connection_pool() {
         fully_consumed_responses_reuse_connection(&PartitionedConnectionPool).await;
-213
+    }
-214
     /// An idle pooled connection is closed after its configured timeout and then replaced.
     async fn idle_connection_is_evicted_after_timeout(backend: &dyn HttpClientBackend) {
         let idle_timeout = Duration::from_millis(100);
         let harness = ConnectionTestHarness::builder()
             .endpoint(
                 IP1,

                 EndpointPlan::queue([
                     Http1Script::responses([Http1Response::ok().body("first")]),
                     Http1Script::responses([Http1Response::ok().body("second")]),
                 ]),
-225
+            )
             .build()
             .await
             .expect("harness should start");
         let client = backend.build(BackendConfig {
             pool_idle_timeout: Some(idle_timeout),
             ..Default::default()
         });
         let connector = test_client::connector(&client);
-234
         let (status, body) =
             test_client::get_and_collect(&connector, &harness.endpoint_url()).await;
         assert_eq!((status, body.as_slice()), (200, b"first".as_slice()));
         let first_connection = http1_request_connection_ids(&harness)[0];
-239
         harness
             .wait_for_event(test_client::WAIT, |event| {

↧ Expand context

                 matches!(
                     event,
                     ConnectionEvent::ConnectionClosed {
                         connection_id,
                         reason: ConnectionCloseReason::ClientClosed,
                     } if *connection_id == first_connection
-248
+                )
             })
             .await
             .expect("the client should close the evicted idle connection");
-252
         let (status, body) =
             test_client::get_and_collect(&connector, &harness.endpoint_url()).await;
         assert_eq!((status, body.as_slice()), (200, b"second".as_slice()));
-256
         let connection_ids = http1_request_connection_ids(&harness);
         assert_eq!(connection_ids.len(), 2);
         assert_ne!(
             connection_ids[0], connection_ids[1],
             "a connection evicted by the idle timeout must not be reused"

@@ -298,270 +357,330 @@

↥ Expand context

     async fn test_idle_connection_is_evicted_after_timeout_with_hyper_util_legacy_pool() {
         idle_connection_is_evicted_after_timeout(&HyperUtilLegacyPool).await;
-272
+    }
-273
     #[tokio::test]
     async fn test_idle_connection_is_evicted_after_timeout_with_partitioned_connection_pool() {
         idle_connection_is_evicted_after_timeout(&PartitionedConnectionPool).await;
-277
+    }
-278
     /// Idle eviction does not interrupt a response body that is still being consumed.
     async fn active_response_body_survives_idle_timeout(backend: &dyn HttpClientBackend) {
         let idle_timeout = Duration::from_millis(100);
         let body_gate = ManualGate::new();
         let harness = ConnectionTestHarness::builder()
             .endpoint(
                 IP1,
                 Http1Script::responses([
                     Http1Response::ok().body_plan(BodyPlan::split_at_gate(
                         "first-",
                         body_gate.waiter(),

                         "body",
                     )),
                     Http1Response::ok().body("second"),
                 ]),
-294
+            )
             .build()
             .await
             .expect("harness should start");
         let client = backend.build(BackendConfig {
             pool_idle_timeout: Some(idle_timeout),
             ..Default::default()
         });
         let connector = test_client::connector(&client);
-303
         let first_response = test_client::send_request(
             &connector,
             HttpRequest::get(harness.endpoint_url()).expect("valid HTTP request"),
-307
+        )
         .await
         .expect("first request should return response headers");
-310

↧ Expand context

         body_gate
             .wait_until_reached(test_client::WAIT)
             .await
             .expect("the first response should reach its body gate");
-315
         tokio::time::sleep(idle_timeout * 3).await;
         body_gate.release();
         let (status, body) = test_client::collect_response(first_response).await;
         assert_eq!((status, body.as_slice()), (200, b"first-body".as_slice()));
-320
         let (status, body) =
             test_client::get_and_collect(&connector, &harness.endpoint_url()).await;
         assert_eq!((status, body.as_slice()), (200, b"second".as_slice()));
-324
         let connection_ids = http1_request_connection_ids(&harness);
         assert_eq!(connection_ids.len(), 2);
         assert_eq!(
             connection_ids[0], connection_ids[1],
             "an active response body must survive the pool idle timeout"
         );

@@ -2008,1981 +2106,2133 @@

↥ Expand context

         body_gate.release();
         let (status, body) = test_client::collect_response(first_response).await;
         assert_eq!((status, body.as_slice()), (200, b"slow-resp".as_slice()));
         let (status, body) = second_handle.await.expect("request task should not panic");
         assert_eq!((status, body.as_slice()), (200, b"fast".as_slice()));
-1986
         let connection_ids = http1_request_connection_ids(&harness);
         assert_eq!(connection_ids.len(), 2);
         assert_ne!(connection_ids[0], connection_ids[1]);
         assert_eq!(harness.tcp_accepted_count(), 2);
-1991
         shutdown_harness(harness, connector, client)
             .await
             .expect("clean harness shutdown");
-1995
+    }
-1996
     #[tokio::test]
     async fn test_request_is_not_written_before_the_previous_response_completes_with_hyper_util_legacy_pool(
     ) {
         request_is_not_written_before_the_previous_response_completes(&HyperUtilLegacyPool).await;

-2001
+    }
-2002
     #[tokio::test]
     async fn test_request_is_not_written_before_the_previous_response_completes_with_partitioned_connection_pool(
     ) {
         request_is_not_written_before_the_previous_response_completes(&PartitionedConnectionPool)
             .await;
-2008
+    }
-2009
+}
-2010
 // A DNS resolver can only be installed through `Builder::build_with_resolver`, which is
 // available once a TLS provider is selected, so these tests need a TLS feature even though
 // they speak plaintext HTTP. `CryptoMode::Ring` requires `rustls-ring` specifically.
 #[cfg(feature = "rustls-ring")]
 // The legacy backend's custom-resolver constructor requires a TLS provider even though this
 // contract speaks plaintext HTTP.
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 mod dns_resolution {
     use super::*;
     use aws_smithy_http_client::tls;
     use aws_smithy_runtime_api::client::dns::SharedDnsResolver;
-+
     /// A configured resolver supplies the address used for an origin connection.
     async fn custom_dns_resolver_is_used_for_origin(backend: &dyn HttpClientBackend) {
         const HOST: &str = "custom-dns.test";
-+
         let harness = ConnectionTestHarness::builder()
             .endpoint(
                 IP1,
                 Http1Script::responses([Http1Response::ok().body("custom dns")]),
-+
+            )
             .dns(HOST, [IP1])
             .build()
             .await
             .expect("harness should start");
         let client = backend.build(BackendConfig {
             dns_resolver: Some(SharedDnsResolver::new(harness.dns_resolver())),
             ..Default::default()
         });
         let connector = test_client::connector(&client);
         let url = format!("http://{HOST}:{}/custom-dns", harness.port());
-+
         let (status, body) = test_client::get_and_collect(&connector, &url).await;
         assert_eq!((status, body.as_slice()), (200, b"custom dns".as_slice()));
         assert_eq!(1, harness.dns_lookup_count());
         assert_eq!(
             vec![(
                 "/custom-dns".to_string(),
                 Some(format!("{HOST}:{}", harness.port()))
             )],
             harness.http_requests()
         );
-+
         shutdown_harness(harness, connector, client)
             .await
             .expect("clean harness shutdown");
-+
+    }
-+
     #[tokio::test]
     async fn test_custom_dns_resolver_is_used_for_origin_with_hyper_util_legacy_pool() {
         custom_dns_resolver_is_used_for_origin(&HyperUtilLegacyPool).await;
-+
+    }
-+
     #[tokio::test]
     async fn test_custom_dns_resolver_is_used_for_origin_with_partitioned_connection_pool() {
         custom_dns_resolver_is_used_for_origin(&PartitionedConnectionPool).await;
-+
+    }
-2068
     /// A hostname with no DNS entry fails the request at resolution, before any TCP
     /// connection is attempted.
     async fn unresolvable_hostname_fails_before_connect() {
     async fn unresolvable_hostname_fails_before_connect(backend: &dyn HttpClientBackend) {
         // The endpoint is never connected to. It exists because a harness requires at
         // least one endpoint, and it supplies the port used to build the request URL.
         let harness = ConnectionTestHarness::builder()
             .endpoint(IP1, SocketScript::new().await_client_close())
             .build()
             .await
             .expect("harness should start");
         let client = Builder::new()
             .tls_provider(tls::Provider::Rustls(
                 tls::rustls_provider::CryptoMode::Ring,
             ))
             .build_with_resolver(harness.dns_resolver());
         let client = backend.build(BackendConfig {
             dns_resolver: Some(SharedDnsResolver::new(harness.dns_resolver())),
             ..Default::default()
         });
         let connector = test_client::connector(&client);
-2084
         let url = format!("http://unknown.test:{}/", harness.port());
         let error = test_client::send_request(
             &connector,
             HttpRequest::get(&url).expect("valid HTTP request"),
-2089
+        )
         .await
         .expect_err("an unresolvable hostname must fail the request");
         assert!(
             error.is_io(),
             "expected ConnectorError::io for a DNS failure, got {error:?}"
         );
         let chain = error_chain_display(&error);
         assert!(
             chain.contains("dns error"),
             "the error should identify DNS resolution as the cause, got: {chain}"
         );
-2101
         assert_eq!(
             harness.tcp_accepted_count(),
 ,
             "no TCP connection should be attempted when DNS resolution fails"
         );
         let lookups = harness
             .events()
             .into_iter()
             .filter(
                 |event| matches!(event, ConnectionEvent::DnsLookup { hostname } if hostname == "unknown.test"),
-2112
+            )
             .count();
         assert_eq!(
             lookups, 1,
             "the failed lookup should be recorded exactly once"
         );
-2118
         shutdown_harness(harness, connector, client)
             .await
             .expect("clean harness shutdown");
-2122
+    }
-2123
     #[tokio::test]
     async fn test_unresolvable_hostname_fails_before_connect_with_hyper_util_legacy_pool() {
         unresolvable_hostname_fails_before_connect().await;
         unresolvable_hostname_fails_before_connect(&HyperUtilLegacyPool).await;
-+
+    }
-+
     #[tokio::test]
     async fn test_unresolvable_hostname_fails_before_connect_with_partitioned_connection_pool() {
         unresolvable_hostname_fails_before_connect(&PartitionedConnectionPool).await;
-2132
+    }
-2133
+}

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/h2_connection_behavior_test.rs

@@ -1,1 +130,81 @@

↥ Expand context

 /*
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-5
 //! HTTP/2 connection behavior contracts.
 //!
 //! Each contract is implementation-neutral and has an explicit runner for every
 //! HTTP client backend expected to preserve that behavior.
-10

 #![cfg(all(feature = "wire-mock", feature = "rustls-aws-lc"))]
-12
 mod common;
-14
 use aws_smithy_http_client::pool::{
     Client as PoolClient, ConnectionPool, ConnectionReuseScope, Partition, PartitionId,
     TokioDriverSpawner,
 };
 use aws_smithy_http_client::test_util::wire::connection::{ConnectionCloseReason, ManualGate};
 use aws_smithy_http_client::tls;
 use aws_smithy_http_client::Builder;
 use aws_smithy_runtime_api::client::connection::{
     CaptureSmithyConnection, ConnectionMetadata as SmithyConnectionMetadata,
 };
 use aws_smithy_runtime_api::client::http::{SharedHttpClient, SharedHttpConnector};
 use aws_smithy_runtime_api::client::orchestrator::HttpRequest;
 use bytes::Bytes;
 use common::client as test_client;
 use common::client::{BackendConfig, HyperUtilLegacyPool};
 use common::client::{
     BackendConfig, HttpsClientBackend, HyperUtilLegacyPool, PartitionedConnectionPool,
 };
 use common::h2::{
     H2BodyPlan, H2ConnectionId, H2ConnectionPlan, H2ConnectionScript, H2Event, H2Response,
     H2StreamScript, H2TestServer,
 };
 use common::tls as test_tls;
 use h2::Reason;
 use http_body_util::BodyExt;
 use std::error::Error;
-39
 trait HttpsClientBackend {
     fn build_https(
         &self,
         config: BackendConfig,
         provider: tls::Provider,
         tls_context: tls::TlsContext,
     ) -> SharedHttpClient;
--
+}
--
 impl HttpsClientBackend for HyperUtilLegacyPool {
     fn build_https(
         &self,
         config: BackendConfig,
         provider: tls::Provider,
         tls_context: tls::TlsContext,
     ) -> SharedHttpClient {
         let mut builder = Builder::new();
         if let Some(pool_idle_timeout) = config.pool_idle_timeout {
             builder = builder.pool_idle_timeout(pool_idle_timeout);
--
+        }
         builder
             .tls_provider(provider)
             .tls_context(tls_context)
             .build_https()
--
+    }
--
+}
--
 #[derive(Clone, Copy, Debug)]
 struct PartitionedConnectionPool;
--
 impl HttpsClientBackend for PartitionedConnectionPool {
     fn build_https(
         &self,
         config: BackendConfig,
         provider: tls::Provider,
         tls_context: tls::TlsContext,
     ) -> SharedHttpClient {
         let mut builder = ConnectionPool::builder().tls_provider(provider);
         if let Some(pool_idle_timeout) = config.pool_idle_timeout {
             builder = builder.idle_timeout(pool_idle_timeout);
--
+        }
         let pool = builder
             .tls_context(tls_context)
             .build_https()
             .expect("valid connection-pool config");
         let client = PoolClient::new(&pool).expect("anonymous partition exists");
         SharedHttpClient::new(client)
--
+    }
--
+}
--
 fn rustls_aws_lc() -> tls::Provider {
     tls::Provider::Rustls(tls::rustls_provider::CryptoMode::AwsLc)
-42
+}
-43
 fn h2_client_with_provider(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) -> SharedHttpClient {
     backend.build_https(
         BackendConfig::default(),
         provider,
         test_tls::server_tls_context(),
         test_tls::SERVER_IDENTITY.client_context(),
-52
+    )
-53
+}
-54
 fn h2_client(backend: &dyn HttpsClientBackend) -> SharedHttpClient {
     h2_client_with_provider(backend, rustls_aws_lc())
-57
+}
-58
 fn stream_connection_ids(server: &H2TestServer, path: &str) -> Vec<H2ConnectionId> {
     server
         .events()

↧ Expand context

         .into_iter()
         .filter_map(|event| match event {
             H2Event::StreamAccepted {
                 connection_id,
                 path: event_path,
                 ..
             } if event_path == path => Some(connection_id),
             _ => None,
         })
         .collect()
-72
+}
-73
 fn single_stream_connection(server: &H2TestServer, path: &str) -> H2ConnectionId {
     let connection_ids = stream_connection_ids(server, path);
     assert_eq!(connection_ids.len(), 1, "expected one stream for {path}");
     connection_ids[0]
-78
+}
-79
 async fn get_and_collect_with_capture(
     connector: &SharedHttpConnector,

@@ -771,722 +833,785 @@

↥ Expand context

                 Poll::Ready(_) => {
                     self.complete = true;
                     Poll::Ready(None)
-725
+                }
                 Poll::Pending => Poll::Pending,
-727
+            }
-728
+        }
-729
         fn is_end_stream(&self) -> bool {
             self.complete
-732
+        }
-733
         fn size_hint(&self) -> SizeHint {
             SizeHint::default()
-736
+        }
-737
+    }
-738
     fn held_upload() -> (oneshot::Sender<()>, SdkBody) {
         let (finish, finished) = oneshot::channel();
         let body = HeldUpload {

             finish: finished,
             complete: false,
         };
         (finish, SdkBody::from_body_1_x(body))
-746
+    }
-747
     fn client_with_idle_timeout(backend: &dyn HttpsClientBackend) -> SharedHttpClient {
         backend.build_https(
             BackendConfig {
                 pool_idle_timeout: Some(IDLE_TIMEOUT),
                 ..Default::default()
             },
             rustls_aws_lc(),
             test_tls::server_tls_context(),
             test_tls::SERVER_IDENTITY.client_context(),
-756
+        )
-757
+    }
-758
     /// An idle H2 connection is closed after its configured timeout and then replaced.
     async fn idle_connection_is_evicted_after_timeout(backend: &dyn HttpsClientBackend) {
         let script =
             H2ConnectionScript::new().fallback(H2StreamScript::respond(H2Response::ok("ok")));
         let server = H2TestServer::builder()
             .connections(H2ConnectionPlan::queue([script.clone(), script]))
             .start()

↧ Expand context

             .await
             .expect("H2 server should start");
         let client = client_with_idle_timeout(backend);
         let connector = test_client::connector(&client);
-770
         let (status, body) = test_client::get_and_collect(&connector, &server.url("/first")).await;
         assert_eq!((status, body.as_slice()), (200, b"ok".as_slice()));
         let first_connection = single_stream_connection(&server, "/first");
         server
             .wait_for_event(test_client::WAIT, |event| {
                 matches!(
                     event,
                     H2Event::ConnectionClosed { connection_id, reason: ConnectionCloseReason::ClientClosed }
                         if *connection_id == first_connection
-780
+                )
             })
             .await
             .expect("the idle H2 connection should close after its pool timeout");
-784
         let (status, body) = test_client::get_and_collect(&connector, &server.url("/second")).await;

@@ -998,950 +1058,1010 @@

↥ Expand context

             .send(())
             .expect("request body disappeared before upload completion");
         held_request_gate.release();
         server
             .wait_for_event(test_client::WAIT, |event| {
                 matches!(
                     event,
                     H2Event::ConnectionClosed { connection_id, .. }
                         if *connection_id == upload_connection
-959
+                )
             })
             .await
             .expect("draining connection should close after upload completion");
         drop(connector);
         drop(client);
         server.shutdown().await.expect("clean H2 server shutdown");
-966
+    }
-967
+}
-968
 mod partition_reuse {

     use super::*;
     use std::time::Duration;
-972
     fn partitioned_clients(
         scope: ConnectionReuseScope,
     ) -> (ConnectionPool, SharedHttpConnector, SharedHttpConnector) {
         let first = PartitionId::from_index(1);
         let second = PartitionId::from_index(2);
         let pool = ConnectionPool::builder()
             .tls_provider(rustls_aws_lc())
             .tls_context(test_tls::server_tls_context())
             .tls_context(test_tls::SERVER_IDENTITY.client_context())
             .partitions([
                 Partition::new(first, TokioDriverSpawner::current()),
                 Partition::new(second, TokioDriverSpawner::current()),
             ])
             .connection_reuse_scope(scope)
             .max_connections_per_host(1)
             .build_https()
             .expect("valid partitioned HTTPS pool");
         let first_client = SharedHttpClient::new(
             PoolClient::from_partition(&pool, first).expect("first partition should resolve"),

↧ Expand context

         );
         let second_client = SharedHttpClient::new(
             PoolClient::from_partition(&pool, second).expect("second partition should resolve"),
         );
-995
+        (
             pool,
             test_client::connector(&first_client),
             test_client::connector(&second_client),
-999
+        )
-1000
+    }
-1001
     async fn eligible_partition_reuses_peer_h2(scope: ConnectionReuseScope) {
         let server = H2TestServer::builder()
             .connections(H2ConnectionPlan::queue([H2ConnectionScript::new()
                 .fallback(H2StreamScript::respond(H2Response::ok("shared")))]))
             .start()
             .await
             .expect("H2 server should start");
         let (pool, first, second) = partitioned_clients(scope);
-1010

tmp-codegen-diff/aws-sdk/sdk/aws-smithy-http-client/tests/proxy_tests.rs

@@ -1,1 +1200,1004 @@

 /*
  * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
  * SPDX-License-Identifier: Apache-2.0
  */
-5
 //! Integration tests for proxy functionality
 //! Proxy behavior contracts shared by the legacy and partitioned connection pools.
 //!
 //! These tests verify that proxy configuration works end-to-end with real HTTP requests
 //! using mock proxy servers.
 //! Each contract is backend-neutral and has an explicit runner for every client
 //! implementation that must preserve the behavior.
-+
 #![cfg(feature = "default-client")]
-12
 use aws_smithy_async::time::SystemTimeSource;
 mod common {
     #[allow(dead_code)]
     pub(crate) mod client;
     #[cfg(all(
         feature = "wire-mock",
         any(feature = "rustls-ring", feature = "s2n-tls")
     ))]
     #[allow(dead_code)]
     pub(crate) mod h2;
     pub(crate) mod proxy;
     #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
     pub(crate) mod tls;
-+
+}
-+
 use aws_smithy_http_client::proxy::ProxyConfig;
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use aws_smithy_http_client::tls;
 use aws_smithy_http_client::{proxy::ProxyConfig, Connector};
 use aws_smithy_runtime_api::client::http::{
     http_client_fn, HttpClient, HttpConnector, HttpConnectorSettings, SharedHttpConnector,
 use aws_smithy_runtime_api::box_error::BoxError;
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 use aws_smithy_runtime_api::client::dns::{
     DnsFuture, ResolveDns, ResolveDnsError, SharedDnsResolver,
 };
 use aws_smithy_runtime_api::client::http::{HttpConnector, SharedHttpClient, SharedHttpConnector};
 use aws_smithy_runtime_api::client::orchestrator::HttpRequest;
 use aws_smithy_runtime_api::client::runtime_components::RuntimeComponentsBuilder;
 use base64::Engine;
 use http_1x::{Request, Response, StatusCode};
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use common::client::HttpsClientBackend;
 use common::client::{
     self as test_client, BackendConfig, HttpClientBackend, HyperUtilLegacyPool,
     PartitionedConnectionPool,
 };
 #[cfg(all(
     feature = "wire-mock",
     any(feature = "rustls-ring", feature = "s2n-tls")
 ))]
 use common::h2::{
     H2ConnectionPlan, H2ConnectionScript, H2Event, H2Response, H2StreamScript, H2TestServer,
 };
 use common::proxy::{basic_authorization, MockHttpServer};
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use common::proxy::{MockConnectProxy, MockTlsOrigin};
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 use common::tls as test_tls;
 use http_1x::{Response, StatusCode};
 use http_body_util::BodyExt;
 use hyper::body::Incoming;
 use hyper::service::service_fn;
 use hyper_util::rt::TokioIo;
 use std::collections::HashMap;
 use std::convert::Infallible;
 use std::net::SocketAddr;
 use std::sync::{Arc, Mutex};
 use std::future::Future;
 use std::time::Duration;
 use tokio::net::TcpListener;
 use tokio::sync::oneshot;
--
 // ================================================================================================
 // Test Utilities (Mock Proxy Server)
 // ================================================================================================
--
 /// Mock HTTP server that acts as a proxy endpoint for testing
 #[derive(Debug)]
 struct MockProxyServer {
     conn_count: Arc<()>,
     addr: SocketAddr,
     shutdown_tx: Option<oneshot::Sender<()>>,
     request_log: Arc<Mutex<Vec<RecordedRequest>>>,
--
+}
--
 /// A recorded request received by the mock proxy server
 #[derive(Debug, Clone)]
 struct RecordedRequest {
     method: String,
     uri: String,
     headers: HashMap<String, String>,
--
+}
--
 impl MockProxyServer {
     /// Create a new mock proxy server with a custom request handler
     async fn new<F>(handler: F) -> Self
     where
         F: Fn(RecordedRequest) -> Response<String> + Send + Sync + 'static,
--
+    {
         let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
         let addr = listener.local_addr().unwrap();
         let (shutdown_tx, shutdown_rx) = oneshot::channel();
         let request_log = Arc::new(Mutex::new(Vec::new()));
         let request_log_clone = request_log.clone();
         let conn_count = Arc::new(());
         let server_conn_count = conn_count.clone();
--
         let handler = Arc::new(handler);
--
         tokio::spawn(async move {
             let mut shutdown_rx = shutdown_rx;
--
             loop {
                 tokio::select! {
                     result = listener.accept() => {
                         match result {
                             Ok((stream, _)) => {
                                 let io = TokioIo::new(stream);
                                 let handler = handler.clone();
                                 let request_log = request_log_clone.clone();
--
                                 let stream_conn_count = server_conn_count.clone();
                                 tokio::spawn(async move {
                                     let _stream_conn_count = stream_conn_count;
                                     let service = service_fn(move |req: Request<Incoming>| {
                                         let handler = handler.clone();
                                         let request_log = request_log.clone();
--
                                         async move {
                                             // Record the request
                                             let recorded = RecordedRequest {
                                                 method: req.method().to_string(),
                                                 uri: req.uri().to_string(),
                                                 headers: req.headers().iter()
                                                     .map(|(k, v)| (k.to_string(), v.to_str().unwrap_or("").to_string()))
                                                     .collect(),
                                             };
--
                                             request_log.lock().unwrap().push(recorded.clone());
--
                                             // Call the handler
                                             let response = handler(recorded);
--
                                             // Convert to hyper response
                                             let (parts, body) = response.into_parts();
                                             let hyper_response = Response::from_parts(parts, body);
--
                                             Ok::<_, Infallible>(hyper_response)
--
+                                        }
                                     });
--
                                     if let Err(err) = hyper::server::conn::http1::Builder::new()
                                         .serve_connection(io, service)
                                         .await
--
+                                    {
                                         eprintln!("Mock proxy server connection error: {}", err);
--
+                                    }
                                 });
--
+                            }
                             Err(_) => break,
--
+                        }
--
+                    }
                     _ = &mut shutdown_rx => {
                         break;
--
+                    }
--
+                }
--
+            }
         });
--
         Self {
             addr,
             shutdown_tx: Some(shutdown_tx),
             request_log,
             conn_count,
--
+        }
-+
 struct TestClient {
     _client: SharedHttpClient,
     connector: SharedHttpConnector,
-+
+}
-+
 fn http_client(backend: &dyn HttpClientBackend, config: BackendConfig) -> TestClient {
     let client = backend.build(config);
     let connector = test_client::connector(&client);
     TestClient {
         _client: client,
         connector,
-76
+    }
-+
+}
-78
     /// Return the number of active connections to this server
     fn conn_count(&self) -> usize {
         // 1 reference for the struct MockProxyServer, 1 reference for the
         // socket task.
         Arc::strong_count(&self.conn_count)
             .checked_sub(2)
             .expect("de-count 2 refs")
 fn proxy_backend_config(proxy_config: ProxyConfig) -> BackendConfig {
     BackendConfig {
         proxy_config: Some(proxy_config),
         ..Default::default()
-83
+    }
-+
+}
-85
     /// Create a simple mock proxy that returns a fixed response
     async fn with_response(status: StatusCode, body: &str) -> Self {
         let body = body.to_string();
         Self::new(move |_req| {
             Response::builder()
                 .status(status)
                 .body(body.clone())
                 .unwrap()
         })
         .await
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 fn https_client(
     backend: &dyn HttpsClientBackend,
     config: BackendConfig,
     provider: tls::Provider,
     tls_context: tls::TlsContext,
 ) -> TestClient {
     let client = backend.build_https(config, provider, tls_context);
     let connector = test_client::connector(&client);
     TestClient {
         _client: client,
         connector,
-98
+    }
-+
+}
-100
     /// Create a mock proxy that validates basic authentication
     async fn with_auth_validation(expected_user: &str, expected_pass: &str) -> Self {
         let expected_auth = format!(
             "Basic {}",
             base64::prelude::BASE64_STANDARD.encode(format!("{}:{}", expected_user, expected_pass))
         );
 async fn send_request(
     client: &TestClient,
     request: HttpRequest,
 ) -> Result<(StatusCode, String), BoxError> {
     let response = client.connector.call(request).await?;
     let status = StatusCode::from_u16(response.status().as_u16())?;
     let body = response.into_body().collect().await?.to_bytes();
     Ok((status, String::from_utf8(body.to_vec())?))
-+
+}
-110
         Self::new(move |req| {
             if let Some(auth_header) = req.headers.get("proxy-authorization") {
                 if auth_header == &expected_auth {
                     Response::builder()
                         .status(StatusCode::OK)
                         .body("authenticated".to_string())
                         .unwrap()
                 } else {
                     Response::builder()
                         .status(StatusCode::PROXY_AUTHENTICATION_REQUIRED)
                         .body("invalid credentials".to_string())
                         .unwrap()
--
+                }
             } else {
                 Response::builder()
                     .status(StatusCode::PROXY_AUTHENTICATION_REQUIRED)
                     .header("proxy-authenticate", "Basic realm=\"proxy\"")
                     .body("authentication required".to_string())
                     .unwrap()
--
+            }
         })
         .await
--
+    }
 async fn get(client: &TestClient, uri: &str) -> Result<(StatusCode, String), BoxError> {
     send_request(client, HttpRequest::get(uri)?).await
-+
+}
-114
     /// Get the address this server is listening on
     fn addr(&self) -> SocketAddr {
         self.addr
--
+    }
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 #[derive(Clone, Debug)]
 struct FailingDns;
-118
     /// Get all requests received by this server
     fn requests(&self) -> Vec<RecordedRequest> {
         self.request_log.lock().unwrap().clone()
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 impl ResolveDns for FailingDns {
     fn resolve_dns<'a>(&'a self, name: &'a str) -> DnsFuture<'a> {
         DnsFuture::ready(Err(ResolveDnsError::new(std::io::Error::other(format!(
             "intentional DNS failure for {name}"
         )))))
-125
+    }
-126
+}
-127
 impl Drop for MockProxyServer {
     fn drop(&mut self) {
         if let Some(tx) = self.shutdown_tx.take() {
             let _ = tx.send(());
--
+        }
--
+    }
 #[cfg(all(
     feature = "wire-mock",
     any(feature = "rustls-ring", feature = "s2n-tls")
 ))]
 async fn h2_forward_proxy_applies_configured_authentication(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) {
     let server = H2TestServer::builder()
         .connections(H2ConnectionPlan::queue([H2ConnectionScript::new().route(
             "/protected",
             H2StreamScript::respond(H2Response::ok("authenticated over H2")),
         )]))
         .start()
         .await
         .expect("H2 forward proxy should start");
     let config = ProxyConfig::http(server.url("/"))
         .expect("valid proxy URI")
         .with_basic_auth("h2user", "h2pass");
     let client = https_client(
         backend,
         proxy_backend_config(config),
         provider,
         test_tls::SERVER_IDENTITY.client_context(),
     );
-+
     assert_eq!(
         (StatusCode::OK, "authenticated over H2".to_string()),
         get(&client, "http://origin.test/protected")
             .await
             .expect("H2 forward-proxy request should succeed")
     );
     let expected = basic_authorization("h2user", "h2pass");
     let authorization = server.events().into_iter().find_map(|event| match event {
         H2Event::StreamAccepted {
             path,
             proxy_authorization,
             ..
         } if path == "/protected" => proxy_authorization,
         _ => None,
     });
     assert_eq!(Some(expected), authorization);
-+
     drop(client);
     server
         .shutdown()
         .await
         .expect("clean H2 forward-proxy shutdown");
-+
+}
-+
 #[cfg(all(feature = "wire-mock", feature = "rustls-ring"))]
 #[tokio::test]
 async fn test_h2_forward_proxy_auth_with_rustls_and_hyper_util_legacy_pool() {
     h2_forward_proxy_applies_configured_authentication(
         &HyperUtilLegacyPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-+
 #[cfg(all(feature = "wire-mock", feature = "rustls-ring"))]
 #[tokio::test]
 async fn test_h2_forward_proxy_auth_with_rustls_and_partitioned_connection_pool() {
     h2_forward_proxy_applies_configured_authentication(
         &PartitionedConnectionPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-+
 #[cfg(all(feature = "wire-mock", feature = "s2n-tls"))]
 #[tokio::test]
 async fn test_h2_forward_proxy_auth_with_s2n_tls_and_hyper_util_legacy_pool() {
     h2_forward_proxy_applies_configured_authentication(&HyperUtilLegacyPool, tls::Provider::S2nTls)
         .await;
-+
+}
-+
 #[cfg(all(feature = "wire-mock", feature = "s2n-tls"))]
 #[tokio::test]
 async fn test_h2_forward_proxy_auth_with_s2n_tls_and_partitioned_connection_pool() {
     h2_forward_proxy_applies_configured_authentication(
         &PartitionedConnectionPool,
         tls::Provider::S2nTls,
-+
+    )
     .await;
-+
+}
-+
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn https_proxy_dns_failure_remains_retryable_io(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) {
     let client = https_client(
         backend,
         BackendConfig {
             proxy_config: Some(
                 ProxyConfig::all("http://proxy.invalid:8080").expect("valid proxy URI"),
             ),
             dns_resolver: Some(SharedDnsResolver::new(FailingDns)),
             ..Default::default()
         },
         provider,
         tls::TlsContext::default(),
     );
-+
     let error = test_client::send_request(
         &client.connector,
         HttpRequest::get("https://origin.test/protected").expect("valid request"),
-+
+    )
     .await
     .expect_err("proxy DNS failure must fail the request");
     assert!(
         error.is_io(),
         "HTTPS proxy DNS failure should remain retryable I/O, got {error:?}"
     );
-+
+}
-+
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_https_proxy_dns_failure_with_rustls_and_hyper_util_legacy_pool() {
     https_proxy_dns_failure_remains_retryable_io(
         &HyperUtilLegacyPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-+
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_https_proxy_dns_failure_with_rustls_and_partitioned_connection_pool() {
     https_proxy_dns_failure_remains_retryable_io(
         &PartitionedConnectionPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-+
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_proxy_dns_failure_with_s2n_tls_and_hyper_util_legacy_pool() {
     https_proxy_dns_failure_remains_retryable_io(&HyperUtilLegacyPool, tls::Provider::S2nTls).await;
-+
+}
-+
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_proxy_dns_failure_with_s2n_tls_and_partitioned_connection_pool() {
     https_proxy_dns_failure_remains_retryable_io(&PartitionedConnectionPool, tls::Provider::S2nTls)
         .await;
-276
+}
-277
 /// Utility for running tests with specific environment variables
 #[allow(clippy::await_holding_lock)]
 async fn with_env_vars<F, Fut, R>(vars: &[(&str, &str)], test: F) -> R
 where
     F: FnOnce() -> Fut,
     Fut: std::future::Future<Output = R>,
     Fut: Future<Output = R>,
-283
+{
     // Use a static mutex to serialize environment variable tests
     static ENV_MUTEX: std::sync::Mutex<()> = std::sync::Mutex::new(());
     let _guard = ENV_MUTEX.lock().unwrap();
--
     // Save original environment
     let original_vars: Vec<_> = vars
     let _guard = ENV_MUTEX.lock().expect("environment lock is not poisoned");
     let previous: Vec<_> = vars
         .iter()
         .map(|(key, _)| (*key, std::env::var(key)))
         .map(|(name, _)| (*name, std::env::var(name)))
         .collect();
-290
     // Set test environment variables
     for (key, value) in vars {
         std::env::set_var(key, value);
     for (name, value) in vars {
         std::env::set_var(name, value);
-293
+    }
--
     // Run the test
     let result = test().await;
--
     // Restore original environment
     for (key, original_value) in original_vars {
         match original_value {
             Ok(val) => std::env::set_var(key, val),
             Err(_) => std::env::remove_var(key),
     for (name, value) in previous {
         match value {
             Ok(value) => std::env::set_var(name, value),
             Err(_) => std::env::remove_var(name),
-299
+        }
-300
+    }
--
     result
-302
+}
-303
 /// Helper function to make HTTP requests through a proxy-configured connector
 async fn make_http_request_through_proxy(
     proxy_config: ProxyConfig,
     target_url: &str,
 ) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
     make_http_request_through_proxy_with_pool_timeout(
         proxy_config,
         Some(Duration::from_secs(90)),
         target_url,
--
+    )
     .await
     .map(|(status, res, _client)| (status, res))
--
+}
--
 /// Helper function to make HTTP requests through a proxy-configured connector
 async fn make_http_request_through_proxy_with_pool_timeout(
     proxy_config: ProxyConfig,
     pool_idle_timeout: Option<Duration>,
     target_url: &str,
 ) -> Result<(StatusCode, String, SharedHttpConnector), Box<dyn std::error::Error + Send + Sync>> {
     // Create an HttpClient using http_client_fn with proxy-configured connector
     let http_client = http_client_fn(move |settings, _components| {
         let connector = Connector::builder()
             .proxy_config(proxy_config.clone())
             .pool_idle_timeout(pool_idle_timeout)
             .connector_settings(settings.clone())
             .build_http();
--
         aws_smithy_runtime_api::client::http::SharedHttpConnector::new(connector)
     });
 async fn http_forward_proxy_uses_absolute_form(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::new(|request| {
         assert_eq!("GET", request.method);
         assert_eq!("http://api.example.com/v1/data", request.uri);
         assert_eq!(
             Some(&"api.example.com".to_string()),
             request.headers.get("host")
         );
         Response::builder()
             .status(StatusCode::OK)
             .body("proxied".to_string())
             .expect("valid response")
     })
     .await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr())).expect("valid proxy");
     let client = http_client(backend, proxy_backend_config(config));
-320
     // Set up runtime components (following smoke_test_client pattern)
     let connector_settings = HttpConnectorSettings::builder().build();
     let runtime_components = RuntimeComponentsBuilder::for_tests()
         .with_time_source(Some(SystemTimeSource::new()))
         .build()
         .unwrap();
     assert_eq!(
         (StatusCode::OK, "proxied".to_string()),
         get(&client, "http://api.example.com/v1/data")
             .await
             .expect("proxy request succeeds")
     );
     assert_eq!(1, proxy.requests().len());
-+
+}
-329
     // Get the HTTP connector from the client
     let http_connector = http_client.http_connector(&connector_settings, &runtime_components);
 #[tokio::test]
 async fn test_http_forward_proxy_uses_absolute_form_with_hyper_util_legacy_pool() {
     http_forward_proxy_uses_absolute_form(&HyperUtilLegacyPool).await;
-+
+}
-334
     // Create and make the HTTP request
     let request = HttpRequest::get(target_url)
         .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)?;
 #[tokio::test]
 async fn test_http_forward_proxy_uses_absolute_form_with_partitioned_connection_pool() {
     http_forward_proxy_uses_absolute_form(&PartitionedConnectionPool).await;
-+
+}
-+
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 async fn custom_dns_resolver_is_used_for_proxy_connections(backend: &dyn HttpClientBackend) {
     const PROXY_HOST: &str = "proxy.test";
-+
     let proxy = MockHttpServer::with_response(StatusCode::OK, "proxied through custom DNS").await;
     let resolver = proxy.dns_resolver(PROXY_HOST);
     let proxy_config = ProxyConfig::http(format!("http://{PROXY_HOST}:{}", proxy.addr().port()))
         .expect("valid proxy URI");
     let client = http_client(
         backend,
         BackendConfig {
             dns_resolver: Some(SharedDnsResolver::new(resolver.clone())),
             ..proxy_backend_config(proxy_config)
         },
     );
-360
     let response = http_connector.call(request).await?;
     assert_eq!(
         (StatusCode::OK, "proxied through custom DNS".to_string()),
         get(&client, "http://origin.test/custom-dns-proxy")
             .await
             .expect("proxy request succeeds")
     );
     assert_eq!(vec![PROXY_HOST.to_string()], resolver.lookups());
     assert_eq!(
         "http://origin.test/custom-dns-proxy",
         proxy.requests()[0].uri
     );
-+
+}
-373
     // Extract status and body
     let status = response.status();
     let body_bytes = response.into_body().collect().await?.to_bytes();
     let body_string = String::from_utf8(body_bytes.to_vec())?;
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 #[tokio::test]
 async fn test_custom_dns_resolver_is_used_for_proxy_connections_with_hyper_util_legacy_pool() {
     custom_dns_resolver_is_used_for_proxy_connections(&HyperUtilLegacyPool).await;
-+
+}
-384
     Ok((status.into(), body_string, http_connector))
 #[cfg(any(
     feature = "rustls-aws-lc",
     feature = "rustls-aws-lc-fips",
     feature = "rustls-ring",
     feature = "s2n-tls"
 ))]
 #[tokio::test]
 async fn test_custom_dns_resolver_is_used_for_proxy_connections_with_partitioned_connection_pool() {
     custom_dns_resolver_is_used_for_proxy_connections(&PartitionedConnectionPool).await;
-394
+}
-395
 // test the pool idle timeout. The test is in this file because it has a convenient
 // infrastructure for making a server that answers smithy requests.
 #[tokio::test(start_paused = false)]
 // can't set start_paused due to <https://github.com/hyperium/hyper/issues/3950>
 async fn test_http_proxy_connection_pool_timeout() {
     const TIMEOUT: Duration = Duration::from_secs(10);
 async fn configured_proxy_authentication_is_applied(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_auth_validation("testuser", "testpass").await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("testuser", "testpass");
     let client = http_client(backend, proxy_backend_config(config));
-402
     // Create a mock proxy server that validates the request was routed through it
     let mock_proxy = MockProxyServer::new(|req| {
         // Validate that this looks like a proxy request
         assert_eq!(req.method, "GET");
         // For HTTP proxy, the URI should be the full target URL
         assert_eq!(req.uri, "http://aws.amazon.com/api/data");
     assert_eq!(
         (StatusCode::OK, "authenticated".to_string()),
         get(&client, "http://service.test/protected")
             .await
             .expect("authenticated proxy request succeeds")
     );
     assert_eq!(
         Some(&basic_authorization("testuser", "testpass")),
         proxy.requests()[0].headers.get("proxy-authorization")
     );
-+
+}
-414
         // Return a successful response that we can identify
         Response::builder()
             .status(StatusCode::OK)
             .body("proxied response from mock server".to_string())
             .unwrap()
     })
     .await;
     // make sure that conn_count for an empty proxy is 0
     assert_eq!(mock_proxy.conn_count(), 0);
     tracing::info!("Start!");
--
     // Configure connector with HTTP proxy
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr())).unwrap();
--
     // Make an HTTP request through the proxy - use safe domain
     let target_url = "http://aws.amazon.com/api/data";
     let start = tokio::time::Instant::now();
     let result =
         make_http_request_through_proxy_with_pool_timeout(proxy_config, Some(TIMEOUT), target_url)
             .await;
     // hold _connector to avoid the timer being dropped
     let (status, body, _connector) = result.expect("HTTP request through proxy should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "proxied response from mock server");
--
     // Verify the mock proxy received the expected request
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
     assert_eq!(requests[0].method, "GET");
     assert_eq!(requests[0].uri, target_url);
--
     // after making a request, conn count is 1
     assert_eq!(mock_proxy.conn_count(), 1);
--
     // sleep 1 second below the idle timeout, conn count is still 1
     tokio::time::sleep_until(start + TIMEOUT - Duration::from_secs(1)).await;
     assert_eq!(mock_proxy.conn_count(), 1);
--
     // sleep 2 more seconds, the connection should be disconnected, conn count should be 0
     tokio::time::sleep(Duration::from_secs(3)).await;
     assert_eq!(mock_proxy.conn_count(), 0);
 #[tokio::test]
 async fn test_configured_proxy_authentication_with_hyper_util_legacy_pool() {
     configured_proxy_authentication_is_applied(&HyperUtilLegacyPool).await;
-418
+}
-419
 #[tokio::test]
 async fn test_http_proxy_basic_request() {
     // Create a mock proxy server that validates the request was routed through it
     let mock_proxy = MockProxyServer::new(|req| {
         // Validate that this looks like a proxy request
         assert_eq!(req.method, "GET");
         // For HTTP proxy, the URI should be the full target URL
         assert_eq!(req.uri, "http://aws.amazon.com/api/data");
--
         // Return a successful response that we can identify
 async fn test_configured_proxy_authentication_with_partitioned_connection_pool() {
     configured_proxy_authentication_is_applied(&PartitionedConnectionPool).await;
-+
+}
-+
 async fn caller_proxy_authorization_is_preserved(backend: &dyn HttpClientBackend) {
     let caller_authorization = basic_authorization("caller", "credentials");
     let expected = caller_authorization.clone();
     let proxy = MockHttpServer::new(move |request| {
         assert_eq!(Some(&expected), request.headers.get("proxy-authorization"));
         Response::builder()
             .status(StatusCode::OK)
             .body("proxied response from mock server".to_string())
             .unwrap()
             .body("caller authorization".to_string())
             .expect("valid response")
     })
     .await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("configured", "credentials");
     let client = http_client(backend, proxy_backend_config(config));
     let mut request = HttpRequest::get("http://service.test/caller-auth").expect("valid request");
     request
         .headers_mut()
         .insert("proxy-authorization", caller_authorization);
-444
     // Configure connector with HTTP proxy
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr())).unwrap();
--
     // Make an HTTP request through the proxy - use safe domain
     let target_url = "http://aws.amazon.com/api/data";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
--
     let (status, body) = result.expect("HTTP request through proxy should succeed");
--
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "proxied response from mock server");
--
     // Verify the mock proxy received the expected request
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
     assert_eq!(requests[0].method, "GET");
     assert_eq!(requests[0].uri, target_url);
     assert_eq!(
         (StatusCode::OK, "caller authorization".to_string()),
         send_request(&client, request)
             .await
             .expect("caller authorization request succeeds")
     );
-451
+}
-452
 #[tokio::test]
 async fn test_proxy_authentication() {
     // Create a mock proxy that requires authentication
     let mock_proxy = MockProxyServer::with_auth_validation("testuser", "testpass").await;
--
     // Configure connector with authenticated proxy
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr()))
         .unwrap()
         .with_basic_auth("testuser", "testpass");
--
     // Make request through authenticated proxy - use safe domain
     let target_url = "http://aws.amazon.com/protected/resource";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
--
     let (status, body) = result.expect("Authenticated proxy request should succeed");
 async fn test_caller_proxy_authorization_is_preserved_with_hyper_util_legacy_pool() {
     caller_proxy_authorization_is_preserved(&HyperUtilLegacyPool).await;
-+
+}
-457
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "authenticated");
 #[tokio::test]
 async fn test_caller_proxy_authorization_is_preserved_with_partitioned_connection_pool() {
     caller_proxy_authorization_is_preserved(&PartitionedConnectionPool).await;
-+
+}
-462
     // Verify the proxy received the request with correct auth
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
 async fn proxy_url_authentication_is_applied(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_auth_validation("urluser", "urlpass").await;
     let config =
         ProxyConfig::http(format!("http://urluser:urlpass@{}", proxy.addr())).expect("valid proxy");
     let client = http_client(backend, proxy_backend_config(config));
-468
     let expected_auth = format!(
         "Basic {}",
         base64::prelude::BASE64_STANDARD.encode("testuser:testpass")
     assert_eq!(
         StatusCode::OK,
         get(&client, "http://service.test/url-auth")
             .await
             .expect("URL-authenticated request succeeds")
             .0
     );
     assert_eq!(
         requests[0].headers.get("proxy-authorization"),
         Some(&expected_auth)
         Some(&basic_authorization("urluser", "urlpass")),
         proxy.requests()[0].headers.get("proxy-authorization")
     );
-480
+}
-481
 /// Tests URL-embedded proxy authentication (http://user:pass@proxy.com format)
 /// Verifies that credentials in the proxy URL are properly extracted and used
 #[tokio::test]
 async fn test_proxy_url_embedded_auth() {
     let mock_proxy = MockProxyServer::with_auth_validation("urluser", "urlpass").await;
--
     // Configure proxy with credentials embedded in URL
     let proxy_url = format!("http://urluser:urlpass@{}", mock_proxy.addr());
     let proxy_config = ProxyConfig::http(proxy_url).unwrap();
--
     // Make request through proxy with URL-embedded auth
     let target_url = "http://aws.amazon.com/api/test";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
 async fn test_proxy_url_authentication_with_hyper_util_legacy_pool() {
     proxy_url_authentication_is_applied(&HyperUtilLegacyPool).await;
-+
+}
-486
     let (status, body) = result.expect("URL-embedded auth proxy request should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "authenticated");
 #[tokio::test]
 async fn test_proxy_url_authentication_with_partitioned_connection_pool() {
     proxy_url_authentication_is_applied(&PartitionedConnectionPool).await;
-+
+}
-491
     // Verify the proxy received the request with correct auth
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
 async fn proxy_url_authentication_precedes_configured_authentication(
     backend: &dyn HttpClientBackend,
 ) {
     let proxy = MockHttpServer::with_auth_validation("urluser", "urlpass").await;
     let config = ProxyConfig::http(format!("http://urluser:urlpass@{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("configured", "credentials");
     let client = http_client(backend, proxy_backend_config(config));
-500
     let expected_auth = format!(
         "Basic {}",
         base64::prelude::BASE64_STANDARD.encode("urluser:urlpass")
     assert_eq!(
         StatusCode::OK,
         get(&client, "http://service.test/auth-precedence")
             .await
             .expect("proxy request succeeds")
             .0
     );
     assert_eq!(
         requests[0].headers.get("proxy-authorization"),
         Some(&expected_auth)
         Some(&basic_authorization("urluser", "urlpass")),
         proxy.requests()[0].headers.get("proxy-authorization")
     );
-512
+}
-513
 /// Tests authentication precedence: URL-embedded credentials should take precedence over programmatic auth
 /// Verifies that when both URL auth and with_basic_auth() are provided, URL auth wins
 #[tokio::test]
 async fn test_proxy_auth_precedence() {
     let mock_proxy = MockProxyServer::with_auth_validation("urluser", "urlpass").await;
--
     // Configure proxy with URL-embedded auth AND programmatic auth
     // URL auth should take precedence
     let proxy_url = format!("http://urluser:urlpass@{}", mock_proxy.addr());
     let proxy_config = ProxyConfig::http(proxy_url)
         .unwrap()
         .with_basic_auth("programmatic", "auth"); // This should be ignored
--
     // Make request - should use URL-embedded auth, not programmatic auth
     let target_url = "http://aws.amazon.com/precedence/test";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
--
     let (status, body) = result.expect("Auth precedence test should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "authenticated");
--
     // Verify the proxy received the request with URL-embedded auth (not programmatic)
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
--
     let expected_auth = format!(
         "Basic {}",
         base64::prelude::BASE64_STANDARD.encode("urluser:urlpass")
     );
     assert_eq!(
         requests[0].headers.get("proxy-authorization"),
         Some(&expected_auth)
     );
 async fn test_proxy_url_authentication_precedence_with_hyper_util_legacy_pool() {
     proxy_url_authentication_precedes_configured_authentication(&HyperUtilLegacyPool).await;
-517
+}
-518
 #[tokio::test]
 async fn test_proxy_from_environment_variables() {
     let mock_proxy = MockProxyServer::with_response(StatusCode::OK, "env proxy response").await;
 async fn test_proxy_url_authentication_precedence_with_partitioned_connection_pool() {
     proxy_url_authentication_precedes_configured_authentication(&PartitionedConnectionPool).await;
-+
+}
-523
 async fn environment_proxy_is_used(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "environment proxy").await;
     let proxy_uri = format!("http://{}", proxy.addr());
     with_env_vars(
         &[
             ("HTTP_PROXY", &format!("http://{}", mock_proxy.addr())),
             ("HTTP_PROXY", &proxy_uri),
             ("NO_PROXY", "localhost,127.0.0.1"),
         ],
         || async {
             // Create connector with environment-based proxy config
             let proxy_config = ProxyConfig::from_env();
--
             // Make request through environment-configured proxy
             let target_url = "http://aws.amazon.com/v1/data";
             let result = make_http_request_through_proxy(proxy_config, target_url).await;
--
             let (status, body) = result.expect("Environment proxy request should succeed");
--
             assert_eq!(status, StatusCode::OK);
             assert_eq!(body, "env proxy response");
--
             // Verify the proxy received the request
             let requests = mock_proxy.requests();
             assert_eq!(requests.len(), 1);
             assert_eq!(requests[0].uri, target_url);
             let client = http_client(backend, proxy_backend_config(ProxyConfig::from_env()));
             assert_eq!(
                 (StatusCode::OK, "environment proxy".to_string()),
                 get(&client, "http://service.test/environment")
                     .await
                     .expect("environment proxy request succeeds")
             );
         },
-541
+    )
     .await;
     assert_eq!("http://service.test/environment", proxy.requests()[0].uri);
-544
+}
-545
 /// Tests that NO_PROXY bypass rules work correctly
 /// Verifies that requests to bypassed hosts do not go through the proxy
 #[tokio::test]
 async fn test_no_proxy_bypass_rules() {
     let mock_proxy = MockProxyServer::with_response(StatusCode::OK, "should not reach here").await;
--
     // Create a second mock server that will act as the "direct" target
     let direct_server = MockProxyServer::with_response(StatusCode::OK, "direct connection").await;
--
     // Configure proxy with NO_PROXY rules that include the direct server's address
     // Use just the IP address for the NO_PROXY rule
     let direct_ip = "127.0.0.1";
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr()))
         .unwrap()
         .no_proxy(direct_ip);
--
     // Make request to the direct server (should bypass proxy due to NO_PROXY rule)
     let result = make_http_request_through_proxy(
         proxy_config,
         &format!("http://{}/test", direct_server.addr()),
--
+    )
     .await;
 async fn test_environment_proxy_with_hyper_util_legacy_pool() {
     environment_proxy_is_used(&HyperUtilLegacyPool).await;
-+
+}
-550
     let (status, body) = result.expect("Direct connection should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "direct connection");
 #[tokio::test]
 async fn test_environment_proxy_with_partitioned_connection_pool() {
     environment_proxy_is_used(&PartitionedConnectionPool).await;
-+
+}
-555
     // Verify the mock proxy received no requests (bypassed)
     let proxy_requests = mock_proxy.requests();
     assert_eq!(
         proxy_requests.len(),
 ,
         "Proxy should not have received any requests due to NO_PROXY bypass"
     );
 async fn no_proxy_bypasses_proxy(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "unexpected proxy").await;
     let origin = MockHttpServer::with_response(StatusCode::OK, "direct").await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .no_proxy("127.0.0.1");
     let client = http_client(backend, proxy_backend_config(config));
-563
     // Verify the direct server received the request
     let direct_requests = direct_server.requests();
     assert_eq!(
         direct_requests.len(),
 ,
         "Direct server should have received the request"
         (StatusCode::OK, "direct".to_string()),
         get(&client, &format!("http://{}/bypass", origin.addr()))
             .await
             .expect("direct request succeeds")
     );
     assert!(proxy.requests().is_empty());
     assert_eq!("/bypass", origin.requests()[0].uri);
-572
+}
-573
 /// Tests that disabled proxy configuration results in direct connections
 /// Verifies that ProxyConfig::disabled() bypasses all proxy logic
 #[tokio::test]
 async fn test_proxy_disabled() {
     // Create a direct target server
     let direct_server = MockProxyServer::with_response(StatusCode::OK, "direct connection").await;
--
     // Create a disabled proxy configuration
     let proxy_config = ProxyConfig::disabled();
 async fn test_no_proxy_bypass_with_hyper_util_legacy_pool() {
     no_proxy_bypasses_proxy(&HyperUtilLegacyPool).await;
-+
+}
-578
     // Make request with disabled proxy (should go direct to our mock server)
     let result = make_http_request_through_proxy(
         proxy_config,
         &format!("http://{}/get", direct_server.addr()),
--
+    )
     .await;
 #[tokio::test]
 async fn test_no_proxy_bypass_with_partitioned_connection_pool() {
     no_proxy_bypasses_proxy(&PartitionedConnectionPool).await;
-+
+}
-583
     let (status, body) = result.expect("Direct connection should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "direct connection");
 async fn disabled_proxy_uses_direct_origin_form(backend: &dyn HttpClientBackend) {
     let origin = MockHttpServer::with_response(StatusCode::OK, "direct").await;
     let client = http_client(backend, proxy_backend_config(ProxyConfig::disabled()));
-587
     // Verify the direct server received the request
     let requests = direct_server.requests();
     assert_eq!(
         requests.len(),
 ,
         "Direct server should have received the request"
     );
     assert_eq!(requests[0].method, "GET");
     // For direct connections, the URI might be just the path part
     assert!(
         requests[0].uri == format!("http://{}/get", direct_server.addr())
             || requests[0].uri == "/get",
         "URI should be either full URL or path, got: {}",
         requests[0].uri
         (StatusCode::OK, "direct".to_string()),
         get(&client, &format!("http://{}/direct", origin.addr()))
             .await
             .expect("direct request succeeds")
     );
     assert_eq!("/direct", origin.requests()[0].uri);
-595
+}
-596
 /// Tests HTTPS-only proxy configuration
 /// Verifies that HTTP requests bypass HTTPS-only proxies
 #[tokio::test]
 async fn test_https_proxy_configuration() {
     let mock_proxy = MockProxyServer::with_response(StatusCode::OK, "https proxy response").await;
--
     // Create a direct target server for HTTP requests
     let direct_server =
         MockProxyServer::with_response(StatusCode::OK, "direct http connection").await;
--
     // Configure HTTPS-only proxy
     let proxy_config = ProxyConfig::https(format!("http://{}", mock_proxy.addr())).unwrap();
 async fn test_disabled_proxy_uses_direct_origin_form_with_hyper_util_legacy_pool() {
     disabled_proxy_uses_direct_origin_form(&HyperUtilLegacyPool).await;
-+
+}
-601
     // Test: HTTP request should NOT go through HTTPS-only proxy, should go direct
     let target_url = format!("http://{}/api", direct_server.addr());
     let result = make_http_request_through_proxy(proxy_config.clone(), &target_url).await;
 #[tokio::test]
 async fn test_disabled_proxy_uses_direct_origin_form_with_partitioned_connection_pool() {
     disabled_proxy_uses_direct_origin_form(&PartitionedConnectionPool).await;
-+
+}
-606
     // The HTTP request should succeed by going directly to our mock server
     let (status, body) = result.expect("HTTP request should succeed via direct connection");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "direct http connection");
 async fn https_only_proxy_bypasses_http(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "unexpected proxy").await;
     let origin = MockHttpServer::with_response(StatusCode::OK, "direct HTTP").await;
     let config =
         ProxyConfig::https(format!("http://{}", proxy.addr())).expect("valid proxy configuration");
     let client = http_client(backend, proxy_backend_config(config));
-613
     // Verify the HTTPS-only proxy received no requests
     let proxy_requests = mock_proxy.requests();
     assert_eq!(
         proxy_requests.len(),
 ,
         "HTTP request should not go through HTTPS-only proxy"
     );
--
     // Verify the direct server received the request
     let direct_requests = direct_server.requests();
     assert_eq!(
         direct_requests.len(),
 ,
         "Direct server should have received the HTTP request"
         (StatusCode::OK, "direct HTTP".to_string()),
         get(&client, &format!("http://{}/http-only", origin.addr()))
             .await
             .expect("direct HTTP request succeeds")
     );
     assert!(proxy.requests().is_empty());
-621
+}
-622
 /// Tests all-traffic proxy configuration
 /// Verifies that both HTTP and HTTPS requests go through all-traffic proxies
 #[tokio::test]
 async fn test_all_traffic_proxy() {
     let mock_proxy = MockProxyServer::with_response(StatusCode::OK, "all traffic proxy").await;
--
     // Configure proxy for all traffic
     let proxy_config = ProxyConfig::all(format!("http://{}", mock_proxy.addr())).unwrap();
 async fn test_https_only_proxy_bypasses_http_with_hyper_util_legacy_pool() {
     https_only_proxy_bypasses_http(&HyperUtilLegacyPool).await;
-+
+}
-627
     // HTTP request should go through the proxy
     let target_url = "http://aws.amazon.com/api/endpoint";
     let result = make_http_request_through_proxy(proxy_config.clone(), target_url).await;
 #[tokio::test]
 async fn test_https_only_proxy_bypasses_http_with_partitioned_connection_pool() {
     https_only_proxy_bypasses_http(&PartitionedConnectionPool).await;
-+
+}
-632
     let (status, body) = result.expect("HTTP request through all-traffic proxy should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "all traffic proxy");
 async fn all_traffic_proxy_forwards_http(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "all traffic").await;
     let config = ProxyConfig::all(format!("http://{}", proxy.addr())).expect("valid proxy");
     let client = http_client(backend, proxy_backend_config(config));
-637
     // Verify the proxy received the HTTP request
     let requests = mock_proxy.requests();
     assert_eq!(
         requests.len(),
 ,
         "Proxy should have received exactly one request"
         (StatusCode::OK, "all traffic".to_string()),
         get(&client, "http://service.test/all")
             .await
             .expect("all-traffic proxy request succeeds")
     );
     assert_eq!(requests[0].method, "GET");
     assert_eq!(requests[0].uri, target_url);
     assert_eq!("http://service.test/all", proxy.requests()[0].uri);
-645
+}
-646
 /// Tests proxy connection failure handling
 /// Verifies that unreachable proxy servers result in appropriate connection errors
 #[tokio::test]
 async fn test_proxy_connection_failure() {
     // Configure proxy pointing to non-existent server
     let proxy_config = ProxyConfig::http("http://127.0.0.1:1").unwrap(); // Port 1 should be unavailable
 async fn test_all_traffic_proxy_forwards_http_with_hyper_util_legacy_pool() {
     all_traffic_proxy_forwards_http(&HyperUtilLegacyPool).await;
-+
+}
-651
     // Make request through non-existent proxy - use a safe domain that won't cause issues
     let target_url = "http://aws.amazon.com/api/test";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
 #[tokio::test]
 async fn test_all_traffic_proxy_forwards_http_with_partitioned_connection_pool() {
     all_traffic_proxy_forwards_http(&PartitionedConnectionPool).await;
-+
+}
-656
     // The request should fail with a connection error
 async fn unreachable_proxy_fails(backend: &dyn HttpClientBackend) {
     let config = ProxyConfig::http("http://127.0.0.1:1").expect("valid proxy");
     let client = http_client(backend, proxy_backend_config(config));
     assert!(
         result.is_err(),
         "Request should fail when proxy is unreachable"
         get(&client, "http://service.test/unreachable")
             .await
             .is_err(),
         "an unreachable proxy must fail the request"
     );
-+
+}
-667
     let error = result.unwrap_err();
     let error_msg = error.to_string().to_lowercase();
--
     // Verify it's a connection-related error (not a different kind of error)
     assert!(
         error_msg.contains("connection")
             || error_msg.contains("refused")
             || error_msg.contains("unreachable")
             || error_msg.contains("timeout")
             || error_msg.contains("connect")
             || error_msg.contains("io error"), // Include generic IO errors
         "Error should be connection-related, got: {}",
         error
     );
 #[tokio::test]
 async fn test_unreachable_proxy_fails_with_hyper_util_legacy_pool() {
     unreachable_proxy_fails(&HyperUtilLegacyPool).await;
-671
+}
-672
 /// Tests proxy authentication failure handling
 /// Verifies that incorrect proxy credentials result in 407 Proxy Authentication Required
 #[tokio::test]
 async fn test_proxy_authentication_failure() {
     let mock_proxy = MockProxyServer::with_auth_validation("correct", "password").await;
 async fn test_unreachable_proxy_fails_with_partitioned_connection_pool() {
     unreachable_proxy_fails(&PartitionedConnectionPool).await;
-+
+}
-677
     // Configure proxy with wrong credentials
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr()))
         .unwrap()
 async fn incorrect_proxy_authentication_returns_407(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_auth_validation("correct", "password").await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("wrong", "credentials");
     let client = http_client(backend, proxy_backend_config(config));
-684
     // Make request with wrong credentials - use safe domain
     let target_url = "http://aws.amazon.com/secure/api";
     let result = make_http_request_through_proxy(proxy_config, target_url).await;
--
     // The request should return 407 Proxy Authentication Required
     let (status, _body) = result.expect("Request should complete (even with auth failure)");
     assert_eq!(status, StatusCode::PROXY_AUTHENTICATION_REQUIRED);
--
     // Verify the proxy received the request (even though auth failed)
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1, "Proxy should have received the request");
--
     // Verify the wrong credentials were sent
     let expected_wrong_auth = format!(
         "Basic {}",
         base64::prelude::BASE64_STANDARD.encode("wrong:credentials")
     assert_eq!(
         StatusCode::PROXY_AUTHENTICATION_REQUIRED,
         get(&client, "http://service.test/denied")
             .await
             .expect("proxy response is returned")
             .0
     );
     assert_eq!(
         requests[0].headers.get("proxy-authorization"),
         Some(&expected_wrong_auth)
         Some(&basic_authorization("wrong", "credentials")),
         proxy.requests()[0].headers.get("proxy-authorization")
     );
-696
+}
-697
 /// Tests that ProxyConfig::disabled() overrides environment proxy settings
 /// Verifies that explicit proxy disabling takes precedence over environment variables
 #[tokio::test]
 async fn test_explicit_proxy_disable_overrides_environment() {
     let mock_proxy = MockProxyServer::new(|_req| {
         panic!("Request should not reach proxy when explicitly disabled");
     })
     .await;
--
     // Create a direct target server
     let direct_server = MockProxyServer::with_response(StatusCode::OK, "direct connection").await;
--
     with_env_vars(
         &[("HTTP_PROXY", &format!("http://{}", mock_proxy.addr()))],
         || async {
             // Create connector with explicitly disabled proxy (should override environment)
             let proxy_config = ProxyConfig::disabled();
--
             // Make request - should go direct despite HTTP_PROXY environment variable
             let target_url = format!("http://{}/test", direct_server.addr());
             let result = make_http_request_through_proxy(proxy_config, &target_url).await;
--
             let (status, body) = result.expect("Direct connection should succeed");
             assert_eq!(status, StatusCode::OK);
             assert_eq!(body, "direct connection");
--
             // Verify the proxy received no requests (disabled)
             let proxy_requests = mock_proxy.requests();
             assert_eq!(
                 proxy_requests.len(),
 ,
                 "Proxy should not receive requests when explicitly disabled"
             );
--
             // Verify the direct server received the request
             let direct_requests = direct_server.requests();
             assert_eq!(
                 direct_requests.len(),
 ,
                 "Direct server should have received the request"
             );
         },
--
+    )
     .await;
 async fn test_incorrect_proxy_authentication_returns_407_with_hyper_util_legacy_pool() {
     incorrect_proxy_authentication_returns_407(&HyperUtilLegacyPool).await;
-701
+}
-702
 // ================================================================================================
 // HTTPS/CONNECT Tunneling Tests
 // ================================================================================================
 //
 // These tests are for HTTPS tunneling through HTTP proxies using the CONNECT method.
--
 /// Helper function to make HTTPS requests through proxy using TLS providers
 /// This is similar to make_http_request_through_proxy but uses TLS-enabled connectors
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn make_https_request_through_proxy(
     proxy_config: ProxyConfig,
     target_url: &str,
     tls_provider: tls::Provider,
 ) -> Result<(StatusCode, String), Box<dyn std::error::Error + Send + Sync>> {
     let http_client = http_client_fn(move |settings, _components| {
         let connector = Connector::builder()
             .proxy_config(proxy_config.clone())
             .connector_settings(settings.clone())
             .tls_provider(tls_provider.clone())
             .build();
--
         aws_smithy_runtime_api::client::http::SharedHttpConnector::new(connector)
     });
--
     let connector_settings = HttpConnectorSettings::builder().build();
     let runtime_components = RuntimeComponentsBuilder::for_tests()
         .with_time_source(Some(SystemTimeSource::new()))
         .build()
         .unwrap();
--
     let http_connector = http_client.http_connector(&connector_settings, &runtime_components);
--
     let request = HttpRequest::get(target_url)
         .map_err(|e| Box::new(e) as Box<dyn std::error::Error + Send + Sync>)?;
--
     let response = http_connector.call(request).await?;
--
     let status = response.status();
     let body_bytes = response.into_body().collect().await?.to_bytes();
     let body_string = String::from_utf8(body_bytes.to_vec())?;
--
     Ok((status.into(), body_string))
--
+}
--
 /// Generic test function for HTTPS CONNECT with authentication
 /// Tests that HTTPS requests through HTTP proxy use CONNECT method with proper auth headers
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn run_https_connect_with_auth_test(tls_provider: tls::Provider, provider_name: &str) {
     let mock_proxy = MockProxyServer::new(|req| {
         // For HTTPS through HTTP proxy, we should see a CONNECT request
         assert_eq!(req.method, "CONNECT");
         assert_eq!(req.uri, "secure.aws.amazon.com:443");
--
         // Verify authentication header is present
         let expected_auth = format!(
             "Basic {}",
             base64::prelude::BASE64_STANDARD.encode("connectuser:connectpass")
 #[tokio::test]
 async fn test_incorrect_proxy_authentication_returns_407_with_partitioned_connection_pool() {
     incorrect_proxy_authentication_returns_407(&PartitionedConnectionPool).await;
-+
+}
-+
 async fn disabled_proxy_overrides_environment(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "unexpected proxy").await;
     let origin = MockHttpServer::with_response(StatusCode::OK, "direct").await;
     let proxy_uri = format!("http://{}", proxy.addr());
     with_env_vars(&[("HTTP_PROXY", &proxy_uri)], || async {
         let client = http_client(backend, proxy_backend_config(ProxyConfig::disabled()));
         assert_eq!(
             (StatusCode::OK, "direct".to_string()),
             get(&client, &format!("http://{}/disabled", origin.addr()))
                 .await
                 .expect("direct request succeeds")
         );
         assert_eq!(req.headers.get("proxy-authorization"), Some(&expected_auth));
--
         // Return 400 to avoid dealing with actual TLS tunneling
         // The important part is that we got the CONNECT request with correct auth
         Response::builder()
             .status(StatusCode::BAD_REQUEST)
             .body("CONNECT tunnel setup failed".to_string())
             .unwrap()
     })
     .await;
     assert!(proxy.requests().is_empty());
     assert_eq!("/disabled", origin.requests()[0].uri);
-+
+}
-725
     // Configure proxy with authentication
     let proxy_config = ProxyConfig::all(format!("http://{}", mock_proxy.addr()))
         .unwrap()
         .with_basic_auth("connectuser", "connectpass");
--
     // Make HTTPS request - should trigger CONNECT method
     let target_url = "https://secure.aws.amazon.com/api/secure";
     let result = make_https_request_through_proxy(proxy_config, target_url, tls_provider).await;
 #[tokio::test]
 async fn test_disabled_proxy_overrides_environment_with_hyper_util_legacy_pool() {
     disabled_proxy_overrides_environment(&HyperUtilLegacyPool).await;
-+
+}
-730
     // We expect this to fail with a connection error since we returned 400
     // The important thing is that the CONNECT request was made correctly
     assert!(
         result.is_err(),
         "CONNECT tunnel should fail with 400 response for {}",
         provider_name
 #[tokio::test]
 async fn test_disabled_proxy_overrides_environment_with_partitioned_connection_pool() {
     disabled_proxy_overrides_environment(&PartitionedConnectionPool).await;
-+
+}
-+
 async fn idle_proxy_connection_is_evicted(backend: &dyn HttpClientBackend) {
     let proxy = MockHttpServer::with_response(StatusCode::OK, "proxied").await;
     let config = ProxyConfig::http(format!("http://{}", proxy.addr())).expect("valid proxy");
     let client = http_client(
         backend,
         BackendConfig {
             pool_idle_timeout: Some(Duration::from_millis(100)),
             ..proxy_backend_config(config)
         },
     );
-746
     // Verify the proxy received the CONNECT request
     let requests = mock_proxy.requests();
     assert_eq!(
         requests.len(),
 ,
         "Proxy should have received exactly one CONNECT request for {}",
         provider_name
         StatusCode::OK,
         get(&client, "http://service.test/idle")
             .await
             .expect("proxy request succeeds")
             .0
     );
     assert_eq!(1, proxy.connection_count());
-+
     tokio::time::timeout(Duration::from_secs(2), async {
         while proxy.connection_count() != 0 {
             tokio::time::sleep(Duration::from_millis(10)).await;
-+
+        }
     })
     .await
     .expect("idle proxy connection should close");
-763
+}
-764
 /// Generic test function for CONNECT without authentication (should get 407)
 /// Tests that HTTPS requests without auth get proper 407 response
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn run_https_connect_auth_required_test(tls_provider: tls::Provider, provider_name: &str) {
     let mock_proxy = MockProxyServer::new(|req| {
         // For HTTPS through HTTP proxy, we should see a CONNECT request
         assert_eq!(req.method, "CONNECT");
         assert_eq!(req.uri, "secure.aws.amazon.com:443");
 #[tokio::test]
 async fn test_idle_proxy_connection_is_evicted_with_hyper_util_legacy_pool() {
     idle_proxy_connection_is_evicted(&HyperUtilLegacyPool).await;
-+
+}
-769
         // No auth header should be present
         assert!(!req.headers.contains_key("proxy-authorization"));
 #[tokio::test]
 async fn test_idle_proxy_connection_is_evicted_with_partitioned_connection_pool() {
     idle_proxy_connection_is_evicted(&PartitionedConnectionPool).await;
-+
+}
-774
         // Return 407 Proxy Authentication Required
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn https_connect_uses_authority_form_and_authentication(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) {
     let expected = basic_authorization("connectuser", "connectpass");
     let expected_for_handler = expected.clone();
     let proxy = MockHttpServer::new(move |request| {
         assert_eq!("CONNECT", request.method);
         assert_eq!("secure.example.com:443", request.uri);
         assert_eq!(
             Some(&expected_for_handler),
             request.headers.get("proxy-authorization")
         );
         Response::builder()
             .status(StatusCode::PROXY_AUTHENTICATION_REQUIRED)
             .body("Proxy authentication required for CONNECT".to_string())
             .unwrap()
             .status(StatusCode::BAD_REQUEST)
             .body("tunnel rejected".to_string())
             .expect("valid response")
     })
     .await;
--
     // Configure proxy without authentication
     let proxy_config = ProxyConfig::all(format!("http://{}", mock_proxy.addr())).unwrap();
--
     // Make HTTPS request - should trigger CONNECT method and get 407
     let target_url = "https://secure.aws.amazon.com/api/secure";
     let result = make_https_request_through_proxy(proxy_config, target_url, tls_provider).await;
--
     // We expect this to fail with a connection error since we returned 407
     assert!(
         result.is_err(),
         "CONNECT tunnel should fail with 407 response for {}",
         provider_name
     let config = ProxyConfig::all(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("connectuser", "connectpass");
     let client = https_client(
         backend,
         proxy_backend_config(config),
         provider,
         tls::TlsContext::default(),
     );
-804
     let error_msg = result.unwrap_err().to_string();
     let error_msg_lower = error_msg.to_lowercase();
--
     // The important thing is that the request failed (which means CONNECT was attempted)
     // The specific error message format is less critical for this test
     // We accept either specific proxy auth errors OR generic connection errors
     // since both indicate the CONNECT tunnel attempt was made
     assert!(
         error_msg_lower.contains("407")
             || error_msg_lower.contains("proxy")
             || error_msg_lower.contains("auth")
             || error_msg_lower.contains("io error")
             || error_msg_lower.contains("connection"),
         "Error should be connection-related (indicating CONNECT was attempted) for {}, got: {}",
         provider_name,
         error_msg
     );
--
     // Verify the proxy received the CONNECT request
     let requests = mock_proxy.requests();
     assert_eq!(
         requests.len(),
 ,
         "Proxy should have received exactly one CONNECT request for {}",
         provider_name
         get(&client, "https://secure.example.com/private")
             .await
             .is_err(),
         "a rejected CONNECT request must fail"
     );
     assert_eq!(1, proxy.requests().len());
-812
+}
-813
 /// Tests HTTPS tunneling through HTTP proxy with CONNECT method (rustls provider)
 /// Verifies that HTTPS requests through HTTP proxy use CONNECT method with authentication
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_https_connect_with_auth_rustls() {
     run_https_connect_with_auth_test(
 async fn test_https_connect_form_and_auth_with_rustls_and_hyper_util_legacy_pool() {
     https_connect_uses_authority_form_and_authentication(
         &HyperUtilLegacyPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
         "rustls",
-820
+    )
     .await;
-822
+}
-823
 /// Tests CONNECT method without authentication (should get 407) - rustls provider
 /// Verifies that HTTPS requests without auth get proper 407 response
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_https_connect_auth_required_rustls() {
     run_https_connect_auth_required_test(
 async fn test_https_connect_form_and_auth_with_rustls_and_partitioned_connection_pool() {
     https_connect_uses_authority_form_and_authentication(
         &PartitionedConnectionPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
         "rustls",
-830
+    )
     .await;
-832
+}
-833
 /// Tests HTTPS tunneling through HTTP proxy with CONNECT method (s2n-tls provider)
 /// Verifies that HTTPS requests through HTTP proxy use CONNECT method with authentication
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_connect_with_auth_s2n_tls() {
     run_https_connect_with_auth_test(tls::Provider::S2nTls, "s2n-tls").await;
 async fn test_https_connect_form_and_auth_with_s2n_tls_and_hyper_util_legacy_pool() {
     https_connect_uses_authority_form_and_authentication(
         &HyperUtilLegacyPool,
         tls::Provider::S2nTls,
-+
+    )
     .await;
-842
+}
-843
 /// Tests CONNECT method without authentication (should get 407) - s2n-tls provider
 /// Verifies that HTTPS requests without auth get proper 407 response
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_connect_auth_required_s2n_tls() {
     run_https_connect_auth_required_test(tls::Provider::S2nTls, "s2n-tls").await;
 async fn test_https_connect_form_and_auth_with_s2n_tls_and_partitioned_connection_pool() {
     https_connect_uses_authority_form_and_authentication(
         &PartitionedConnectionPool,
         tls::Provider::S2nTls,
-+
+    )
     .await;
-852
+}
-853
 /// Tests that HTTP requests through proxy use absolute URI form
 /// Verifies that the full URL (including hostname) is sent to the proxy
 #[tokio::test]
 async fn test_http_proxy_absolute_uri_form() {
     let target_host = "api.example.com";
     let target_path = "/v1/data";
     let expected_absolute_uri = format!("http://{}{}", target_host, target_path);
--
     // Clone for use in closure
     let expected_uri_clone = expected_absolute_uri.clone();
     let target_host_clone = target_host.to_string();
--
     let mock_proxy = MockProxyServer::new(move |req| {
         // For HTTP through proxy, we should see the full absolute URI
         assert_eq!(req.method, "GET");
         assert_eq!(req.uri, expected_uri_clone);
--
         // Host header should still be present
         assert_eq!(req.headers.get("host"), Some(&target_host_clone));
--
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn https_connect_without_authentication_is_rejected(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) {
     let proxy = MockHttpServer::new(|request| {
         assert_eq!("CONNECT", request.method);
         assert_eq!("secure.example.com:443", request.uri);
         assert!(!request.headers.contains_key("proxy-authorization"));
         Response::builder()
             .status(StatusCode::OK)
             .body("proxied response".to_string())
             .unwrap()
             .status(StatusCode::PROXY_AUTHENTICATION_REQUIRED)
             .body("authentication required".to_string())
             .expect("valid response")
     })
     .await;
     let config = ProxyConfig::all(format!("http://{}", proxy.addr())).expect("valid proxy");
     let client = https_client(
         backend,
         proxy_backend_config(config),
         provider,
         tls::TlsContext::default(),
     );
-876
     let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr())).unwrap();
--
     let result = make_http_request_through_proxy(proxy_config, &expected_absolute_uri).await;
--
     let (status, body) = result.expect("HTTP request through proxy should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "proxied response");
--
     // Verify the proxy received the request with absolute URI
     let requests = mock_proxy.requests();
     assert_eq!(requests.len(), 1);
     assert_eq!(requests[0].uri, expected_absolute_uri);
     assert!(
         get(&client, "https://secure.example.com/private")
             .await
             .is_err(),
         "a 407 CONNECT response must fail"
     );
     assert_eq!(1, proxy.requests().len());
-884
+}
-885
 /// Tests that direct HTTP requests (no proxy) use origin form URI
 /// Verifies that only the path is sent when connecting directly
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_direct_http_origin_uri_form() {
     let target_path = "/v1/data";
--
     // Create a direct target server (no proxy)
     let direct_server = MockProxyServer::new(move |req| {
         // For direct connections, we should see only the path (origin form)
         assert_eq!(req.method, "GET");
         // The URI should be just the path part, not the full URL
         assert!(
             req.uri == target_path || req.uri.ends_with(target_path),
             "Expected origin form URI ending with '{}', got '{}'",
             target_path,
             req.uri
         );
--
         Response::builder()
             .status(StatusCode::OK)
             .body("direct response".to_string())
             .unwrap()
     })
 async fn test_https_connect_without_auth_with_rustls_and_hyper_util_legacy_pool() {
     https_connect_without_authentication_is_rejected(
         &HyperUtilLegacyPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
--
     // Use disabled proxy to ensure direct connection
     let proxy_config = ProxyConfig::disabled();
--
     let target_url = format!("http://{}{}", direct_server.addr(), target_path);
     let result = make_http_request_through_proxy(proxy_config, &target_url).await;
--
     let (status, body) = result.expect("Direct HTTP request should succeed");
     assert_eq!(status, StatusCode::OK);
     assert_eq!(body, "direct response");
--
     // Verify the server received the request
     let requests = direct_server.requests();
     assert_eq!(requests.len(), 1);
-894
+}
-895
 /// Tests URI form handling with different proxy configurations
 /// Verifies that URI form changes based on proxy vs direct connection
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_uri_form_proxy_vs_direct() {
     let target_host = "test.example.com";
     let target_path = "/api/test";
     let full_url = format!("http://{}{}", target_host, target_path);
--
     // Test 1: Through proxy - should use absolute form
--
+    {
         // Clone for use in closure
         let target_host_clone = target_host.to_string();
         let target_path_clone = target_path.to_string();
--
         let mock_proxy = MockProxyServer::new(move |req| {
             // Should receive absolute URI
             assert!(req.uri.starts_with("http://"));
             assert!(req.uri.contains(&target_host_clone));
             assert!(req.uri.contains(&target_path_clone));
--
             Response::builder()
                 .status(StatusCode::OK)
                 .body("proxy response".to_string())
                 .unwrap()
         })
         .await;
--
         let proxy_config = ProxyConfig::http(format!("http://{}", mock_proxy.addr())).unwrap();
         let result = make_http_request_through_proxy(proxy_config, &full_url).await;
--
         assert!(result.is_ok(), "Proxy request should succeed");
         let requests = mock_proxy.requests();
         assert_eq!(requests.len(), 1);
         assert_eq!(requests[0].uri, full_url);
--
+    }
--
     // Test 2: Direct connection - should use origin form
--
+    {
         let target_path_clone = target_path.to_string();
--
         let direct_server = MockProxyServer::new(move |req| {
             // Should receive only the path part
             assert!(!req.uri.starts_with("http://"));
             assert!(req.uri == target_path_clone || req.uri.ends_with(&target_path_clone));
 async fn test_https_connect_without_auth_with_rustls_and_partitioned_connection_pool() {
     https_connect_without_authentication_is_rejected(
         &PartitionedConnectionPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-905
             Response::builder()
                 .status(StatusCode::OK)
                 .body("direct response".to_string())
                 .unwrap()
         })
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_connect_without_auth_with_s2n_tls_and_hyper_util_legacy_pool() {
     https_connect_without_authentication_is_rejected(&HyperUtilLegacyPool, tls::Provider::S2nTls)
         .await;
--
         let proxy_config = ProxyConfig::disabled();
         let direct_url = format!("http://{}{}", direct_server.addr(), target_path);
         let result = make_http_request_through_proxy(proxy_config, &direct_url).await;
--
         assert!(result.is_ok(), "Direct request should succeed");
         let requests = direct_server.requests();
         assert_eq!(requests.len(), 1);
--
+    }
-911
+}
-912
 /// Generic test function for CONNECT URI form validation
 /// Tests that CONNECT requests use the correct host:port format
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn run_connect_uri_form_test(tls_provider: tls::Provider, provider_name: &str) {
     let target_host = "secure.example.com";
     let target_port = 443;
     let expected_connect_uri = format!("{}:{}", target_host, target_port);
--
     // Clone for use in closure
     let expected_uri_clone = expected_connect_uri.clone();
--
     let mock_proxy = MockProxyServer::new(move |req| {
         if req.method == "CONNECT" {
             // CONNECT should use host:port format
             assert_eq!(req.uri, expected_uri_clone);
--
             // CONNECT requests should not have a Host header in the CONNECT line
             // (the Host header is for the tunneled HTTP request, not the CONNECT)
--
             Response::builder()
                 .status(StatusCode::OK)
                 .body("Connection established".to_string())
                 .unwrap()
         } else {
             // This shouldn't happen in our test, but handle it gracefully
             Response::builder()
                 .status(StatusCode::BAD_REQUEST)
                 .body("Unexpected non-CONNECT request".to_string())
                 .unwrap()
--
+        }
     })
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_https_connect_without_auth_with_s2n_tls_and_partitioned_connection_pool() {
     https_connect_without_authentication_is_rejected(
         &PartitionedConnectionPool,
         tls::Provider::S2nTls,
-+
+    )
     .await;
-+
+}
-922
     let proxy_config = ProxyConfig::all(format!("http://{}", mock_proxy.addr())).unwrap();
--
     // Try to make an HTTPS request - this should trigger CONNECT
     let target_url = format!("https://{}/api/secure", target_host);
 #[cfg(any(feature = "rustls-ring", feature = "s2n-tls"))]
 async fn tunneled_https_request_uses_origin_form(
     backend: &dyn HttpsClientBackend,
     provider: tls::Provider,
 ) {
     let origin = MockTlsOrigin::new("tunneled response").await;
     let authorization = basic_authorization("connectuser", "connectpass");
     let proxy = MockConnectProxy::relay_to(origin.addr(), Some(authorization.clone())).await;
     let config = ProxyConfig::all(format!("http://{}", proxy.addr()))
         .expect("valid proxy")
         .with_basic_auth("connectuser", "connectpass");
     let client = https_client(
         backend,
         proxy_backend_config(config),
         provider,
         test_tls::SERVER_IDENTITY.client_context(),
     );
     let target = format!("https://localhost:{}/inside?value=1", origin.addr().port());
-941
     let _result = make_https_request_through_proxy(proxy_config, &target_url, tls_provider).await;
     assert_eq!(
         (StatusCode::OK, "tunneled response".to_string()),
         get(&client, &target)
             .await
             .expect("tunneled HTTPS request succeeds")
     );
-948
     // The request will likely fail due to our mock setup, but that's OK
     // The important thing is that the CONNECT request was made with correct URI
     let requests = mock_proxy.requests();
     let proxy_requests = proxy.requests();
     assert_eq!(1, proxy_requests.len());
     assert_eq!("CONNECT", proxy_requests[0].method);
     assert_eq!(
         format!("localhost:{}", origin.addr().port()),
         proxy_requests[0].uri
     );
     assert_eq!(
         requests.len(),
 ,
         "Should have received exactly one CONNECT request for {}",
         provider_name
         Some(&authorization),
         proxy_requests[0].headers.get("proxy-authorization")
     );
-+
     let origin_requests = origin.requests();
     assert_eq!(1, origin_requests.len());
     assert_eq!("GET", origin_requests[0].method);
     assert_eq!("/inside?value=1", origin_requests[0].uri);
     assert!(
         !origin_requests[0]
             .headers
             .contains_key("proxy-authorization"),
         "proxy credentials must not cross the CONNECT tunnel"
     );
     assert_eq!(requests[0].method, "CONNECT");
     assert_eq!(requests[0].uri, expected_connect_uri);
-971
+}
-972
 /// Tests CONNECT method URI form for HTTPS tunneling - rustls provider
 /// Verifies that CONNECT requests use the correct host:port format
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_connect_uri_form_rustls() {
     run_connect_uri_form_test(
 async fn test_tunneled_https_origin_form_with_rustls_and_hyper_util_legacy_pool() {
     tunneled_https_request_uses_origin_form(
         &HyperUtilLegacyPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
-+
+    )
     .await;
-+
+}
-+
 #[cfg(feature = "rustls-ring")]
 #[tokio::test]
 async fn test_tunneled_https_origin_form_with_rustls_and_partitioned_connection_pool() {
     tunneled_https_request_uses_origin_form(
         &PartitionedConnectionPool,
         tls::Provider::rustls(tls::rustls_provider::CryptoMode::Ring),
         "rustls",
-989
+    )
     .await;
-991
+}
-992
 /// Tests CONNECT method URI form for HTTPS tunneling - s2n-tls provider
 /// Verifies that CONNECT requests use the correct host:port format
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_connect_uri_form_s2n_tls() {
     run_connect_uri_form_test(tls::Provider::S2nTls, "s2n-tls").await;
 async fn test_tunneled_https_origin_form_with_s2n_tls_and_hyper_util_legacy_pool() {
     tunneled_https_request_uses_origin_form(&HyperUtilLegacyPool, tls::Provider::S2nTls).await;
-+
+}
-+
 #[cfg(feature = "s2n-tls")]
 #[tokio::test]
 async fn test_tunneled_https_origin_form_with_s2n_tls_and_partitioned_connection_pool() {
     tunneled_https_request_uses_origin_form(&PartitionedConnectionPool, tls::Provider::S2nTls)
         .await;
-1004
+}

Pages: 1 2 3