Function newProxyClient

enterprise/aibridgeproxyd/aibridgeproxyd_test.go:391–420

newProxyClient creates an HTTP(S) client configured to use the proxy. It adds a Proxy-Authorization header with the provided token for authentication. The certPool and insecureSkipVerify parameters control TLS verification: - If the proxy listener is TLS, include the listener certificate. - For MITM

(t *testing.T, srv *aibridgeproxyd.Server, proxyAuth string, certPool *x509.CertPool, insecureSkipVerify bool)

//   - For tunneled requests, include the target server's certificate.
//   - Set insecureSkipVerify when the target cert SANs do not match the hostname.
func newProxyClient(t *testing.T, srv *aibridgeproxyd.Server, proxyAuth string, certPool *x509.CertPool, insecureSkipVerify bool) *http.Client {
	t.Helper()

	// Create an HTTP(S) client configured to use the proxy.
	scheme := "http"
	if srv.IsTLSListener() {
		scheme = "https"
	}
	proxyURL, err := url.Parse(scheme + "://" + srv.Addr())
	require.NoError(t, err)

	transport := &http.Transport{
		Proxy: http.ProxyURL(proxyURL),
		TLSClientConfig: &tls.Config{
			MinVersion:         tls.VersionTLS12,
			RootCAs:            certPool,
			InsecureSkipVerify: insecureSkipVerify, //nolint:gosec
		},
	}

	// Only set the header if proxyAuth is provided. This allows tests to
	// verify behavior when the Proxy-Authorization header is missing.
	if proxyAuth != "" {
		transport.ProxyConnectHeader = http.Header{
			"Proxy-Authorization": []string{proxyAuth},
		}
	}

	return &http.Client{Transport: transport}
}

// newTargetServer creates a mock HTTPS server that will be the target of proxied requests.
// It returns the server and its parsed URL. The server is automatically closed when the test ends.