feat: b6-openai-models — batch 6

rust/crates/api/src/http_client.rs

@@ -7,11 +7,17 @@ const NO_PROXY_KEYS: [&str; 2] = ["NO_PROXY", "no_proxy"];
 /// Snapshot of the proxy-related environment variables that influence the
 /// outbound HTTP client. Captured up front so callers can inspect, log, and
 /// test the resolved configuration without re-reading the process environment.
+///
+/// When `proxy_url` is set it acts as a single catch-all proxy for both
+/// HTTP and HTTPS traffic, taking precedence over the per-scheme fields.
 #[derive(Debug, Clone, Default, PartialEq, Eq)]
 pub struct ProxyConfig {
     pub http_proxy: Option<String>,
     pub https_proxy: Option<String>,
     pub no_proxy: Option<String>,
+    /// Optional unified proxy URL that applies to both HTTP and HTTPS.
+    /// When set, this takes precedence over `http_proxy` and `https_proxy`.
+    pub proxy_url: Option<String>,
 }
 
 impl ProxyConfig {
@@ -22,6 +28,17 @@ impl ProxyConfig {
         Self::from_lookup(|key| std::env::var(key).ok())
     }
 
+    /// Create a proxy configuration from a single URL that applies to both
+    /// HTTP and HTTPS traffic. This is the config-file alternative to setting
+    /// `HTTP_PROXY` and `HTTPS_PROXY` environment variables separately.
+    #[must_use]
+    pub fn from_proxy_url(url: impl Into<String>) -> Self {
+        Self {
+            proxy_url: Some(url.into()),
+            ..Self::default()
+        }
+    }
+
     fn from_lookup<F>(mut lookup: F) -> Self
     where
         F: FnMut(&str) -> Option<String>,
@@ -30,12 +47,13 @@ impl ProxyConfig {
             http_proxy: first_non_empty(&HTTP_PROXY_KEYS, &mut lookup),
             https_proxy: first_non_empty(&HTTPS_PROXY_KEYS, &mut lookup),
             no_proxy: first_non_empty(&NO_PROXY_KEYS, &mut lookup),
+            proxy_url: None,
         }
     }
 
     #[must_use]
     pub fn is_empty(&self) -> bool {
-        self.http_proxy.is_none() && self.https_proxy.is_none()
+        self.proxy_url.is_none() && self.http_proxy.is_none() && self.https_proxy.is_none()
     }
 }
 
@@ -58,6 +76,10 @@ pub fn build_http_client_or_default() -> reqwest::Client {
 
 /// Build a `reqwest::Client` from an explicit [`ProxyConfig`]. Used by tests
 /// and by callers that want to override process-level environment lookups.
+///
+/// When `config.proxy_url` is set it overrides the per-scheme `http_proxy`
+/// and `https_proxy` fields and is registered as both an HTTP and HTTPS
+/// proxy so a single value can route every outbound request.
 pub fn build_http_client_with(config: &ProxyConfig) -> Result<reqwest::Client, ApiError> {
     let mut builder = reqwest::Client::builder().no_proxy();
 
@@ -66,7 +88,12 @@ pub fn build_http_client_with(config: &ProxyConfig) -> Result<reqwest::Client, A
         .as_deref()
         .and_then(reqwest::NoProxy::from_string);
 
-    if let Some(url) = config.https_proxy.as_deref() {
+    let (http_proxy_url, https_proxy_url) = match config.proxy_url.as_deref() {
+        Some(unified) => (Some(unified), Some(unified)),
+        None => (config.http_proxy.as_deref(), config.https_proxy.as_deref()),
+    };
+
+    if let Some(url) = https_proxy_url {
         let mut proxy = reqwest::Proxy::https(url)?;
         if let Some(filter) = no_proxy.clone() {
             proxy = proxy.no_proxy(Some(filter));
@@ -74,7 +101,7 @@ pub fn build_http_client_with(config: &ProxyConfig) -> Result<reqwest::Client, A
         builder = builder.proxy(proxy);
     }
 
-    if let Some(url) = config.http_proxy.as_deref() {
+    if let Some(url) = http_proxy_url {
         let mut proxy = reqwest::Proxy::http(url)?;
         if let Some(filter) = no_proxy.clone() {
             proxy = proxy.no_proxy(Some(filter));
@@ -221,6 +248,7 @@ mod tests {
             http_proxy: Some("http://proxy.internal:3128".to_string()),
             https_proxy: Some("http://secure.internal:3129".to_string()),
             no_proxy: Some("localhost,127.0.0.1".to_string()),
+            proxy_url: None,
         };
 
         // when
@@ -237,6 +265,7 @@ mod tests {
             http_proxy: None,
             https_proxy: Some("not a url".to_string()),
             no_proxy: None,
+            proxy_url: None,
         };
 
         // when
@@ -249,4 +278,67 @@ mod tests {
             "expected ApiError::Http for invalid proxy URL, got: {error:?}"
         );
     }
+
+    #[test]
+    fn from_proxy_url_sets_unified_field_and_leaves_per_scheme_empty() {
+        // given / when
+        let config = ProxyConfig::from_proxy_url("http://unified.internal:3128");
+
+        // then
+        assert_eq!(
+            config.proxy_url.as_deref(),
+            Some("http://unified.internal:3128")
+        );
+        assert!(config.http_proxy.is_none());
+        assert!(config.https_proxy.is_none());
+        assert!(!config.is_empty());
+    }
+
+    #[test]
+    fn build_http_client_succeeds_with_unified_proxy_url() {
+        // given
+        let config = ProxyConfig {
+            proxy_url: Some("http://unified.internal:3128".to_string()),
+            no_proxy: Some("localhost".to_string()),
+            ..ProxyConfig::default()
+        };
+
+        // when
+        let result = build_http_client_with(&config);
+
+        // then
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn proxy_url_takes_precedence_over_per_scheme_fields() {
+        // given – both per-scheme and unified are set
+        let config = ProxyConfig {
+            http_proxy: Some("http://per-scheme.internal:1111".to_string()),
+            https_proxy: Some("http://per-scheme.internal:2222".to_string()),
+            no_proxy: None,
+            proxy_url: Some("http://unified.internal:3128".to_string()),
+        };
+
+        // when – building succeeds (the unified URL is valid)
+        let result = build_http_client_with(&config);
+
+        // then
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn build_http_client_returns_error_for_invalid_unified_proxy_url() {
+        // given
+        let config = ProxyConfig::from_proxy_url("not a url");
+
+        // when
+        let result = build_http_client_with(&config);
+
+        // then
+        assert!(
+            matches!(result, Err(crate::error::ApiError::Http(_))),
+            "invalid unified proxy URL should fail: {result:?}"
+        );
+    }
 }

rust/crates/api/tests/proxy_integration.rs

@@ -0,0 +1,173 @@
+use std::ffi::OsString;
+use std::sync::{Mutex, OnceLock};
+
+use api::{build_http_client_with, ProxyConfig};
+
+fn env_lock() -> std::sync::MutexGuard<'static, ()> {
+    static LOCK: OnceLock<Mutex<()>> = OnceLock::new();
+    LOCK.get_or_init(|| Mutex::new(()))
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+}
+
+struct EnvVarGuard {
+    key: &'static str,
+    original: Option<OsString>,
+}
+
+impl EnvVarGuard {
+    fn set(key: &'static str, value: Option<&str>) -> Self {
+        let original = std::env::var_os(key);
+        match value {
+            Some(value) => std::env::set_var(key, value),
+            None => std::env::remove_var(key),
+        }
+        Self { key, original }
+    }
+}
+
+impl Drop for EnvVarGuard {
+    fn drop(&mut self) {
+        match &self.original {
+            Some(value) => std::env::set_var(self.key, value),
+            None => std::env::remove_var(self.key),
+        }
+    }
+}
+
+#[test]
+fn proxy_config_from_env_reads_uppercase_proxy_vars() {
+    // given
+    let _lock = env_lock();
+    let _http = EnvVarGuard::set("HTTP_PROXY", Some("http://proxy.corp:3128"));
+    let _https = EnvVarGuard::set("HTTPS_PROXY", Some("http://secure.corp:3129"));
+    let _no = EnvVarGuard::set("NO_PROXY", Some("localhost,127.0.0.1"));
+    let _http_lower = EnvVarGuard::set("http_proxy", None);
+    let _https_lower = EnvVarGuard::set("https_proxy", None);
+    let _no_lower = EnvVarGuard::set("no_proxy", None);
+
+    // when
+    let config = ProxyConfig::from_env();
+
+    // then
+    assert_eq!(config.http_proxy.as_deref(), Some("http://proxy.corp:3128"));
+    assert_eq!(
+        config.https_proxy.as_deref(),
+        Some("http://secure.corp:3129")
+    );
+    assert_eq!(config.no_proxy.as_deref(), Some("localhost,127.0.0.1"));
+    assert!(config.proxy_url.is_none());
+    assert!(!config.is_empty());
+}
+
+#[test]
+fn proxy_config_from_env_reads_lowercase_proxy_vars() {
+    // given
+    let _lock = env_lock();
+    let _http = EnvVarGuard::set("HTTP_PROXY", None);
+    let _https = EnvVarGuard::set("HTTPS_PROXY", None);
+    let _no = EnvVarGuard::set("NO_PROXY", None);
+    let _http_lower = EnvVarGuard::set("http_proxy", Some("http://lower.corp:3128"));
+    let _https_lower = EnvVarGuard::set("https_proxy", Some("http://lower-secure.corp:3129"));
+    let _no_lower = EnvVarGuard::set("no_proxy", Some(".internal"));
+
+    // when
+    let config = ProxyConfig::from_env();
+
+    // then
+    assert_eq!(config.http_proxy.as_deref(), Some("http://lower.corp:3128"));
+    assert_eq!(
+        config.https_proxy.as_deref(),
+        Some("http://lower-secure.corp:3129")
+    );
+    assert_eq!(config.no_proxy.as_deref(), Some(".internal"));
+    assert!(!config.is_empty());
+}
+
+#[test]
+fn proxy_config_from_env_is_empty_when_no_vars_set() {
+    // given
+    let _lock = env_lock();
+    let _http = EnvVarGuard::set("HTTP_PROXY", None);
+    let _https = EnvVarGuard::set("HTTPS_PROXY", None);
+    let _no = EnvVarGuard::set("NO_PROXY", None);
+    let _http_lower = EnvVarGuard::set("http_proxy", None);
+    let _https_lower = EnvVarGuard::set("https_proxy", None);
+    let _no_lower = EnvVarGuard::set("no_proxy", None);
+
+    // when
+    let config = ProxyConfig::from_env();
+
+    // then
+    assert!(config.is_empty());
+    assert!(config.http_proxy.is_none());
+    assert!(config.https_proxy.is_none());
+    assert!(config.no_proxy.is_none());
+}
+
+#[test]
+fn proxy_config_from_env_treats_empty_values_as_unset() {
+    // given
+    let _lock = env_lock();
+    let _http = EnvVarGuard::set("HTTP_PROXY", Some(""));
+    let _https = EnvVarGuard::set("HTTPS_PROXY", Some(""));
+    let _http_lower = EnvVarGuard::set("http_proxy", Some(""));
+    let _https_lower = EnvVarGuard::set("https_proxy", Some(""));
+    let _no = EnvVarGuard::set("NO_PROXY", Some(""));
+    let _no_lower = EnvVarGuard::set("no_proxy", Some(""));
+
+    // when
+    let config = ProxyConfig::from_env();
+
+    // then
+    assert!(config.is_empty());
+}
+
+#[test]
+fn build_client_with_env_proxy_config_succeeds() {
+    // given
+    let _lock = env_lock();
+    let _http = EnvVarGuard::set("HTTP_PROXY", Some("http://proxy.corp:3128"));
+    let _https = EnvVarGuard::set("HTTPS_PROXY", Some("http://secure.corp:3129"));
+    let _no = EnvVarGuard::set("NO_PROXY", Some("localhost"));
+    let _http_lower = EnvVarGuard::set("http_proxy", None);
+    let _https_lower = EnvVarGuard::set("https_proxy", None);
+    let _no_lower = EnvVarGuard::set("no_proxy", None);
+    let config = ProxyConfig::from_env();
+
+    // when
+    let result = build_http_client_with(&config);
+
+    // then
+    assert!(result.is_ok());
+}
+
+#[test]
+fn build_client_with_proxy_url_config_succeeds() {
+    // given
+    let config = ProxyConfig::from_proxy_url("http://unified.corp:3128");
+
+    // when
+    let result = build_http_client_with(&config);
+
+    // then
+    assert!(result.is_ok());
+}
+
+#[test]
+fn proxy_config_from_env_prefers_uppercase_over_lowercase() {
+    // given
+    let _lock = env_lock();
+    let _http_upper = EnvVarGuard::set("HTTP_PROXY", Some("http://upper.corp:3128"));
+    let _http_lower = EnvVarGuard::set("http_proxy", Some("http://lower.corp:3128"));
+    let _https = EnvVarGuard::set("HTTPS_PROXY", None);
+    let _https_lower = EnvVarGuard::set("https_proxy", None);
+    let _no = EnvVarGuard::set("NO_PROXY", None);
+    let _no_lower = EnvVarGuard::set("no_proxy", None);
+
+    // when
+    let config = ProxyConfig::from_env();
+
+    // then
+    assert_eq!(config.http_proxy.as_deref(), Some("http://upper.corp:3128"));
+}