api.go

// Copyright the Open Container Initiative Contributors.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//	http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package main

import (
	"bytes"
	"encoding/base64"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"maps"
	"net/http"
	"net/url"
	"regexp"
	"slices"
	"strconv"
	"strings"

	specs "github.com/opencontainers/distribution-spec/specs-go/v1"
	digest "github.com/opencontainers/go-digest"
	image "github.com/opencontainers/image-spec/specs-go/v1"
)

var emptyDigest = digest.Canonical.FromBytes([]byte{})

type api struct {
	client     *http.Client
	user, pass string
	authCache  map[string]string
}

type apiOpt func(*api)

func apiNew(client *http.Client, opts ...apiOpt) *api {
	a := &api{
		client: client,
	}
	for _, opt := range opts {
		opt(a)
	}
	return a
}

func apiWithAuth(user, pass string, cacheAuth bool) apiOpt {
	return func(a *api) {
		a.user = user
		a.pass = pass
		if cacheAuth {
			a.authCache = map[string]string{}
		}
	}
}

type apiDoOpt struct {
	reqFn  func(*http.Request) error
	respFn func(*http.Response) error
	out    io.Writer
	flags  map[string]bool
}

func (a *api) Do(opts ...apiDoOpt) error {
	errs := []error{}
	reqFns := []func(*http.Request) error{}
	respFns := []func(*http.Response) error{}
	var out io.Writer
	for _, opt := range opts {
		if opt.reqFn != nil {
			reqFns = append(reqFns, opt.reqFn)
		}
		if opt.respFn != nil {
			respFns = append(respFns, opt.respFn)
		}
		if opt.out != nil {
			out = opt.out
		}
	}
	req, err := http.NewRequest(http.MethodGet, "", nil)
	if err != nil {
		return err
	}
	for _, reqFn := range reqFns {
		err := reqFn(req)
		if err != nil {
			errs = append(errs, err)
		}
	}
	if len(errs) == 1 {
		return errs[0]
	} else if len(errs) > 1 {
		return errors.Join(errs...)
	}
	// add cached auth header if available
	if a.authCache != nil {
		err = a.addCachedAuth(req)
		if err != nil {
			return err
		}
	}
	if out != nil {
		out = redactWriter{w: out}
	}
	wt := &wrapTransport{out: out, orig: a.client.Transport}
	if a.client.Transport == nil {
		wt.orig = http.DefaultTransport
	}
	c := *a.client
	c.Transport = wt
	resp, err := c.Do(req)
	if err != nil {
		return err
	}
	// on auth failures, generate the auth header and retry
	if resp.StatusCode == http.StatusUnauthorized {
		auth, err := a.getAuthHeader(c, resp)
		if err != nil {
			errs = append(errs, err)
		}
		if resp.Body != nil {
			_ = resp.Body.Close()
		}
		if err == nil && auth != "" {
			req.Header.Set("Authorization", auth)
			if req.GetBody != nil {
				req.Body, err = req.GetBody()
				if err != nil {
					return fmt.Errorf("failed to reset body after auth request: %w", err)
				}
			}
			resp, err = c.Do(req)
			if err != nil {
				return err
			}
		}
	}
	for _, respFn := range respFns {
		err := respFn(resp)
		if err != nil {
			errs = append(errs, err)
		}
	}
	if resp.Body != nil {
		_ = resp.Body.Close()
	}
	if len(errs) == 1 {
		return errs[0]
	} else if len(errs) > 1 {
		return errors.Join(errs...)
	}
	return nil
}

func (a *api) GetFlags(opts ...apiDoOpt) map[string]bool {
	ret := map[string]bool{}
	for _, opt := range opts {
		maps.Copy(ret, opt.flags)
	}
	return ret
}

func (a *api) VerifyDigest(resp *http.Response, dig digest.Digest, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	digHeader := resp.Header.Get("Docker-Content-Digest")
	if digHeader == "" && flags["RequireDigestHeader"] {
		return fmt.Errorf("registry did not return a Docker-Content-Digest header")
	}
	if digHeader != "" && dig.String() != "" && digHeader != dig.String() {
		return fmt.Errorf("Docker-Content-Digest header value expected %q, received %q", dig.String(), digHeader)
	}
	return nil
}

func (a *api) BlobDelete(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/" + dig.String())
	if err != nil {
		return err
	}
	var status int
	err = a.Do(
		apiWithMethod("DELETE"),
		apiWithURL(u),
		apiExpectStatus(http.StatusAccepted, http.StatusNotFound, http.StatusMethodNotAllowed),
		apiReturnStatus(&status),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob delete failed: %w", err)
	}
	if status == http.StatusMethodNotAllowed {
		return fmt.Errorf("registry returned status %d%.0w", status, errRegUnsupported)
	}
	return nil
}

func (a *api) BlobGetReq(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/" + dig.String())
	if err != nil {
		return err
	}
	err = a.Do(
		apiWithMethod("GET"),
		apiWithURL(u),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob get failed: %w", err)
	}
	return nil
}

func (a *api) BlobGetExistsFull(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	resp := http.Response{Header: http.Header{}}
	opts = append(opts,
		apiExpectStatus(http.StatusOK),
		apiReturnResponse(&resp),
	)
	if val, ok := td.blobs[dig]; ok && (len(val) > 0 || dig == emptyDigest) {
		opts = append(opts, apiExpectBody(val), apiExpectHeader("Content-Length", fmt.Sprintf("%d", len(val))))
	}
	errs := []error{}
	if err := a.BlobGetReq(registry, repo, dig, td, opts...); err != nil {
		errs = append(errs, err)
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		errs = append(errs, err)
	}
	return errors.Join(errs...)
}

func (a *api) BlobHeadReq(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/" + dig.String())
	if err != nil {
		return err
	}
	err = a.Do(
		apiWithMethod("HEAD"),
		apiWithURL(u),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob head failed: %w", err)
	}
	return nil
}

func (a *api) BlobHeadExists(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	resp := http.Response{Header: http.Header{}}
	opts = append(opts,
		apiExpectStatus(http.StatusOK),
		apiExpectBody([]byte{}),
		apiReturnResponse(&resp),
	)
	if val, ok := td.blobs[dig]; ok && (len(val) > 0 || dig == emptyDigest) {
		opts = append(opts, apiExpectHeader("Content-Length", fmt.Sprintf("%d", len(val))))
	}
	errs := []error{}
	if err := a.BlobHeadReq(registry, repo, dig, td, opts...); err != nil {
		errs = append(errs, err)
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		errs = append(errs, err)
	}
	return errors.Join(errs...)
}

func (a *api) BlobMount(registry, repo, source string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	bodyBytes, ok := td.blobs[dig]
	if !ok {
		return fmt.Errorf("BlobPostPut missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	qa := u.Query()
	qa.Set("mount", dig.String())
	if source != "" {
		qa.Set("from", source)
	}
	u.RawQuery = qa.Encode()
	// TODO: add digest algorithm if not sha256
	errs := []error{}
	loc := ""
	status := 0
	resp := http.Response{Header: http.Header{}}
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiExpectStatus(http.StatusCreated, http.StatusAccepted),
		apiReturnHeader("Location", &loc),
		apiReturnStatus(&status),
		apiReturnResponse(&resp),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	if loc == "" {
		return fmt.Errorf("blob post did not return a location")
	}
	if status == http.StatusAccepted {
		// fallback to post+put
		u, err = u.Parse(loc)
		if err != nil {
			return fmt.Errorf("blob post could not parse location header %q: %w", loc, err)
		}
		qa = u.Query()
		qa.Set("digest", dig.String())
		u.RawQuery = qa.Encode()
		err = a.Do(
			apiWithMethod("PUT"),
			apiWithURL(u),
			apiWithContentLength(int64(len(bodyBytes))),
			apiWithHeaderAdd("Content-Type", mtOctetStream),
			apiWithBody(bodyBytes),
			apiExpectStatus(http.StatusCreated),
			apiReturnHeader("Location", &loc),
			apiReturnResponse(&resp),
			apiWithAnd(opts),
		)
		if err != nil {
			return fmt.Errorf("blob put failed: %w", err)
		}
		errs = append(errs, fmt.Errorf("registry returned status %d, fell back to blob POST+PUT%.0w", status, errRegUnsupported))
	} else if status != http.StatusCreated {
		return fmt.Errorf("blob mount returned status %d", status)
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		return err
	}
	if err := a.BlobVerifyLocation(u, loc, bodyBytes, opts...); err != nil {
		return err
	}
	return errors.Join(errs...)
}

func (a *api) BlobPatchChunked(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	bodyBytes, ok := td.blobs[dig]
	if !ok {
		return fmt.Errorf("BlobPatchChunked missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	// TODO: add digest algorithm if not sha256
	minStr := ""
	loc := ""
	resp := http.Response{Header: http.Header{}}
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiWithContentLength(0),
		apiExpectStatus(http.StatusAccepted),
		apiReturnHeader("OCI-Chunk-Min-Length", &minStr),
		apiReturnHeader("Location", &loc),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	// calc chunk size to make 3 chunks, adjust to min chunk size if specified
	chunkSize := len(bodyBytes)/3 + 1
	if minStr != "" {
		min, err := strconv.Atoi(minStr)
		if err != nil {
			return fmt.Errorf("parsing OCI-Chunk-Min-Length size %q failed: %w", minStr, err)
		}
		if min > chunkSize {
			chunkSize = min
		}
	}
	if chunkSize < chunkMin {
		chunkSize = chunkMin
	}
	if chunkSize > len(bodyBytes) {
		chunkSize = len(bodyBytes)
	}
	lastByte := -1
	// loop over the number of chunks
	for lastByte < len(bodyBytes)-1 {
		if flags["OutOfOrderChunks"] {
			if loc == "" {
				return fmt.Errorf("blob request did not return a location")
			}
			u, err = u.Parse(loc)
			if err != nil {
				return fmt.Errorf("blob request could not parse location header: %w", err)
			}
			// send an out of order chunk, skipping ahead or back to the beginning
			badStart := lastByte + 1 + chunkSize
			if badStart >= len(bodyBytes) {
				badStart = 0
			}
			badLastByte := min(badStart+chunkSize-1, len(bodyBytes)-1)
			method := "PATCH"
			if flags["PutLastChunk"] && badLastByte == len(bodyBytes)-1 {
				method = "PUT"
				qa := u.Query()
				qa.Set("digest", dig.String())
				u.RawQuery = qa.Encode()
			}
			err = a.Do(
				apiWithMethod(method),
				apiWithURL(u),
				apiWithContentLength(int64(badLastByte-badStart+1)),
				apiWithHeaderAdd("Content-Type", mtOctetStream),
				apiWithHeaderAdd("Content-Range", fmt.Sprintf("%d-%d", badStart, badLastByte)),
				apiWithBody(bodyBytes[badStart:badLastByte+1]),
				apiExpectStatus(http.StatusRequestedRangeNotSatisfiable),
				apiReturnHeader("Location", &loc),
				apiWithAnd(opts),
			)
			if err != nil {
				return fmt.Errorf("blob out of order chunk: %w", err)
			}
			// recover with a GET request to find the new location/range
			rangeHeader := ""
			err = a.Do(
				apiWithMethod("GET"),
				apiWithURL(u),
				apiExpectStatus(http.StatusNoContent),
				apiReturnHeader("Location", &loc),
				apiReturnHeader("Range", &rangeHeader),
				apiWithAnd(opts),
			)
			if err != nil {
				return fmt.Errorf("blob chunked upload get request: %w", err)
			}
			rangeHeader, found := strings.CutPrefix(rangeHeader, "0-")
			if !found {
				return fmt.Errorf("content-range header is missing the 0- prefix: %q", rangeHeader)
			}
			rangeLastByte, err := strconv.Atoi(rangeHeader)
			if err != nil {
				return fmt.Errorf("content-range header could not be parsed: %q", rangeHeader)
			}
			if lastByte >= 0 && rangeLastByte != lastByte {
				return fmt.Errorf("content-range unexpected, received %q, expected \"0-%d\"", rangeHeader, lastByte)
			}
		}
		if loc == "" {
			return fmt.Errorf("blob request did not return a location")
		}
		u, err = u.Parse(loc)
		if err != nil {
			return fmt.Errorf("blob request could not parse location header: %w", err)
		}
		start := lastByte + 1
		lastByte = min(start+chunkSize-1, len(bodyBytes)-1)
		var chunkOpts []apiDoOpt
		if flags["PutLastChunk"] && lastByte == len(bodyBytes)-1 {
			qa := u.Query()
			qa.Set("digest", dig.String())
			u.RawQuery = qa.Encode()
			chunkOpts = append([]apiDoOpt{
				apiWithMethod("PUT"),
			}, opts...)
			if flags["ExpectBadDigest"] {
				chunkOpts = append(chunkOpts,
					apiExpectStatus(http.StatusBadRequest),
				)
			} else {
				chunkOpts = append(chunkOpts,
					apiExpectStatus(http.StatusCreated),
					apiReturnHeader("Location", &loc),
					apiReturnResponse(&resp),
				)
			}
		} else {
			chunkOpts = append([]apiDoOpt{
				apiWithMethod("PATCH"),
				apiExpectStatus(http.StatusAccepted),
				apiReturnHeader("Location", &loc),
			}, opts...)
		}
		err = a.Do(
			apiWithURL(u),
			apiWithContentLength(int64(lastByte-start+1)),
			apiWithHeaderAdd("Content-Type", mtOctetStream),
			apiWithHeaderAdd("Content-Range", fmt.Sprintf("%d-%d", start, lastByte)),
			apiWithBody(bodyBytes[start:lastByte+1]),
			apiWithAnd(chunkOpts),
		)
		if err != nil {
			return fmt.Errorf("blob patch failed: %w", err)
		}
	}
	if !flags["PutLastChunk"] {
		if loc == "" {
			return fmt.Errorf("blob patch did not return a location")
		}
		u, err = u.Parse(loc)
		if err != nil {
			return fmt.Errorf("blob patch could not parse location header: %w", err)
		}
		qa := u.Query()
		qa.Set("digest", dig.String())
		u.RawQuery = qa.Encode()
		var putOpts []apiDoOpt
		if flags["ExpectBadDigest"] {
			putOpts = append([]apiDoOpt{
				apiExpectStatus(http.StatusBadRequest),
			}, opts...)
		} else {
			putOpts = append([]apiDoOpt{
				apiExpectStatus(http.StatusCreated),
				apiReturnHeader("Location", &loc),
				apiReturnResponse(&resp),
			}, opts...)
		}
		err = a.Do(
			apiWithMethod("PUT"),
			apiWithURL(u),
			apiWithContentLength(0),
			apiWithHeaderAdd("Content-Type", mtOctetStream),
			apiWithAnd(putOpts),
		)
		if err != nil {
			return fmt.Errorf("blob put failed: %w", err)
		}
	}
	if flags["ExpectBadDigest"] {
		return nil
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		return err
	}
	if err := a.BlobVerifyLocation(u, loc, bodyBytes, opts...); err != nil {
		return err
	}
	return nil
}

func (a *api) BlobPatchStream(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	bodyBytes, ok := td.blobs[dig]
	if !ok {
		return fmt.Errorf("BlobPatchStream missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	// TODO: add digest algorithm if not sha256
	loc := ""
	resp := http.Response{Header: http.Header{}}
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiWithContentLength(0),
		apiExpectStatus(http.StatusAccepted),
		apiReturnHeader("Location", &loc),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	if loc == "" {
		return fmt.Errorf("blob post did not return a location")
	}
	u, err = u.Parse(loc)
	if err != nil {
		return fmt.Errorf("blob post could not parse location header: %w", err)
	}
	err = a.Do(
		apiWithMethod("PATCH"),
		apiWithURL(u),
		apiWithHeaderAdd("Content-Type", mtOctetStream),
		apiWithBody(bodyBytes),
		apiExpectStatus(http.StatusAccepted),
		apiReturnHeader("Location", &loc),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob patch failed: %w", err)
	}
	if loc == "" {
		return fmt.Errorf("blob patch did not return a location")
	}
	u, err = u.Parse(loc)
	if err != nil {
		return fmt.Errorf("blob patch could not parse location header: %w", err)
	}
	qa := u.Query()
	qa.Set("digest", dig.String())
	u.RawQuery = qa.Encode()
	var putOpts []apiDoOpt
	if flags["ExpectBadDigest"] {
		putOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusBadRequest),
		}, opts...)
	} else {
		putOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusCreated),
			apiExpectHeader("Location", ""),
		}, opts...)
	}
	err = a.Do(
		apiWithMethod("PUT"),
		apiWithURL(u),
		apiWithContentLength(0),
		apiWithHeaderAdd("Content-Type", mtOctetStream),
		apiReturnHeader("Location", &loc),
		apiReturnResponse(&resp),
		apiWithAnd(putOpts),
	)
	if err != nil {
		return fmt.Errorf("blob put failed: %w", err)
	}
	if flags["ExpectBadDigest"] {
		return nil
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		return err
	}
	if err := a.BlobVerifyLocation(u, loc, bodyBytes, opts...); err != nil {
		return err
	}
	return nil
}

func (a *api) BlobPostCancel(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	loc := ""
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiExpectStatus(http.StatusAccepted),
		apiReturnHeader("Location", &loc),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	if loc == "" {
		return fmt.Errorf("blob post did not return a location")
	}
	u, err = u.Parse(loc)
	if err != nil {
		return fmt.Errorf("blob post could not parse location header: %w", err)
	}
	err = a.Do(
		apiWithMethod("DELETE"),
		apiWithURL(u),
		apiWithContentLength(0),
		apiExpectStatus(http.StatusNoContent),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob cancel failed: %w", err)
	}
	return nil
}

func (a *api) BlobPostOnly(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	bodyBytes, ok := td.blobs[dig]
	if !ok {
		return fmt.Errorf("BlobPostOnly missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	qa := u.Query()
	qa.Set("digest", dig.String())
	u.RawQuery = qa.Encode()
	loc := ""
	resp := http.Response{Header: http.Header{}}
	var status int
	var postOpts []apiDoOpt
	if flags["ExpectBadDigest"] {
		postOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusBadRequest, http.StatusAccepted),
		}, opts...)
	} else {
		postOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusCreated, http.StatusAccepted),
			apiExpectHeader("Location", ""),
		}, opts...)
	}
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiWithContentLength(int64(len(bodyBytes))),
		apiWithHeaderAdd("Content-Type", mtOctetStream),
		apiWithBody(bodyBytes),
		apiReturnStatus(&status),
		apiReturnHeader("Location", &loc),
		apiReturnResponse(&resp),
		apiWithAnd(postOpts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	if status == http.StatusAccepted {
		// fallback to a PUT request, but track the unsupported API
		var putOpts []apiDoOpt
		if flags["ExpectBadDigest"] {
			putOpts = append([]apiDoOpt{
				apiExpectStatus(http.StatusBadRequest),
			}, opts...)
		} else {
			putOpts = append([]apiDoOpt{
				apiExpectStatus(http.StatusCreated),
				apiReturnHeader("Location", &loc),
			}, opts...)
		}
		u, err = u.Parse(loc)
		if err != nil {
			return fmt.Errorf("blob post could not parse location header: %w", err)
		}
		qa := u.Query()
		qa.Set("digest", dig.String())
		u.RawQuery = qa.Encode()
		err = a.Do(
			apiWithMethod("PUT"),
			apiWithURL(u),
			apiWithContentLength(int64(len(bodyBytes))),
			apiWithHeaderAdd("Content-Type", mtOctetStream),
			apiWithBody(bodyBytes),
			apiReturnHeader("Location", &loc),
			apiReturnResponse(&resp),
			apiWithAnd(putOpts),
		)
		if err != nil {
			return fmt.Errorf("blob post failed: %w", err)
		}
		return fmt.Errorf("registry does not support content in the POST, fallback to PUT%.0w", errRegUnsupported)
	}
	if flags["ExpectBadDigest"] {
		return nil
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		return err
	}
	if err := a.BlobVerifyLocation(u, loc, bodyBytes, opts...); err != nil {
		return err
	}
	return nil
}

func (a *api) BlobPostPut(registry, repo string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	bodyBytes, ok := td.blobs[dig]
	if !ok {
		return fmt.Errorf("BlobPostPut missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/blobs/uploads/")
	if err != nil {
		return err
	}
	// TODO: add digest algorithm if not sha256
	loc := ""
	resp := http.Response{Header: http.Header{}}
	err = a.Do(
		apiWithMethod("POST"),
		apiWithURL(u),
		apiExpectStatus(http.StatusAccepted),
		apiReturnHeader("Location", &loc),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("blob post failed: %w", err)
	}
	if loc == "" {
		return fmt.Errorf("blob post did not return a location")
	}
	u, err = u.Parse(loc)
	if err != nil {
		return fmt.Errorf("blob post could not parse location header: %w", err)
	}
	qa := u.Query()
	qa.Set("digest", dig.String())
	u.RawQuery = qa.Encode()
	var putOpts []apiDoOpt
	if flags["ExpectBadDigest"] {
		putOpts = append([]apiDoOpt{apiExpectStatus(http.StatusBadRequest)},
			opts...)
	} else {
		putOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusCreated),
			apiReturnHeader("Location", &loc),
			apiReturnResponse(&resp),
		}, opts...)
	}
	err = a.Do(
		apiWithMethod("PUT"),
		apiWithURL(u),
		apiWithContentLength(int64(len(bodyBytes))),
		apiWithHeaderAdd("Content-Type", mtOctetStream),
		apiWithBody(bodyBytes),
		apiWithAnd(putOpts),
	)
	if err != nil {
		return fmt.Errorf("blob put failed: %w", err)
	}
	if flags["ExpectBadDigest"] {
		return nil
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		return err
	}
	if err := a.BlobVerifyLocation(u, loc, bodyBytes, opts...); err != nil {
		return err
	}
	return nil
}

func (a *api) BlobVerifyLocation(u *url.URL, loc string, bodyBytes []byte, opts ...apiDoOpt) error {
	if loc == "" {
		return fmt.Errorf("location header missing")
	}
	u, err := u.Parse(loc)
	if err != nil {
		return fmt.Errorf("could not parse location header %q: %w", loc, err)
	}
	err = a.Do(
		apiWithMethod("GET"),
		apiWithURL(u),
		apiExpectBody(bodyBytes),
		apiExpectStatus(http.StatusOK),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("failed to verify returned location: %w", err)
	}
	return nil
}

func (a *api) ManifestDelete(registry, repo, ref string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/manifests/" + ref)
	if err != nil {
		return err
	}
	var status int
	err = a.Do(
		apiWithMethod("DELETE"),
		apiWithURL(u),
		apiExpectStatus(http.StatusAccepted, http.StatusNotFound, http.StatusBadRequest, http.StatusMethodNotAllowed),
		apiReturnStatus(&status),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("manifest delete failed: %w", err)
	}
	if status == http.StatusBadRequest || status == http.StatusMethodNotAllowed {
		return fmt.Errorf("registry returned status %d%.0w", status, errRegUnsupported)
	}
	return nil
}

func (a *api) ManifestGetReq(registry, repo, ref string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/manifests/" + ref)
	if err != nil {
		return err
	}
	err = a.Do(
		apiWithMethod("GET"),
		apiWithURL(u),
		apiWithHeaderAdd("Accept", mtOCIIndex),
		apiWithHeaderAdd("Accept", mtOCIImage),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("manifest get failed: %w", err)
	}
	return nil
}

func (a *api) ManifestGetExists(registry, repo, ref string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	opts = append(opts,
		apiExpectStatus(http.StatusOK),
	)
	resp := http.Response{Header: http.Header{}}
	if val, ok := td.manifests[dig]; ok && len(val) > 0 {
		mediaType := detectMediaType(val)
		opts = append(opts,
			apiExpectBody(val),
			apiExpectHeader("Content-Type", mediaType),
			apiExpectHeader("Content-Length", fmt.Sprintf("%d", len(val))),
			apiReturnResponse(&resp),
		)
	}
	errs := []error{}
	if err := a.ManifestGetReq(registry, repo, ref, dig, td, opts...); err != nil {
		errs = append(errs, err)
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		errs = append(errs, err)
	}
	return errors.Join(errs...)
}

func (a *api) ManifestHeadReq(registry, repo, ref string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/" + repo + "/manifests/" + ref)
	if err != nil {
		return err
	}
	err = a.Do(
		apiWithMethod("HEAD"),
		apiWithURL(u),
		apiWithHeaderAdd("Accept", mtOCIIndex),
		apiWithHeaderAdd("Accept", mtOCIImage),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("manifest head failed: %w", err)
	}
	return nil
}

func (a *api) ManifestHeadExists(registry, repo, ref string, dig digest.Digest, td *testData, opts ...apiDoOpt) error {
	opts = append(opts,
		apiExpectStatus(http.StatusOK),
		apiExpectBody([]byte{}),
	)
	resp := http.Response{Header: http.Header{}}
	if val, ok := td.manifests[dig]; ok && len(val) > 0 {
		mediaType := detectMediaType(val)
		opts = append(opts,
			apiExpectHeader("Content-Type", mediaType),
			apiExpectHeader("Content-Length", fmt.Sprintf("%d", len(val))),
			apiReturnResponse(&resp),
		)
	}
	errs := []error{}
	if err := a.ManifestHeadReq(registry, repo, ref, dig, td, opts...); err != nil {
		errs = append(errs, err)
	}
	if err := a.VerifyDigest(&resp, dig, opts...); err != nil {
		errs = append(errs, err)
	}
	return errors.Join(errs...)
}

func (a *api) ManifestPut(registry, repo, ref string, dig digest.Digest, td *testData, referrersEnabled bool, putOpts []apiDoOpt, opts ...apiDoOpt) error {
	flags := a.GetFlags(opts...)
	bodyBytes, ok := td.manifests[dig]
	if !ok {
		return fmt.Errorf("ManifestPut missing expected digest to send: %s%.0w", dig.String(), errAPITestError)
	}
	u, err := url.Parse(registry + "/v2/" + repo + "/manifests/" + ref)
	if err != nil {
		return err
	}
	mediaType := detectMediaType(bodyBytes)
	resp := http.Response{Header: http.Header{}}
	loc := ""
	putOpts = append(putOpts, opts...)
	if flags["ExpectBadDigest"] {
		putOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusBadRequest),
		}, putOpts...)
	} else {
		putOpts = append([]apiDoOpt{
			apiExpectStatus(http.StatusCreated),
			apiReturnHeader("Location", &loc),
		}, putOpts...)
	}
	if referrersEnabled {
		// if the referrers API is being tested, verify OCI-Subject header is returned when appropriate
		subj := detectSubject(td.manifests[dig])
		if subj != nil {
			putOpts = append(putOpts, apiExpectHeader("OCI-Subject", subj.Digest.String()))
		}
	}
	errs := []error{}
	err = a.Do(
		apiWithMethod("PUT"),
		apiWithURL(u),
		apiWithBody(bodyBytes),
		apiWithHeaderAdd("Content-Type", mediaType),
		apiReturnResponse(&resp),
		apiWithAnd(putOpts),
	)
	if err != nil {
		errs = append(errs, fmt.Errorf("manifest put failed: %w", err))
	}
	// do not validate response if a failure was expected
	if flags["ExpectBadDigest"] {
		return errors.Join(errs...)
	}
	// validate the digest header
	digHeader := resp.Header.Get("Docker-Content-Digest")
	if digHeader == "" && flags["RequestDigestHeader"] {
		errs = append(errs, fmt.Errorf("registry did not return a Docker-Content-Digest header"))
	}
	if digHeader != "" && digHeader != dig.String() {
		errs = append(errs, fmt.Errorf("Docker-Content-Digest header value expected %q, received %q", dig.String(), digHeader))
	}
	// verify returned location
	if loc == "" {
		errs = append(errs, fmt.Errorf("blob put did not return a location"))
	} else {
		u, err = u.Parse(loc)
		if err != nil {
			errs = append(errs, fmt.Errorf("could not parse location header %q: %w", loc, err))
		}
		if err == nil {
			err = a.Do(
				apiWithMethod("GET"),
				apiWithURL(u),
				apiWithHeaderAdd("Accept", mtOCIIndex),
				apiWithHeaderAdd("Accept", mtOCIImage),
				apiExpectStatus(http.StatusOK),
				apiExpectHeader("Content-Type", mediaType),
				apiExpectHeader("Content-Length", fmt.Sprintf("%d", len(bodyBytes))),
				apiExpectBody(bodyBytes),
				apiWithAnd(opts),
			)
			if err != nil {
				errs = append(errs, fmt.Errorf("failed to verify returned location: %w", err))
			}
		}
	}
	return errors.Join(errs...)
}

func (a *api) PingReq(registry string, opts ...apiDoOpt) error {
	u, err := url.Parse(registry + "/v2/")
	if err != nil {
		return err
	}
	err = a.Do(
		apiWithMethod("GET"),
		apiWithURL(u),
		apiWithAnd(opts),
	)
	if err != nil {
		return fmt.Errorf("registry ping failed: %w", err)
	}
	return nil
}

func (a *api) ReferrersList(registry, repo string, dig digest.Digest, opts ...apiDoOpt) (image.Index, error) {
	rl := image.Index{}
	u, err := url.Parse(registry + "/v2/" + repo + "/referrers/" + dig.String())
	if err != nil {
		return rl, err
	}
	err = a.Do(
		apiWithURL(u),
		apiExpectHeader("Content-Type", mtOCIIndex),
		apiExpectStatus(http.StatusOK),
		apiReturnJSONBody(&rl),
		apiWithAnd(opts),
	)
	// validate the response
	if err == nil && (rl.MediaType != mtOCIIndex || rl.SchemaVersion != 2) {
		err = fmt.Errorf("referrers response is not a valid OCI index (media type and schema version)%.0w", errAPITestFail)
	}
	return rl, err
}

func (a *api) TagList(registry, repo string, opts ...apiDoOpt) (specs.TagList, error) {
	tl := specs.TagList{}
	u, err := url.Parse(registry + "/v2/" + repo + "/tags/list")
	if err != nil {
		return tl, err
	}
	err = a.Do(
		apiWithURL(u),
		apiWithOr(
			[]apiDoOpt{
				apiExpectStatus(http.StatusOK),
				apiReturnJSONBody(&tl),
			},
			[]apiDoOpt{
				apiExpectStatus(http.StatusNotFound),
			},
		),
		apiWithAnd(opts),
	)
	return tl, err
}

func apiWithAnd(opts []apiDoOpt) apiDoOpt {
	ret := apiDoOpt{}
	reqFns := [](func(*http.Request) error){}
	respFns := [](func(*http.Response) error){}
	for _, opt := range opts {
		if opt.reqFn != nil {
			reqFns = append(reqFns, opt.reqFn)
		}
		if opt.respFn != nil {
			respFns = append(respFns, opt.respFn)
		}
		if opt.out != nil {
			ret.out = opt.out
		}
	}
	if len(reqFns) == 1 {
		ret.reqFn = reqFns[0]
	} else if len(reqFns) > 0 {
		ret.reqFn = func(r *http.Request) error {
			errs := []error{}
			for _, fn := range reqFns {
				err := fn(r)
				if err != nil {
					errs = append(errs, err)
				}
			}
			if len(errs) == 1 {
				return errs[0]
			}
			return errors.Join(errs...)
		}
	}
	if len(respFns) == 1 {
		ret.respFn = respFns[0]
	} else if len(respFns) > 0 {
		ret.respFn = func(r *http.Response) error {
			errs := []error{}
			for _, fn := range respFns {
				err := fn(r)
				if err != nil {
					errs = append(errs, err)
				}
			}
			if len(errs) == 1 {
				return errs[0]
			}
			return errors.Join(errs...)
		}
	}
	return ret
}

// apiWithOr succeeds with any of the lists of respFn's are all successful.
// Note that reqFn entries are ignored.
func apiWithOr(optLists ...[]apiDoOpt) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			errsOr := []error{}
			for _, opts := range optLists {
				errsResp := []error{}
				for _, opt := range opts {
					if opt.respFn != nil {
						err := opt.respFn(resp)
						if err != nil {
							errsResp = append(errsResp, err)
						}
					}
				}
				if len(errsResp) == 0 {
					return nil
				}
				errsOr = append(errsOr, errors.Join(errsResp...))
			}
			return fmt.Errorf("response did not match any condition: %w", errors.Join(errsOr...))
		},
	}
}

func apiWithFlag(flag string) apiDoOpt {
	return apiDoOpt{
		flags: map[string]bool{flag: true},
	}
}

func apiWithMethod(method string) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			req.Method = method
			return nil
		},
	}
}

func apiWithURL(u *url.URL) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			req.URL = u
			return nil
		},
	}
}

func apiWithURLParam(key, val string) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			if req.URL == nil {
				return fmt.Errorf("URL must be set before adding a parameter")
			}
			params := req.URL.Query()
			params.Add(key, val)
			req.URL.RawQuery = params.Encode()
			return nil
		},
	}
}

func apiWithContentLength(l int64) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			req.ContentLength = l
			if req.Header == nil {
				req.Header = http.Header{}
			}
			req.Header.Add("Content-Length", fmt.Sprintf("%d", l))
			return nil
		},
	}
}

func apiWithHeaderAdd(key, value string) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			if req.Header == nil {
				req.Header = http.Header{}
			}
			req.Header.Add(key, value)
			return nil
		},
	}
}

func apiWithBody(body []byte) apiDoOpt {
	return apiDoOpt{
		reqFn: func(req *http.Request) error {
			if req.Body != nil {
				_ = req.Body.Close()
			}
			req.Body = io.NopCloser(bytes.NewReader(body))
			req.GetBody = func() (io.ReadCloser, error) {
				return io.NopCloser(bytes.NewReader(body)), nil
			}
			return nil
		},
	}
}

func apiExpectBody(bodyExpect []byte) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			// read body and replace with a buf reader
			bodyReceived, err := io.ReadAll(resp.Body)
			if err != nil {
				return fmt.Errorf("failed to read body: %w", err)
			}
			_ = resp.Body.Close()
			resp.Body = io.NopCloser(bytes.NewReader(bodyReceived))
			if bytes.Equal(bodyExpect, bodyReceived) {
				return nil
			}
			var bufExpect, bufReceived bytes.Buffer
			err = printBody(bodyReceived, &bufReceived)
			if err != nil {
				return fmt.Errorf("failed to print received body: %w", err)
			}
			err = printBody(bodyExpect, &bufExpect)
			if err != nil {
				return fmt.Errorf("failed to print expected body: %w", err)
			}
			return fmt.Errorf("body contents mismatch, expected %s, received %s", strings.TrimSpace(bufExpect.String()), strings.TrimSpace(bufReceived.String()))
		},
	}
}

func apiExpectHeader(key, val string) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			cur := resp.Header.Values(key)
			if val == "" {
				if len(cur) == 0 {
					return fmt.Errorf("missing header %q", key)
				}
			} else {
				if !slices.Contains(cur, val) {
					return fmt.Errorf("header value mismatch for %q, expected %q, received %q", key, val, cur)
				}
			}
			return nil
		},
	}
}

func apiExpectStatus(statusCodes ...int) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			if slices.Contains(statusCodes, resp.StatusCode) {
				return nil
			}
			return fmt.Errorf("unexpected status code, expected one of %v, received %d", statusCodes, resp.StatusCode)
		},
	}
}

func apiReturnHeader(key string, val *string) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			cur := resp.Header.Get(key)
			if cur != "" {
				*val = cur
			}
			return nil
		},
	}
}

func apiReturnJSONBody(data any) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			return json.NewDecoder(resp.Body).Decode(data)
		},
	}
}

func apiReturnResponse(ret *http.Response) apiDoOpt {
	return apiDoOpt{
		respFn: func(r *http.Response) error {
			*ret = *r
			return nil
		},
	}
}

func apiReturnStatus(status *int) apiDoOpt {
	return apiDoOpt{
		respFn: func(resp *http.Response) error {
			*status = resp.StatusCode
			return nil
		},
	}
}

func apiSaveOutput(out io.Writer) apiDoOpt {
	return apiDoOpt{
		out: out,
	}
}

type authHeader struct {
	Type    string
	Realm   string
	Service string
	Scope   string
}

type authInfo struct {
	Token       string `json:"token"`
	AccessToken string `json:"access_token"`
}

func (a *api) getAuthHeader(client http.Client, resp *http.Response) (string, error) {
	cacheKey, err := authCacheKey(*resp.Request)
	if err != nil {
		return "", err
	}
	header := resp.Header.Get("WWW-Authenticate")
	if resp.StatusCode != http.StatusUnauthorized || header == "" {
		return "", fmt.Errorf("status code or header invalid for adding auth, status %d, header %s", resp.StatusCode, header)
	}
	parsed, err := parseAuthHeader(header)
	if err != nil {
		return "", err
	}
	if parsed.Type == "basic" {
		auth := fmt.Sprintf("Basic %s", base64.StdEncoding.EncodeToString([]byte(a.user+":"+a.pass)))
		if a.authCache != nil {
			a.authCache[cacheKey] = auth
		}
		return auth, nil
	}
	if parsed.Type == "bearer" {
		u, err := resp.Request.URL.Parse(parsed.Realm)
		if err != nil {
			return "", fmt.Errorf("failed to parse realm url: %w", err)
		}
		param := url.Values{}
		param.Set("service", parsed.Service)
		if parsed.Scope != "" {
			param.Set("scope", parsed.Scope)
		}
		u.RawQuery = param.Encode()
		req, err := http.NewRequest(http.MethodGet, u.String(), nil)
		if err != nil {
			return "", fmt.Errorf("failed to created request: %w", err)
		}
		req.Header.Set("Accept", "application/json")
		req.SetBasicAuth(a.user, a.pass)
		authResp, err := client.Do(req)
		if err != nil {
			return "", fmt.Errorf("failed to send auth request: %w", err)
		}
		if authResp.Body != nil {
			defer func() { _ = authResp.Body.Close() }()
		}
		if authResp.StatusCode != http.StatusOK {
			return "", fmt.Errorf("invalid status on auth request: %d", authResp.StatusCode)
		}
		ai := authInfo{}
		if err := json.NewDecoder(authResp.Body).Decode(&ai); err != nil {
			return "", fmt.Errorf("failed to parse auth response: %w", err)
		}
		if ai.AccessToken != "" {
			ai.Token = ai.AccessToken
		}
		auth := fmt.Sprintf("Bearer %s", ai.Token)
		if a.authCache != nil {
			a.authCache[cacheKey] = auth
		}
		return auth, nil
	}
	return "", fmt.Errorf("failed to parse auth header, type=%s: %s", parsed.Type, header)
}

func (a *api) addCachedAuth(req *http.Request) error {
	if a.authCache == nil {
		return nil
	}
	key, err := authCacheKey(*req)
	if err != nil {
		return err
	}
	if auth, ok := a.authCache[key]; ok {
		req.Header.Set("Authorization", auth)
	}
	return nil
}

var (
	authHeaderMatcher = regexp.MustCompile("(?i).*(bearer|basic).*")
	authParamsMatcher = regexp.MustCompile(`([a-zA-z]+)="(.+?)"`)
)

func parseAuthHeader(header string) (authHeader, error) {
	// TODO: replace with a better parser, quotes should be optional, get character set from upstream http rfc
	var parsed authHeader
	parsed.Type = strings.ToLower(authHeaderMatcher.ReplaceAllString(header, "$1"))
	if parsed.Type == "bearer" {
		matches := authParamsMatcher.FindAllStringSubmatch(header, -1)
		for _, match := range matches {
			switch strings.ToLower(match[1]) {
			case "realm":
				parsed.Realm = match[2]
			case "service":
				parsed.Service = match[2]
			case "scope":
				parsed.Scope = match[2]
			}
		}
	}
	return parsed, nil
}

var reRepo = regexp.MustCompile(`\/v2\/` +
	`([a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*(?:\/[a-z0-9]+(?:(?:\.|_|__|-+)[a-z0-9]+)*)*)` +
	`(\/(?:blobs|manifests|tags|referrers)\/(?:[^\/]+)|\/blobs\/uploads\/[^\/]*)`)

func authCacheKey(req http.Request) (string, error) {
	if req.URL == nil {
		return "", fmt.Errorf("cannot compute auth cache key, URL is nil")
	}
	// auth cache key is the host, repo, and method, joined with a colon separator
	host := req.URL.Host
	repo := ""
	if req.URL.Path != "/v2/" {
		pathMatch := reRepo.FindStringSubmatch(req.URL.Path)
		if len(pathMatch) < 2 {
			return "", fmt.Errorf("could not extract repo from path")
		}
		repo = pathMatch[1]
	}
	// compatible methods are merged
	method := req.Method
	switch method {
	case "GET", "HEAD":
		method = "pull"
	case "POST", "PATCH", "PUT":
		method = "push"
	}
	return strings.Join([]string{host, repo, method}, ":"), nil
}

type wrapTransport struct {
	out  io.Writer
	orig http.RoundTripper
}

func (wt *wrapTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	if wt.out != nil {
		if err := printRequest(req, wt.out); err != nil {
			return nil, err
		}
	}
	resp, err := wt.orig.RoundTrip(req)
	if wt.out != nil {
		if err == nil {
			if err := printResponse(resp, wt.out); err != nil {
				return resp, err
			}
		}
		if err != nil {
			if _, err := fmt.Fprintf(wt.out, "%s\n~~~ Error ~~~\n%s\n", strings.Repeat("-", 80), err.Error()); err != nil {
				return resp, err
			}
		}
		if _, err := fmt.Fprintf(wt.out, "%s\n", strings.Repeat("=", 80)); err != nil {
			return resp, err
		}
	}
	return resp, err
}

type detectManifest struct {
	MediaType string            `json:"mediaType"`
	Subject   *image.Descriptor `json:"subject,omitempty"`
}

func detectMediaType(body []byte) string {
	det := detectManifest{
		MediaType: mtOCIImage,
	}
	_ = json.Unmarshal(body, &det)
	return det.MediaType
}

func detectSubject(body []byte) *image.Descriptor {
	det := detectManifest{}
	_ = json.Unmarshal(body, &det)
	return det.Subject
}

func cloneBodyReq(req *http.Request) ([]byte, error) {
	if req.GetBody != nil {
		rc, err := req.GetBody()
		if err != nil {
			return nil, err
		}
		out, err := io.ReadAll(rc)
		_ = rc.Close()
		return out, err
	}
	if req.Body == nil {
		return []byte{}, nil
	}
	out, err := io.ReadAll(req.Body)
	_ = req.Body.Close()
	if err != nil {
		return nil, err
	}
	// replace the body with a buffer so it can be reused
	req.Body = io.NopCloser(bytes.NewReader(out))
	return out, err
}

func cloneBodyResp(resp *http.Response) ([]byte, error) {
	if resp.Body == nil {
		return []byte{}, nil
	}
	out, err := io.ReadAll(resp.Body)
	_ = resp.Body.Close()
	if err != nil {
		return nil, err
	}
	// replace the body with a buffer so it can be reused
	resp.Body = io.NopCloser(bytes.NewReader(out))
	return out, err
}

func mediaTypeBase(orig string) string {
	base, _, _ := strings.Cut(orig, ";")
	return strings.TrimSpace(strings.ToLower(base))
}

func printBody(body []byte, w io.Writer) error {
	if len(body) == 0 {
		if _, err := fmt.Fprintf(w, "--- Empty body ---\n"); err != nil {
			return err
		}
		return nil
	}
	ct := http.DetectContentType(body)
	switch mediaTypeBase(ct) {
	case "application/json", "text/plain":
		if _, err := fmt.Fprintf(w, "%.*s\n", truncateBody, string(body)); err != nil {
			return err
		}
		if len(body) > truncateBody {
			if _, err := fmt.Fprintf(w, "--- Truncated body from %d to %d bytes ---\n", len(body), truncateBody); err != nil {
				return err
			}
		}
	default:
		if _, err := fmt.Fprintf(w, "--- Output of %s not supported, %d bytes not shown ---\n", ct, len(body)); err != nil {
			return err
		}
	}
	return nil
}

func printHeaders(headers http.Header, w io.Writer) error {
	if _, err := fmt.Fprintf(w, "Headers:\n"); err != nil {
		return err
	}
	for _, k := range slices.Sorted(maps.Keys(headers)) {
		if _, err := fmt.Fprintf(w, "  %25s: %v\n", k, headers[k]); err != nil {
			return err
		}
	}
	return nil
}

func printRequest(req *http.Request, w io.Writer) error {
	if _, err := fmt.Fprintf(w, "%s\n~~~ REQUEST ~~~\n", strings.Repeat("=", 80)); err != nil {
		return err
	}
	if _, err := fmt.Fprintf(w, "Method: %s\nURL: %s\n", req.Method, req.URL.String()); err != nil {
		return err
	}
	if err := printHeaders(req.Header, w); err != nil {
		return err
	}
	body, err := cloneBodyReq(req)
	if err != nil {
		return err
	}
	if err := printBody(body, w); err != nil {
		return err
	}

	return nil
}

func printResponse(resp *http.Response, w io.Writer) error {
	if _, err := fmt.Fprintf(w, "%s\n~~~ RESPONSE ~~~\n", strings.Repeat("-", 80)); err != nil {
		return err
	}
	if _, err := fmt.Fprintf(w, "Status: %d\n", resp.StatusCode); err != nil {
		return err
	}
	if err := printHeaders(resp.Header, w); err != nil {
		return err
	}
	body, err := cloneBodyResp(resp)
	if err != nil {
		return err
	}
	if err := printBody(body, w); err != nil {
		return err
	}

	return nil
}

type redactWriter struct {
	w io.Writer
}

var (
	redactRegexp  = regexp.MustCompile(`(?i)("?\w*(?:authorization|token|state)\w*"?(?:=|:)\s*(?:\[)?\s*"?\s*(?:(?:bearer|basic)? )?)[^\s?&"\]]*`)
	redactReplace = []byte("$1*****")
)

func (rw redactWriter) Write(p []byte) (int, error) {
	pRedact := redactRegexp.ReplaceAll(p, redactReplace)
	n, err := rw.w.Write(pRedact)
	if err != nil || n != len(pRedact) {
		return 0, err
	}
	return len(p), nil
}