feat(smart-proxy): add hot-reloadable global ingress security policy across Rust and TypeScript proxy layers

rust/crates/rustproxy/tests/common/mod.rs

@@ -136,7 +136,8 @@ pub async fn start_http_echo_backend(port: u16, backend_name: &str) -> JoinHandl
                 let path = parts.get(1).copied().unwrap_or("/");
 
                 // Extract Host header
-                let host = req_str.lines()
+                let host = req_str
+                    .lines()
                     .find(|l| l.to_lowercase().starts_with("host:"))
                     .map(|l| l[5..].trim())
                     .unwrap_or("unknown");
@@ -336,7 +337,8 @@ pub async fn start_ws_echo_backend(port: u16) -> JoinHandle<()> {
                 let req_str = String::from_utf8_lossy(&buf[..n]);
 
                 // Extract Sec-WebSocket-Key for proper handshake
-                let ws_key = req_str.lines()
+                let ws_key = req_str
+                    .lines()
                     .find(|l| l.to_lowercase().starts_with("sec-websocket-key:"))
                     .map(|l| l.split(':').nth(1).unwrap_or("").trim().to_string())
                     .unwrap_or_default();
@@ -378,7 +380,9 @@ pub fn generate_self_signed_cert(domain: &str) -> (String, String) {
     use rcgen::{CertificateParams, KeyPair};
 
     let mut params = CertificateParams::new(vec![domain.to_string()]).unwrap();
-    params.distinguished_name.push(rcgen::DnType::CommonName, domain);
+    params
+        .distinguished_name
+        .push(rcgen::DnType::CommonName, domain);
 
     let key_pair = KeyPair::generate().unwrap();
     let cert = params.self_signed(&key_pair).unwrap();
@@ -458,11 +462,7 @@ pub fn make_tls_terminate_route(
 
 /// Start a TLS WebSocket echo backend: accepts TLS, performs WS handshake, then echoes data.
 /// Combines TLS acceptance (like `start_tls_http_backend`) with WebSocket echo (like `start_ws_echo_backend`).
-pub async fn start_tls_ws_echo_backend(
-    port: u16,
-    cert_pem: &str,
-    key_pem: &str,
-) -> JoinHandle<()> {
+pub async fn start_tls_ws_echo_backend(port: u16, cert_pem: &str, key_pem: &str) -> JoinHandle<()> {
     use std::sync::Arc;
 
     let acceptor = rustproxy_passthrough::build_tls_acceptor(cert_pem, key_pem)

rust/crates/rustproxy/tests/integration_h3_proxy.rs

@@ -1,9 +1,9 @@
 mod common;
 
+use bytes::Buf;
 use common::*;
 use rustproxy::RustProxy;
-use rustproxy_config::{RustProxyOptions, TransportProtocol, RouteUdp, RouteQuic};
-use bytes::Buf;
+use rustproxy_config::{RouteQuic, RouteUdp, RustProxyOptions, TransportProtocol};
 use std::sync::Arc;
 
 /// Build a route that listens on UDP with HTTP/3 enabled and TLS terminate.
@@ -14,7 +14,14 @@ fn make_h3_route(
     cert_pem: &str,
     key_pem: &str,
 ) -> rustproxy_config::RouteConfig {
-    let mut route = make_tls_terminate_route(port, "localhost", target_host, target_port, cert_pem, key_pem);
+    let mut route = make_tls_terminate_route(
+        port,
+        "localhost",
+        target_host,
+        target_port,
+        cert_pem,
+        key_pem,
+    );
     route.route_match.transport = Some(TransportProtocol::All);
     // Keep domain="localhost" from make_tls_terminate_route — needed for TLS cert extraction
     route.action.udp = Some(RouteUdp {
@@ -89,11 +96,9 @@ async fn test_h3_response_stream_finishes() {
         .await
         .expect("QUIC handshake failed");
 
-    let (mut driver, mut send_request) = h3::client::new(
-        h3_quinn::Connection::new(connection),
-    )
-    .await
-    .expect("H3 connection setup failed");
+    let (mut driver, mut send_request) = h3::client::new(h3_quinn::Connection::new(connection))
+        .await
+        .expect("H3 connection setup failed");
 
     // Drive the H3 connection in background
     tokio::spawn(async move {
@@ -108,33 +113,46 @@ async fn test_h3_response_stream_finishes() {
         .body(())
         .unwrap();
 
-    let mut stream = send_request.send_request(req).await
+    let mut stream = send_request
+        .send_request(req)
+        .await
         .expect("Failed to send H3 request");
-    stream.finish().await
+    stream
+        .finish()
+        .await
         .expect("Failed to finish sending H3 request body");
 
     // 6. Read response headers
-    let resp = stream.recv_response().await
+    let resp = stream
+        .recv_response()
+        .await
         .expect("Failed to receive H3 response");
-    assert_eq!(resp.status(), http::StatusCode::OK,
-        "Expected 200 OK, got {}", resp.status());
+    assert_eq!(
+        resp.status(),
+        http::StatusCode::OK,
+        "Expected 200 OK, got {}",
+        resp.status()
+    );
 
     // 7. Read body and verify stream ends (FIN received)
     //    This is the critical assertion: recv_data() must return None (stream ended)
     //    within the timeout, NOT hang forever waiting for a FIN that never arrives.
-    let result = with_timeout(async {
-        let mut total = 0usize;
-        while let Some(chunk) = stream.recv_data().await.expect("H3 data receive error") {
-            total += chunk.remaining();
-        }
-        // recv_data() returned None => stream ended (FIN received)
-        total
-    }, 10)
+    let result = with_timeout(
+        async {
+            let mut total = 0usize;
+            while let Some(chunk) = stream.recv_data().await.expect("H3 data receive error") {
+                total += chunk.remaining();
+            }
+            // recv_data() returned None => stream ended (FIN received)
+            total
+        },
+        10,
+    )
     .await;
 
     let bytes_received = result.expect(
         "TIMEOUT: H3 stream never ended (FIN not received by client). \
-         The proxy sent all response data but failed to send the QUIC stream FIN."
+         The proxy sent all response data but failed to send the QUIC stream FIN.",
     );
     assert_eq!(
         bytes_received,

rust/crates/rustproxy/tests/integration_http_proxy.rs

@@ -43,17 +43,32 @@ async fn test_http_forward_basic() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let response = send_http_request(proxy_port, "anyhost.com", "GET", "/hello").await;
-        let body = extract_body(&response);
-        body.to_string()
-    }, 10)
+    let result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "anyhost.com", "GET", "/hello").await;
+            let body = extract_body(&response);
+            body.to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(result.contains(r#""method":"GET"#), "Expected GET method, got: {}", result);
-    assert!(result.contains(r#""path":"/hello"#), "Expected /hello path, got: {}", result);
-    assert!(result.contains(r#""backend":"main"#), "Expected main backend, got: {}", result);
+    assert!(
+        result.contains(r#""method":"GET"#),
+        "Expected GET method, got: {}",
+        result
+    );
+    assert!(
+        result.contains(r#""path":"/hello"#),
+        "Expected /hello path, got: {}",
+        result
+    );
+    assert!(
+        result.contains(r#""backend":"main"#),
+        "Expected main backend, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -69,8 +84,18 @@ async fn test_http_forward_host_routing() {
 
     let options = RustProxyOptions {
         routes: vec![
-            make_test_route(proxy_port, Some("alpha.example.com"), "127.0.0.1", backend1_port),
-            make_test_route(proxy_port, Some("beta.example.com"), "127.0.0.1", backend2_port),
+            make_test_route(
+                proxy_port,
+                Some("alpha.example.com"),
+                "127.0.0.1",
+                backend1_port,
+            ),
+            make_test_route(
+                proxy_port,
+                Some("beta.example.com"),
+                "127.0.0.1",
+                backend2_port,
+            ),
         ],
         ..Default::default()
     };
@@ -80,24 +105,38 @@ async fn test_http_forward_host_routing() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Test alpha domain
-    let alpha_result = with_timeout(async {
-        let response = send_http_request(proxy_port, "alpha.example.com", "GET", "/").await;
-        extract_body(&response).to_string()
-    }, 10)
+    let alpha_result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "alpha.example.com", "GET", "/").await;
+            extract_body(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(alpha_result.contains(r#""backend":"alpha"#), "Expected alpha backend, got: {}", alpha_result);
+    assert!(
+        alpha_result.contains(r#""backend":"alpha"#),
+        "Expected alpha backend, got: {}",
+        alpha_result
+    );
 
     // Test beta domain
-    let beta_result = with_timeout(async {
-        let response = send_http_request(proxy_port, "beta.example.com", "GET", "/").await;
-        extract_body(&response).to_string()
-    }, 10)
+    let beta_result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "beta.example.com", "GET", "/").await;
+            extract_body(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(beta_result.contains(r#""backend":"beta"#), "Expected beta backend, got: {}", beta_result);
+    assert!(
+        beta_result.contains(r#""backend":"beta"#),
+        "Expected beta backend, got: {}",
+        beta_result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -127,24 +166,38 @@ async fn test_http_forward_path_routing() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Test API path
-    let api_result = with_timeout(async {
-        let response = send_http_request(proxy_port, "any.com", "GET", "/api/users").await;
-        extract_body(&response).to_string()
-    }, 10)
+    let api_result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "any.com", "GET", "/api/users").await;
+            extract_body(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(api_result.contains(r#""backend":"api"#), "Expected api backend, got: {}", api_result);
+    assert!(
+        api_result.contains(r#""backend":"api"#),
+        "Expected api backend, got: {}",
+        api_result
+    );
 
     // Test web path (no /api prefix)
-    let web_result = with_timeout(async {
-        let response = send_http_request(proxy_port, "any.com", "GET", "/index.html").await;
-        extract_body(&response).to_string()
-    }, 10)
+    let web_result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "any.com", "GET", "/index.html").await;
+            extract_body(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(web_result.contains(r#""backend":"web"#), "Expected web backend, got: {}", web_result);
+    assert!(
+        web_result.contains(r#""backend":"web"#),
+        "Expected web backend, got: {}",
+        web_result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -184,9 +237,18 @@ async fn test_http_forward_cors_preflight() {
     .unwrap();
 
     // Should get 204 No Content with CORS headers
-    assert!(result.contains("204"), "Expected 204 status, got: {}", result);
-    assert!(result.to_lowercase().contains("access-control-allow-origin"),
-        "Expected CORS header, got: {}", result);
+    assert!(
+        result.contains("204"),
+        "Expected 204 status, got: {}",
+        result
+    );
+    assert!(
+        result
+            .to_lowercase()
+            .contains("access-control-allow-origin"),
+        "Expected CORS header, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -208,15 +270,22 @@ async fn test_http_forward_backend_error() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let response = send_http_request(proxy_port, "example.com", "GET", "/fail").await;
-        response
-    }, 10)
+    let result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "example.com", "GET", "/fail").await;
+            response
+        },
+        10,
+    )
     .await
     .unwrap();
 
     // Proxy should relay the 500 from backend
-    assert!(result.contains("500"), "Expected 500 status, got: {}", result);
+    assert!(
+        result.contains("500"),
+        "Expected 500 status, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -227,7 +296,12 @@ async fn test_http_forward_no_route_matched() {
 
     // Create a route only for a specific domain
     let options = RustProxyOptions {
-        routes: vec![make_test_route(proxy_port, Some("known.example.com"), "127.0.0.1", 9999)],
+        routes: vec![make_test_route(
+            proxy_port,
+            Some("known.example.com"),
+            "127.0.0.1",
+            9999,
+        )],
         ..Default::default()
     };
 
@@ -235,15 +309,22 @@ async fn test_http_forward_no_route_matched() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let response = send_http_request(proxy_port, "unknown.example.com", "GET", "/").await;
-        response
-    }, 10)
+    let result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "unknown.example.com", "GET", "/").await;
+            response
+        },
+        10,
+    )
     .await
     .unwrap();
 
     // Should get 502 Bad Gateway (no route matched)
-    assert!(result.contains("502"), "Expected 502 status, got: {}", result);
+    assert!(
+        result.contains("502"),
+        "Expected 502 status, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -262,15 +343,22 @@ async fn test_http_forward_backend_unavailable() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let response = send_http_request(proxy_port, "example.com", "GET", "/").await;
-        response
-    }, 10)
+    let result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "example.com", "GET", "/").await;
+            response
+        },
+        10,
+    )
     .await
     .unwrap();
 
     // Should get 502 Bad Gateway (backend unavailable)
-    assert!(result.contains("502"), "Expected 502 status, got: {}", result);
+    assert!(
+        result.contains("502"),
+        "Expected 502 status, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -286,7 +374,12 @@ async fn test_https_terminate_http_forward() {
 
     let options = RustProxyOptions {
         routes: vec![make_tls_terminate_route(
-            proxy_port, domain, "127.0.0.1", backend_port, &cert_pem, &key_pem,
+            proxy_port,
+            domain,
+            "127.0.0.1",
+            backend_port,
+            &cert_pem,
+            &key_pem,
         )],
         ..Default::default()
     };
@@ -295,38 +388,53 @@ async fn test_https_terminate_http_forward() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let _ = rustls::crypto::ring::default_provider().install_default();
-        let tls_config = rustls::ClientConfig::builder()
-            .dangerous()
-            .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
-            .with_no_client_auth();
-        let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
+    let result = with_timeout(
+        async {
+            let _ = rustls::crypto::ring::default_provider().install_default();
+            let tls_config = rustls::ClientConfig::builder()
+                .dangerous()
+                .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
+                .with_no_client_auth();
+            let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        // Send HTTP request through TLS
-        let request = format!(
-            "GET /api/data HTTP/1.1\r\nHost: {}\r\nConnection: close\r\n\r\n",
-            domain
-        );
-        tls_stream.write_all(request.as_bytes()).await.unwrap();
+            // Send HTTP request through TLS
+            let request = format!(
+                "GET /api/data HTTP/1.1\r\nHost: {}\r\nConnection: close\r\n\r\n",
+                domain
+            );
+            tls_stream.write_all(request.as_bytes()).await.unwrap();
 
-        let mut response = Vec::new();
-        tls_stream.read_to_end(&mut response).await.unwrap();
-        String::from_utf8_lossy(&response).to_string()
-    }, 10)
+            let mut response = Vec::new();
+            tls_stream.read_to_end(&mut response).await.unwrap();
+            String::from_utf8_lossy(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
     let body = extract_body(&result);
-    assert!(body.contains(r#""method":"GET"#), "Expected GET, got: {}", body);
-    assert!(body.contains(r#""path":"/api/data"#), "Expected /api/data, got: {}", body);
-    assert!(body.contains(r#""backend":"tls-backend"#), "Expected tls-backend, got: {}", body);
+    assert!(
+        body.contains(r#""method":"GET"#),
+        "Expected GET, got: {}",
+        body
+    );
+    assert!(
+        body.contains(r#""path":"/api/data"#),
+        "Expected /api/data, got: {}",
+        body
+    );
+    assert!(
+        body.contains(r#""backend":"tls-backend"#),
+        "Expected tls-backend, got: {}",
+        body
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -347,59 +455,68 @@ async fn test_websocket_through_proxy() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        // Send WebSocket upgrade request
-        let request = format!(
-            "GET /ws HTTP/1.1\r\n\
+            // Send WebSocket upgrade request
+            let request = format!(
+                "GET /ws HTTP/1.1\r\n\
              Host: example.com\r\n\
              Upgrade: websocket\r\n\
              Connection: Upgrade\r\n\
              Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\r\n\
              Sec-WebSocket-Version: 13\r\n\
              \r\n"
-        );
-        stream.write_all(request.as_bytes()).await.unwrap();
+            );
+            stream.write_all(request.as_bytes()).await.unwrap();
 
-        // Read the 101 response
-        let mut response_buf = Vec::with_capacity(4096);
-        let mut temp = [0u8; 1];
-        loop {
-            let n = stream.read(&mut temp).await.unwrap();
-            if n == 0 { break; }
-            response_buf.push(temp[0]);
-            if response_buf.len() >= 4 {
-                let len = response_buf.len();
-                if response_buf[len-4..] == *b"\r\n\r\n" {
+            // Read the 101 response
+            let mut response_buf = Vec::with_capacity(4096);
+            let mut temp = [0u8; 1];
+            loop {
+                let n = stream.read(&mut temp).await.unwrap();
+                if n == 0 {
                     break;
                 }
+                response_buf.push(temp[0]);
+                if response_buf.len() >= 4 {
+                    let len = response_buf.len();
+                    if response_buf[len - 4..] == *b"\r\n\r\n" {
+                        break;
+                    }
+                }
             }
-        }
 
-        let response_str = String::from_utf8_lossy(&response_buf).to_string();
-        assert!(response_str.contains("101"), "Expected 101 Switching Protocols, got: {}", response_str);
-        assert!(
-            response_str.to_lowercase().contains("upgrade: websocket"),
-            "Expected Upgrade header, got: {}",
-            response_str
-        );
+            let response_str = String::from_utf8_lossy(&response_buf).to_string();
+            assert!(
+                response_str.contains("101"),
+                "Expected 101 Switching Protocols, got: {}",
+                response_str
+            );
+            assert!(
+                response_str.to_lowercase().contains("upgrade: websocket"),
+                "Expected Upgrade header, got: {}",
+                response_str
+            );
 
-        // After upgrade, send data and verify echo
-        let test_data = b"Hello WebSocket!";
-        stream.write_all(test_data).await.unwrap();
+            // After upgrade, send data and verify echo
+            let test_data = b"Hello WebSocket!";
+            stream.write_all(test_data).await.unwrap();
 
-        // Read echoed data
-        let mut echo_buf = vec![0u8; 256];
-        let n = stream.read(&mut echo_buf).await.unwrap();
-        let echoed = &echo_buf[..n];
+            // Read echoed data
+            let mut echo_buf = vec![0u8; 256];
+            let n = stream.read(&mut echo_buf).await.unwrap();
+            let echoed = &echo_buf[..n];
 
-        assert_eq!(echoed, test_data, "Expected echo of sent data");
+            assert_eq!(echoed, test_data, "Expected echo of sent data");
 
-        "ok".to_string()
-    }, 10)
+            "ok".to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -431,12 +548,22 @@ async fn test_terminate_and_reencrypt_http_routing() {
 
     // Create terminate-and-reencrypt routes
     let mut route1 = make_tls_terminate_route(
-        proxy_port, "alpha.example.com", "127.0.0.1", backend1_port, &cert1, &key1,
+        proxy_port,
+        "alpha.example.com",
+        "127.0.0.1",
+        backend1_port,
+        &cert1,
+        &key1,
     );
     route1.action.tls.as_mut().unwrap().mode = rustproxy_config::TlsMode::TerminateAndReencrypt;
 
     let mut route2 = make_tls_terminate_route(
-        proxy_port, "beta.example.com", "127.0.0.1", backend2_port, &cert2, &key2,
+        proxy_port,
+        "beta.example.com",
+        "127.0.0.1",
+        backend2_port,
+        &cert2,
+        &key2,
     );
     route2.action.tls.as_mut().unwrap().mode = rustproxy_config::TlsMode::TerminateAndReencrypt;
 
@@ -450,27 +577,32 @@ async fn test_terminate_and_reencrypt_http_routing() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Test alpha domain - HTTP request through TLS terminate-and-reencrypt
-    let alpha_result = with_timeout(async {
-        let _ = rustls::crypto::ring::default_provider().install_default();
-        let tls_config = rustls::ClientConfig::builder()
-            .dangerous()
-            .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
-            .with_no_client_auth();
-        let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
+    let alpha_result = with_timeout(
+        async {
+            let _ = rustls::crypto::ring::default_provider().install_default();
+            let tls_config = rustls::ClientConfig::builder()
+                .dangerous()
+                .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
+                .with_no_client_auth();
+            let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let server_name = rustls::pki_types::ServerName::try_from("alpha.example.com".to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let server_name =
+                rustls::pki_types::ServerName::try_from("alpha.example.com".to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        let request = "GET /api/data HTTP/1.1\r\nHost: alpha.example.com\r\nConnection: close\r\n\r\n";
-        tls_stream.write_all(request.as_bytes()).await.unwrap();
+            let request =
+                "GET /api/data HTTP/1.1\r\nHost: alpha.example.com\r\nConnection: close\r\n\r\n";
+            tls_stream.write_all(request.as_bytes()).await.unwrap();
 
-        let mut response = Vec::new();
-        tls_stream.read_to_end(&mut response).await.unwrap();
-        String::from_utf8_lossy(&response).to_string()
-    }, 10)
+            let mut response = Vec::new();
+            tls_stream.read_to_end(&mut response).await.unwrap();
+            String::from_utf8_lossy(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -498,27 +630,32 @@ async fn test_terminate_and_reencrypt_http_routing() {
     );
 
     // Test beta domain - different host goes to different backend
-    let beta_result = with_timeout(async {
-        let _ = rustls::crypto::ring::default_provider().install_default();
-        let tls_config = rustls::ClientConfig::builder()
-            .dangerous()
-            .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
-            .with_no_client_auth();
-        let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
+    let beta_result = with_timeout(
+        async {
+            let _ = rustls::crypto::ring::default_provider().install_default();
+            let tls_config = rustls::ClientConfig::builder()
+                .dangerous()
+                .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
+                .with_no_client_auth();
+            let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let server_name = rustls::pki_types::ServerName::try_from("beta.example.com".to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let server_name =
+                rustls::pki_types::ServerName::try_from("beta.example.com".to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        let request = "GET /other HTTP/1.1\r\nHost: beta.example.com\r\nConnection: close\r\n\r\n";
-        tls_stream.write_all(request.as_bytes()).await.unwrap();
+            let request =
+                "GET /other HTTP/1.1\r\nHost: beta.example.com\r\nConnection: close\r\n\r\n";
+            tls_stream.write_all(request.as_bytes()).await.unwrap();
 
-        let mut response = Vec::new();
-        tls_stream.read_to_end(&mut response).await.unwrap();
-        String::from_utf8_lossy(&response).to_string()
-    }, 10)
+            let mut response = Vec::new();
+            tls_stream.read_to_end(&mut response).await.unwrap();
+            String::from_utf8_lossy(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -589,14 +726,12 @@ async fn test_terminate_and_reencrypt_websocket() {
                 .dangerous()
                 .with_custom_certificate_verifier(std::sync::Arc::new(InsecureVerifier))
                 .with_no_client_auth();
-            let connector =
-                tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
+            let connector = tokio_rustls::TlsConnector::from(std::sync::Arc::new(tls_config));
 
             let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
                 .await
                 .unwrap();
-            let server_name =
-                rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
+            let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
             let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
             // Send WebSocket upgrade request through TLS
@@ -685,10 +820,13 @@ async fn test_protocol_field_in_route_config() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // HTTP request should match the route and get proxied
-    let result = with_timeout(async {
-        let response = send_http_request(proxy_port, "example.com", "GET", "/test").await;
-        extract_body(&response).to_string()
-    }, 10)
+    let result = with_timeout(
+        async {
+            let response = send_http_request(proxy_port, "example.com", "GET", "/test").await;
+            extract_body(&response).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 

rust/crates/rustproxy/tests/integration_proxy_lifecycle.rs

@@ -20,13 +20,19 @@ async fn test_start_and_stop() {
     assert!(!wait_for_port(port, 200).await);
 
     proxy.start().await.unwrap();
-    assert!(wait_for_port(port, 2000).await, "Port should be listening after start");
+    assert!(
+        wait_for_port(port, 2000).await,
+        "Port should be listening after start"
+    );
 
     proxy.stop().await.unwrap();
 
     // Give the OS a moment to release the port
     tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-    assert!(!wait_for_port(port, 200).await, "Port should not be listening after stop");
+    assert!(
+        !wait_for_port(port, 200).await,
+        "Port should not be listening after stop"
+    );
 }
 
 #[tokio::test]
@@ -54,7 +60,12 @@ async fn test_update_routes_hot_reload() {
     let port = next_port();
 
     let options = RustProxyOptions {
-        routes: vec![make_test_route(port, Some("old.example.com"), "127.0.0.1", 8080)],
+        routes: vec![make_test_route(
+            port,
+            Some("old.example.com"),
+            "127.0.0.1",
+            8080,
+        )],
         ..Default::default()
     };
 
@@ -62,9 +73,12 @@ async fn test_update_routes_hot_reload() {
     proxy.start().await.unwrap();
 
     // Update routes atomically
-    let new_routes = vec![
-        make_test_route(port, Some("new.example.com"), "127.0.0.1", 9090),
-    ];
+    let new_routes = vec![make_test_route(
+        port,
+        Some("new.example.com"),
+        "127.0.0.1",
+        9090,
+    )];
     let result = proxy.update_routes(new_routes).await;
     assert!(result.is_ok());
 
@@ -87,15 +101,24 @@ async fn test_add_remove_listening_port() {
 
     // Add a new port
     proxy.add_listening_port(port2).await.unwrap();
-    assert!(wait_for_port(port2, 2000).await, "New port should be listening");
+    assert!(
+        wait_for_port(port2, 2000).await,
+        "New port should be listening"
+    );
 
     // Remove the port
     proxy.remove_listening_port(port2).await.unwrap();
     tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-    assert!(!wait_for_port(port2, 200).await, "Removed port should not be listening");
+    assert!(
+        !wait_for_port(port2, 200).await,
+        "Removed port should not be listening"
+    );
 
     // Original port should still be listening
-    assert!(wait_for_port(port1, 200).await, "Original port should still be listening");
+    assert!(
+        wait_for_port(port1, 200).await,
+        "Original port should still be listening"
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -168,7 +191,11 @@ async fn test_metrics_track_connections() {
     tokio::time::sleep(std::time::Duration::from_millis(100)).await;
 
     let stats = proxy.get_statistics();
-    assert!(stats.total_connections > 0, "Expected total_connections > 0, got {}", stats.total_connections);
+    assert!(
+        stats.total_connections > 0,
+        "Expected total_connections > 0, got {}",
+        stats.total_connections
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -205,8 +232,11 @@ async fn test_metrics_track_bytes() {
     tokio::time::sleep(std::time::Duration::from_millis(100)).await;
 
     let stats = proxy.get_statistics();
-    assert!(stats.total_connections > 0,
-        "Expected some connections tracked, got {}", stats.total_connections);
+    assert!(
+        stats.total_connections > 0,
+        "Expected some connections tracked, got {}",
+        stats.total_connections
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -228,23 +258,38 @@ async fn test_hot_reload_port_changes() {
     let mut proxy = RustProxy::new(options).unwrap();
     proxy.start().await.unwrap();
     assert!(wait_for_port(port1, 2000).await);
-    assert!(!wait_for_port(port2, 200).await, "port2 should not be listening yet");
+    assert!(
+        !wait_for_port(port2, 200).await,
+        "port2 should not be listening yet"
+    );
 
     // Update routes to use port2 instead
-    let new_routes = vec![
-        make_test_route(port2, None, "127.0.0.1", backend_port),
-    ];
+    let new_routes = vec![make_test_route(port2, None, "127.0.0.1", backend_port)];
     proxy.update_routes(new_routes).await.unwrap();
 
     // Port2 should now be listening, port1 should be closed
-    assert!(wait_for_port(port2, 2000).await, "port2 should be listening after reload");
+    assert!(
+        wait_for_port(port2, 2000).await,
+        "port2 should be listening after reload"
+    );
     tokio::time::sleep(std::time::Duration::from_millis(100)).await;
-    assert!(!wait_for_port(port1, 200).await, "port1 should be closed after reload");
+    assert!(
+        !wait_for_port(port1, 200).await,
+        "port1 should be closed after reload"
+    );
 
     // Verify port2 works
     let ports = proxy.get_listening_ports();
-    assert!(ports.contains(&port2), "Expected port2 in listening ports: {:?}", ports);
-    assert!(!ports.contains(&port1), "port1 should not be in listening ports: {:?}", ports);
+    assert!(
+        ports.contains(&port2),
+        "Expected port2 in listening ports: {:?}",
+        ports
+    );
+    assert!(
+        !ports.contains(&port1),
+        "port1 should not be in listening ports: {:?}",
+        ports
+    );
 
     proxy.stop().await.unwrap();
 }

rust/crates/rustproxy/tests/integration_tcp_passthrough.rs

@@ -24,19 +24,25 @@ async fn test_tcp_forward_echo() {
     proxy.start().await.unwrap();
 
     // Wait for proxy to be ready
-    assert!(wait_for_port(proxy_port, 2000).await, "Proxy port not ready");
+    assert!(
+        wait_for_port(proxy_port, 2000).await,
+        "Proxy port not ready"
+    );
 
     // Connect and send data
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        stream.write_all(b"hello world").await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            stream.write_all(b"hello world").await.unwrap();
 
-        let mut buf = vec![0u8; 1024];
-        let n = stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 5)
+            let mut buf = vec![0u8; 1024];
+            let n = stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        5,
+    )
     .await
     .unwrap();
 
@@ -61,21 +67,24 @@ async fn test_tcp_forward_large_payload() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        // Send 1MB of data
-        let data = vec![b'A'; 1_000_000];
-        stream.write_all(&data).await.unwrap();
-        stream.shutdown().await.unwrap();
+            // Send 1MB of data
+            let data = vec![b'A'; 1_000_000];
+            stream.write_all(&data).await.unwrap();
+            stream.shutdown().await.unwrap();
 
-        // Read all back
-        let mut received = Vec::new();
-        stream.read_to_end(&mut received).await.unwrap();
-        received.len()
-    }, 10)
+            // Read all back
+            let mut received = Vec::new();
+            stream.read_to_end(&mut received).await.unwrap();
+            received.len()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -100,29 +109,32 @@ async fn test_tcp_forward_multiple_connections() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let mut handles = Vec::new();
-        for i in 0..10 {
-            let port = proxy_port;
-            handles.push(tokio::spawn(async move {
-                let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port))
-                    .await
-                    .unwrap();
-                let msg = format!("connection-{}", i);
-                stream.write_all(msg.as_bytes()).await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut handles = Vec::new();
+            for i in 0..10 {
+                let port = proxy_port;
+                handles.push(tokio::spawn(async move {
+                    let mut stream = TcpStream::connect(format!("127.0.0.1:{}", port))
+                        .await
+                        .unwrap();
+                    let msg = format!("connection-{}", i);
+                    stream.write_all(msg.as_bytes()).await.unwrap();
 
-                let mut buf = vec![0u8; 1024];
-                let n = stream.read(&mut buf).await.unwrap();
-                String::from_utf8_lossy(&buf[..n]).to_string()
-            }));
-        }
+                    let mut buf = vec![0u8; 1024];
+                    let n = stream.read(&mut buf).await.unwrap();
+                    String::from_utf8_lossy(&buf[..n]).to_string()
+                }));
+            }
 
-        let mut results = Vec::new();
-        for handle in handles {
-            results.push(handle.await.unwrap());
-        }
-        results
-    }, 10)
+            let mut results = Vec::new();
+            for handle in handles {
+                results.push(handle.await.unwrap());
+            }
+            results
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -149,14 +161,20 @@ async fn test_tcp_forward_backend_unreachable() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Connection should complete (proxy accepts it) but data should not flow
-    let result = with_timeout(async {
-        let stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port)).await;
-        stream.is_ok()
-    }, 5)
+    let result = with_timeout(
+        async {
+            let stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port)).await;
+            stream.is_ok()
+        },
+        5,
+    )
     .await
     .unwrap();
 
-    assert!(result, "Should be able to connect to proxy even if backend is down");
+    assert!(
+        result,
+        "Should be able to connect to proxy even if backend is down"
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -178,16 +196,19 @@ async fn test_tcp_forward_bidirectional() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        stream.write_all(b"test data").await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            stream.write_all(b"test data").await.unwrap();
 
-        let mut buf = vec![0u8; 1024];
-        let n = stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 5)
+            let mut buf = vec![0u8; 1024];
+            let n = stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        5,
+    )
     .await
     .unwrap();
 

rust/crates/rustproxy/tests/integration_tls_passthrough.rs

@@ -65,8 +65,18 @@ async fn test_tls_passthrough_sni_routing() {
 
     let options = RustProxyOptions {
         routes: vec![
-            make_tls_passthrough_route(proxy_port, Some("one.example.com"), "127.0.0.1", backend1_port),
-            make_tls_passthrough_route(proxy_port, Some("two.example.com"), "127.0.0.1", backend2_port),
+            make_tls_passthrough_route(
+                proxy_port,
+                Some("one.example.com"),
+                "127.0.0.1",
+                backend1_port,
+            ),
+            make_tls_passthrough_route(
+                proxy_port,
+                Some("two.example.com"),
+                "127.0.0.1",
+                backend2_port,
+            ),
         ],
         ..Default::default()
     };
@@ -76,39 +86,53 @@ async fn test_tls_passthrough_sni_routing() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Send a fake ClientHello with SNI "one.example.com"
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let hello = build_client_hello("one.example.com");
-        stream.write_all(&hello).await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let hello = build_client_hello("one.example.com");
+            stream.write_all(&hello).await.unwrap();
 
-        let mut buf = vec![0u8; 4096];
-        let n = stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 5)
+            let mut buf = vec![0u8; 4096];
+            let n = stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        5,
+    )
     .await
     .unwrap();
 
     // Backend1 should have received the ClientHello and prefixed its response
-    assert!(result.starts_with("BACKEND1:"), "Expected BACKEND1 prefix, got: {}", result);
+    assert!(
+        result.starts_with("BACKEND1:"),
+        "Expected BACKEND1 prefix, got: {}",
+        result
+    );
 
     // Now test routing to backend2
-    let result2 = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let hello = build_client_hello("two.example.com");
-        stream.write_all(&hello).await.unwrap();
+    let result2 = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let hello = build_client_hello("two.example.com");
+            stream.write_all(&hello).await.unwrap();
 
-        let mut buf = vec![0u8; 4096];
-        let n = stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 5)
+            let mut buf = vec![0u8; 4096];
+            let n = stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        5,
+    )
     .await
     .unwrap();
 
-    assert!(result2.starts_with("BACKEND2:"), "Expected BACKEND2 prefix, got: {}", result2);
+    assert!(
+        result2.starts_with("BACKEND2:"),
+        "Expected BACKEND2 prefix, got: {}",
+        result2
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -121,9 +145,12 @@ async fn test_tls_passthrough_unknown_sni() {
     let _backend = start_echo_server(backend_port).await;
 
     let options = RustProxyOptions {
-        routes: vec![
-            make_tls_passthrough_route(proxy_port, Some("known.example.com"), "127.0.0.1", backend_port),
-        ],
+        routes: vec![make_tls_passthrough_route(
+            proxy_port,
+            Some("known.example.com"),
+            "127.0.0.1",
+            backend_port,
+        )],
         ..Default::default()
     };
 
@@ -132,21 +159,24 @@ async fn test_tls_passthrough_unknown_sni() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Send ClientHello with unknown SNI - should get no response (connection dropped)
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let hello = build_client_hello("unknown.example.com");
-        stream.write_all(&hello).await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let hello = build_client_hello("unknown.example.com");
+            stream.write_all(&hello).await.unwrap();
 
-        let mut buf = vec![0u8; 4096];
-        // Should either get 0 bytes (closed) or an error
-        match stream.read(&mut buf).await {
-            Ok(0) => true, // Connection closed = no route matched
-            Ok(_) => false, // Got data = route shouldn't have matched
-            Err(_) => true, // Error = connection dropped
-        }
-    }, 5)
+            let mut buf = vec![0u8; 4096];
+            // Should either get 0 bytes (closed) or an error
+            match stream.read(&mut buf).await {
+                Ok(0) => true,  // Connection closed = no route matched
+                Ok(_) => false, // Got data = route shouldn't have matched
+                Err(_) => true, // Error = connection dropped
+            }
+        },
+        5,
+    )
     .await
     .unwrap();
 
@@ -163,9 +193,12 @@ async fn test_tls_passthrough_wildcard_domain() {
     let _backend = start_prefix_echo_server(backend_port, "WILDCARD:").await;
 
     let options = RustProxyOptions {
-        routes: vec![
-            make_tls_passthrough_route(proxy_port, Some("*.example.com"), "127.0.0.1", backend_port),
-        ],
+        routes: vec![make_tls_passthrough_route(
+            proxy_port,
+            Some("*.example.com"),
+            "127.0.0.1",
+            backend_port,
+        )],
         ..Default::default()
     };
 
@@ -174,21 +207,28 @@ async fn test_tls_passthrough_wildcard_domain() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Should match any subdomain of example.com
-    let result = with_timeout(async {
-        let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
-        let hello = build_client_hello("anything.example.com");
-        stream.write_all(&hello).await.unwrap();
+    let result = with_timeout(
+        async {
+            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
+            let hello = build_client_hello("anything.example.com");
+            stream.write_all(&hello).await.unwrap();
 
-        let mut buf = vec![0u8; 4096];
-        let n = stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 5)
+            let mut buf = vec![0u8; 4096];
+            let n = stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        5,
+    )
     .await
     .unwrap();
 
-    assert!(result.starts_with("WILDCARD:"), "Expected WILDCARD prefix, got: {}", result);
+    assert!(
+        result.starts_with("WILDCARD:"),
+        "Expected WILDCARD prefix, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -222,24 +262,29 @@ async fn test_tls_passthrough_multiple_domains() {
         ("beta.example.com", "B2:"),
         ("gamma.example.com", "B3:"),
     ] {
-        let result = with_timeout(async {
-            let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-                .await
-                .unwrap();
-            let hello = build_client_hello(domain);
-            stream.write_all(&hello).await.unwrap();
+        let result = with_timeout(
+            async {
+                let mut stream = TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                    .await
+                    .unwrap();
+                let hello = build_client_hello(domain);
+                stream.write_all(&hello).await.unwrap();
 
-            let mut buf = vec![0u8; 4096];
-            let n = stream.read(&mut buf).await.unwrap();
-            String::from_utf8_lossy(&buf[..n]).to_string()
-        }, 5)
+                let mut buf = vec![0u8; 4096];
+                let n = stream.read(&mut buf).await.unwrap();
+                String::from_utf8_lossy(&buf[..n]).to_string()
+            },
+            5,
+        )
         .await
         .unwrap();
 
         assert!(
             result.starts_with(expected_prefix),
             "Domain {} should route to {}, got: {}",
-            domain, expected_prefix, result
+            domain,
+            expected_prefix,
+            result
         );
     }
 

rust/crates/rustproxy/tests/integration_tls_terminate.rs

@@ -74,7 +74,12 @@ async fn test_tls_terminate_basic() {
 
     let options = RustProxyOptions {
         routes: vec![make_tls_terminate_route(
-            proxy_port, domain, "127.0.0.1", backend_port, &cert_pem, &key_pem,
+            proxy_port,
+            domain,
+            "127.0.0.1",
+            backend_port,
+            &cert_pem,
+            &key_pem,
         )],
         ..Default::default()
     };
@@ -84,23 +89,26 @@ async fn test_tls_terminate_basic() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Connect with TLS client
-    let result = with_timeout(async {
-        let tls_config = make_insecure_tls_client_config();
-        let connector = tokio_rustls::TlsConnector::from(tls_config);
+    let result = with_timeout(
+        async {
+            let tls_config = make_insecure_tls_client_config();
+            let connector = tokio_rustls::TlsConnector::from(tls_config);
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        tls_stream.write_all(b"hello TLS").await.unwrap();
+            tls_stream.write_all(b"hello TLS").await.unwrap();
 
-        let mut buf = vec![0u8; 1024];
-        let n = tls_stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 10)
+            let mut buf = vec![0u8; 1024];
+            let n = tls_stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -125,7 +133,12 @@ async fn test_tls_terminate_and_reencrypt() {
 
     // Create terminate-and-reencrypt route
     let mut route = make_tls_terminate_route(
-        proxy_port, domain, "127.0.0.1", backend_port, &proxy_cert, &proxy_key,
+        proxy_port,
+        domain,
+        "127.0.0.1",
+        backend_port,
+        &proxy_cert,
+        &proxy_key,
     );
     route.action.tls.as_mut().unwrap().mode = rustproxy_config::TlsMode::TerminateAndReencrypt;
 
@@ -138,23 +151,26 @@ async fn test_tls_terminate_and_reencrypt() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let tls_config = make_insecure_tls_client_config();
-        let connector = tokio_rustls::TlsConnector::from(tls_config);
+    let result = with_timeout(
+        async {
+            let tls_config = make_insecure_tls_client_config();
+            let connector = tokio_rustls::TlsConnector::from(tls_config);
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        tls_stream.write_all(b"hello reencrypt").await.unwrap();
+            tls_stream.write_all(b"hello reencrypt").await.unwrap();
 
-        let mut buf = vec![0u8; 1024];
-        let n = tls_stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 10)
+            let mut buf = vec![0u8; 1024];
+            let n = tls_stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
@@ -177,8 +193,22 @@ async fn test_tls_terminate_sni_cert_selection() {
 
     let options = RustProxyOptions {
         routes: vec![
-            make_tls_terminate_route(proxy_port, "alpha.example.com", "127.0.0.1", backend1_port, &cert1, &key1),
-            make_tls_terminate_route(proxy_port, "beta.example.com", "127.0.0.1", backend2_port, &cert2, &key2),
+            make_tls_terminate_route(
+                proxy_port,
+                "alpha.example.com",
+                "127.0.0.1",
+                backend1_port,
+                &cert1,
+                &key1,
+            ),
+            make_tls_terminate_route(
+                proxy_port,
+                "beta.example.com",
+                "127.0.0.1",
+                backend2_port,
+                &cert2,
+                &key2,
+            ),
         ],
         ..Default::default()
     };
@@ -188,27 +218,35 @@ async fn test_tls_terminate_sni_cert_selection() {
     assert!(wait_for_port(proxy_port, 2000).await);
 
     // Test alpha domain
-    let result = with_timeout(async {
-        let tls_config = make_insecure_tls_client_config();
-        let connector = tokio_rustls::TlsConnector::from(tls_config);
+    let result = with_timeout(
+        async {
+            let tls_config = make_insecure_tls_client_config();
+            let connector = tokio_rustls::TlsConnector::from(tls_config);
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        let server_name = rustls::pki_types::ServerName::try_from("alpha.example.com".to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let server_name =
+                rustls::pki_types::ServerName::try_from("alpha.example.com".to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        tls_stream.write_all(b"test").await.unwrap();
+            tls_stream.write_all(b"test").await.unwrap();
 
-        let mut buf = vec![0u8; 1024];
-        let n = tls_stream.read(&mut buf).await.unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    }, 10)
+            let mut buf = vec![0u8; 1024];
+            let n = tls_stream.read(&mut buf).await.unwrap();
+            String::from_utf8_lossy(&buf[..n]).to_string()
+        },
+        10,
+    )
     .await
     .unwrap();
 
-    assert!(result.starts_with("ALPHA:"), "Expected ALPHA prefix, got: {}", result);
+    assert!(
+        result.starts_with("ALPHA:"),
+        "Expected ALPHA prefix, got: {}",
+        result
+    );
 
     proxy.stop().await.unwrap();
 }
@@ -224,7 +262,12 @@ async fn test_tls_terminate_large_payload() {
 
     let options = RustProxyOptions {
         routes: vec![make_tls_terminate_route(
-            proxy_port, domain, "127.0.0.1", backend_port, &cert_pem, &key_pem,
+            proxy_port,
+            domain,
+            "127.0.0.1",
+            backend_port,
+            &cert_pem,
+            &key_pem,
         )],
         ..Default::default()
     };
@@ -233,26 +276,29 @@ async fn test_tls_terminate_large_payload() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let tls_config = make_insecure_tls_client_config();
-        let connector = tokio_rustls::TlsConnector::from(tls_config);
+    let result = with_timeout(
+        async {
+            let tls_config = make_insecure_tls_client_config();
+            let connector = tokio_rustls::TlsConnector::from(tls_config);
 
-        let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
-            .await
-            .unwrap();
+            let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", proxy_port))
+                .await
+                .unwrap();
 
-        let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
-        let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+            let server_name = rustls::pki_types::ServerName::try_from(domain.to_string()).unwrap();
+            let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-        // Send 1MB of data
-        let data = vec![b'X'; 1_000_000];
-        tls_stream.write_all(&data).await.unwrap();
-        tls_stream.shutdown().await.unwrap();
+            // Send 1MB of data
+            let data = vec![b'X'; 1_000_000];
+            tls_stream.write_all(&data).await.unwrap();
+            tls_stream.shutdown().await.unwrap();
 
-        let mut received = Vec::new();
-        tls_stream.read_to_end(&mut received).await.unwrap();
-        received.len()
-    }, 15)
+            let mut received = Vec::new();
+            tls_stream.read_to_end(&mut received).await.unwrap();
+            received.len()
+        },
+        15,
+    )
     .await
     .unwrap();
 
@@ -272,7 +318,12 @@ async fn test_tls_terminate_concurrent() {
 
     let options = RustProxyOptions {
         routes: vec![make_tls_terminate_route(
-            proxy_port, domain, "127.0.0.1", backend_port, &cert_pem, &key_pem,
+            proxy_port,
+            domain,
+            "127.0.0.1",
+            backend_port,
+            &cert_pem,
+            &key_pem,
         )],
         ..Default::default()
     };
@@ -281,37 +332,40 @@ async fn test_tls_terminate_concurrent() {
     proxy.start().await.unwrap();
     assert!(wait_for_port(proxy_port, 2000).await);
 
-    let result = with_timeout(async {
-        let mut handles = Vec::new();
-        for i in 0..10 {
-            let port = proxy_port;
-            let dom = domain.to_string();
-            handles.push(tokio::spawn(async move {
-                let tls_config = make_insecure_tls_client_config();
-                let connector = tokio_rustls::TlsConnector::from(tls_config);
+    let result = with_timeout(
+        async {
+            let mut handles = Vec::new();
+            for i in 0..10 {
+                let port = proxy_port;
+                let dom = domain.to_string();
+                handles.push(tokio::spawn(async move {
+                    let tls_config = make_insecure_tls_client_config();
+                    let connector = tokio_rustls::TlsConnector::from(tls_config);
 
-                let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port))
-                    .await
-                    .unwrap();
+                    let stream = tokio::net::TcpStream::connect(format!("127.0.0.1:{}", port))
+                        .await
+                        .unwrap();
 
-                let server_name = rustls::pki_types::ServerName::try_from(dom).unwrap();
-                let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
+                    let server_name = rustls::pki_types::ServerName::try_from(dom).unwrap();
+                    let mut tls_stream = connector.connect(server_name, stream).await.unwrap();
 
-                let msg = format!("conn-{}", i);
-                tls_stream.write_all(msg.as_bytes()).await.unwrap();
+                    let msg = format!("conn-{}", i);
+                    tls_stream.write_all(msg.as_bytes()).await.unwrap();
 
-                let mut buf = vec![0u8; 1024];
-                let n = tls_stream.read(&mut buf).await.unwrap();
-                String::from_utf8_lossy(&buf[..n]).to_string()
-            }));
-        }
+                    let mut buf = vec![0u8; 1024];
+                    let n = tls_stream.read(&mut buf).await.unwrap();
+                    String::from_utf8_lossy(&buf[..n]).to_string()
+                }));
+            }
 
-        let mut results = Vec::new();
-        for handle in handles {
-            results.push(handle.await.unwrap());
-        }
-        results
-    }, 15)
+            let mut results = Vec::new();
+            for handle in handles {
+                results.push(handle.await.unwrap());
+            }
+            results
+        },
+        15,
+    )
     .await
     .unwrap();