fix: reuse single HttpClient across SealPipeline calls (#19)

Previously SealPipeline.SealAndUploadAsync constructed two HttpClient
instances per call (one for PKG, one for Cryptify), then disposed them.
Under sustained load this exhausts the ephemeral socket range as the
underlying connections accumulate in TIME_WAIT — the classic .NET
HttpClient anti-pattern.

PostGuard now owns a single long-lived HttpClient (SocketsHttpHandler
with PooledConnectionLifetime = 2min so DNS changes are still picked
up) and passes it down to SealPipeline. Callers can also inject their
own HttpClient via PostGuardConfig.HttpClient (DI-friendly; the SDK
does not dispose injected clients). A new PostGuardConfig.Timeout
knob exposes the previously-hidden default 100s.

Closes #11

Co-authored-by: dobby-yivi-agent[bot] <275734547+dobby-yivi-agent[bot]@users.noreply.github.com>

Author: dobby-coder[bot]

src/Crypto/SealPipeline.cs

@@ -15,13 +15,13 @@ internal static class SealPipeline
     /// </summary>
     public static async Task<UploadResult> SealAndUploadAsync(
         PostGuardConfig config,
+        HttpClient http,
         EncryptInput input,
         UploadOptions? uploadOptions,
         CancellationToken ct = default)
     {
-        var sealedBytes = await SealAsync(config, input, ct);
+        var sealedBytes = await SealAsync(config, http, input, ct);
 
-        using var http = CreateHttpClient(config);
         var cryptify = new CryptifyClient(http, config.CryptifyUrl);
         var uuid = await cryptify.UploadAsync(
             sealedBytes, input.Recipients, uploadOptions?.Notify, ct);
@@ -34,14 +34,14 @@ public static async Task<UploadResult> SealAndUploadAsync(
     /// </summary>
     public static async Task<byte[]> SealAsync(
         PostGuardConfig config,
+        HttpClient http,
         EncryptInput input,
         CancellationToken ct = default)
     {
         var apiKey = input.Sign is ApiKeySign ak
             ? ak.ApiKey
             : throw new ArgumentException("Only ApiKey signing is supported");
 
-        using var http = CreateHttpClient(config);
         var pkg = new PkgClient(http, config.PkgUrl);
 
         // Fetch MPK and signing keys in parallel
@@ -94,17 +94,4 @@ internal static string BuildPolicyJson(IReadOnlyList<RecipientBuilder> recipient
 
         return JsonSerializer.Serialize(policy);
     }
-
-    private static HttpClient CreateHttpClient(PostGuardConfig config)
-    {
-        var http = new HttpClient();
-        if (config.Headers != null)
-        {
-            foreach (var (key, value) in config.Headers)
-            {
-                http.DefaultRequestHeaders.TryAddWithoutValidation(key, value);
-            }
-        }
-        return http;
-    }
 }

src/PostGuard.cs

@@ -2,15 +2,48 @@
 
 namespace E4A.PostGuard;
 
-public class PostGuard
+public class PostGuard : IDisposable
 {
     private readonly PostGuardConfig _config;
+    private readonly HttpClient _http;
+    private readonly bool _ownsHttp;
+    private bool _disposed;
 
     public PostGuard(PostGuardConfig config)
     {
         ArgumentNullException.ThrowIfNull(config);
         config.Validate();
         _config = config;
+
+        if (config.HttpClient is not null)
+        {
+            _http = config.HttpClient;
+            _ownsHttp = false;
+        }
+        else
+        {
+            // SocketsHttpHandler with a bounded PooledConnectionLifetime so a
+            // long-lived client still picks up DNS changes — recommended pattern
+            // for singleton HttpClient. See:
+            // https://learn.microsoft.com/en-us/dotnet/fundamentals/networking/http/httpclient-guidelines
+            var handler = new SocketsHttpHandler
+            {
+                PooledConnectionLifetime = TimeSpan.FromMinutes(2),
+            };
+            _http = new HttpClient(handler, disposeHandler: true);
+            if (config.Timeout is { } timeout)
+            {
+                _http.Timeout = timeout;
+            }
+            if (config.Headers is not null)
+            {
+                foreach (var (key, value) in config.Headers)
+                {
+                    _http.DefaultRequestHeaders.TryAddWithoutValidation(key, value);
+                }
+            }
+            _ownsHttp = true;
+        }
     }
 
     /// <summary>
@@ -30,7 +63,18 @@ public PostGuard(PostGuardConfig config)
     /// </summary>
     public Sealed Encrypt(EncryptInput input)
     {
-        return new Sealed(_config, input);
+        return new Sealed(_config, _http, input);
+    }
+
+    public void Dispose()
+    {
+        if (_disposed) return;
+        _disposed = true;
+        if (_ownsHttp)
+        {
+            _http.Dispose();
+        }
+        GC.SuppressFinalize(this);
     }
 }
 

src/PostGuardConfig.cs

@@ -13,6 +13,22 @@ public class PostGuardConfig
     /// </summary>
     public bool AllowInsecureUrls { get; init; }
 
+    /// <summary>
+    /// Optional caller-supplied <see cref="System.Net.Http.HttpClient"/>. When
+    /// set, the SDK reuses this client for all PKG and Cryptify calls and does
+    /// NOT dispose it — ownership stays with the caller (DI-friendly). When
+    /// null, <see cref="PostGuard"/> creates and owns a single long-lived client.
+    /// </summary>
+    public HttpClient? HttpClient { get; init; }
+
+    /// <summary>
+    /// Request timeout applied to the SDK-owned <see cref="System.Net.Http.HttpClient"/>.
+    /// Ignored when <see cref="HttpClient"/> is supplied (the caller owns the
+    /// timeout in that case). Defaults to <see cref="System.Net.Http.HttpClient"/>'s
+    /// own default of 100 seconds when null.
+    /// </summary>
+    public TimeSpan? Timeout { get; init; }
+
     internal void Validate()
     {
         if (AllowInsecureUrls)

src/Sealed.cs

@@ -10,11 +10,13 @@ namespace E4A.PostGuard;
 public class Sealed
 {
     private readonly PostGuardConfig _config;
+    private readonly HttpClient _http;
     private readonly EncryptInput _input;
 
-    internal Sealed(PostGuardConfig config, EncryptInput input)
+    internal Sealed(PostGuardConfig config, HttpClient http, EncryptInput input)
     {
         _config = config;
+        _http = http;
         _input = input;
     }
 
@@ -28,7 +30,7 @@ public async Task<UploadResult> UploadAsync(
         UploadOptions? options = null,
         CancellationToken ct = default)
     {
-        return await SealPipeline.SealAndUploadAsync(_config, _input, options, ct);
+        return await SealPipeline.SealAndUploadAsync(_config, _http, _input, options, ct);
     }
 
     /// <summary>
@@ -38,6 +40,6 @@ public async Task<UploadResult> UploadAsync(
     /// <returns>The sealed (encrypted + signed) byte array.</returns>
     public async Task<byte[]> ToBytesAsync(CancellationToken ct = default)
     {
-        return await SealPipeline.SealAsync(_config, _input, ct);
+        return await SealPipeline.SealAsync(_config, _http, _input, ct);
     }
 }

tests/E4A.PostGuard.Tests/PostGuardConfigTests.cs

@@ -91,4 +91,55 @@ public void Ctor_NullConfig_Throws()
     {
         Assert.Throws<ArgumentNullException>(() => new PostGuard(null!));
     }
+
+    [Fact]
+    public void Dispose_DoesNotDisposeInjectedHttpClient()
+    {
+        using var injected = new HttpClient();
+        var config = new PostGuardConfig
+        {
+            PkgUrl = ValidPkg,
+            CryptifyUrl = ValidCryptify,
+            HttpClient = injected,
+        };
+
+        var pg = new PostGuard(config);
+        pg.Dispose();
+
+        // If injected was disposed, this throws ObjectDisposedException.
+        injected.DefaultRequestHeaders.TryAddWithoutValidation("X-Test", "ok");
+    }
+
+    [Fact]
+    public void Dispose_DisposesOwnedHttpClient()
+    {
+        var config = new PostGuardConfig
+        {
+            PkgUrl = ValidPkg,
+            CryptifyUrl = ValidCryptify,
+        };
+
+        var pg = new PostGuard(config);
+        pg.Dispose();
+        // Calling Dispose twice must be safe.
+        pg.Dispose();
+    }
+
+    [Fact]
+    public void Ctor_AppliesTimeoutToOwnedClient()
+    {
+        var config = new PostGuardConfig
+        {
+            PkgUrl = ValidPkg,
+            CryptifyUrl = ValidCryptify,
+            Timeout = TimeSpan.FromSeconds(42),
+        };
+
+        using var pg = new PostGuard(config);
+
+        // No exception during construction; the Timeout property is applied
+        // internally — see PostGuard ctor. We can at least verify the SDK
+        // accepts the value without throwing.
+        Assert.NotNull(pg);
+    }
 }