bool operator() (const std::pair<int, int>& left, const std::pair<int, int>& right) const {

return left.second < right.second;

}

#if !defined(_WIN32) && !defined(__MINGW32__) && !defined(__CYGWIN__)

struct sigaction oldsig;

struct sigaction sig;

sig.sa_handler = &catcher;

sigemptyset(&sig.sa_mask);

#ifdef SA_INTERRUPT

sig.sa_flags = SA_INTERRUPT; /* SunOS */

#else // SA_INTERRUPT

sig.sa_flags = SA_RESTART;

#endif // SA_INTERRUPTT

if (0 != sigaction(SIGPIPE, &sig, &oldsig)) {

fprintf(stderr, "Failed to install SIGPIPE handler: %s\n", strerror(errno));

}

#endif

port(params._port),

start_method(params._start_method),

max_threads(params._max_threads),

max_connections(params._max_connections),

memory_limit(params._memory_limit),

content_size_limit(params._content_size_limit),

connection_timeout(params._connection_timeout),

per_IP_connection_limit(params._per_IP_connection_limit),

log_access(params._log_access),

log_error(params._log_error),

validator(params._validator),

unescaper(params._unescaper),

bind_address(params._bind_address),

bind_address_storage(params._bind_address_storage),

bind_socket(params._bind_socket),

max_thread_stack_size(params._max_thread_stack_size),

use_ssl(params._use_ssl),

use_ipv6(params._use_ipv6),

use_dual_stack(params._use_dual_stack),

debug(params._debug),

pedantic(params._pedantic),

https_mem_key(params._https_mem_key),

https_mem_cert(params._https_mem_cert),

https_mem_trust(params._https_mem_trust),

https_priorities(params._https_priorities),

cred_type(params._cred_type),

psk_cred_handler(params._psk_cred_handler),

digest_auth_random(params._digest_auth_random),

nonce_nc_size(params._nonce_nc_size),

running(false),

default_policy(params._default_policy),

#ifdef HAVE_BAUTH

basic_auth_enabled(params._basic_auth_enabled),

#endif // HAVE_BAUTH

digest_auth_enabled(params._digest_auth_enabled),

regex_checking(params._regex_checking),

ban_system_enabled(params._ban_system_enabled),

post_process_enabled(params._post_process_enabled),

put_processed_data_to_content(params._put_processed_data_to_content),

file_upload_target(params._file_upload_target),

file_upload_dir(params._file_upload_dir),

generate_random_filename_on_upload(params._generate_random_filename_on_upload),

deferred_enabled(params._deferred_enabled),

single_resource(params._single_resource),

tcp_nodelay(params._tcp_nodelay),

not_found_resource(params._not_found_resource),

method_not_allowed_resource(params._method_not_allowed_resource),

internal_error_resource(params._internal_error_resource),

file_cleanup_callback(params._file_cleanup_callback),

auth_handler(params._auth_handler),

auth_skip_paths(params._auth_skip_paths),

sni_callback(params._sni_callback) {

ignore_sigpipe();

pthread_mutex_init(&mutexwait, nullptr);

pthread_cond_init(&mutexcond, nullptr);

// These parameters are passed to respect the MHD interface, but are not needed here.

std::ignore = cls;

std::ignore = connection;

std::ignore = toe;

delete static_cast<details::modded_request*>(*con_cls);

if (hrm == nullptr) {

throw std::invalid_argument("The http_resource pointer cannot be null");

}

if (single_resource && ((resource != "" && resource != "/") || !family)) {

throw std::invalid_argument("The resource should be '' or '/' and be marked as family when using a single_resource server");

}

details::http_endpoint idx(resource, family, true, regex_checking);

std::unique_lock registered_resources_lock(registered_resources_mutex);

pair<map<details::http_endpoint, http_resource*>::iterator, bool> result = registered_resources.insert(map<details::http_endpoint, http_resource*>::value_type(idx, hrm));

if (result.second) {

bool is_exact = !family && idx.get_url_pars().empty();

if (is_exact) {

registered_resources_str.insert(pair<string, http_resource*>(idx.get_url_complete(), result.first->second));

}

if (idx.is_regex_compiled()) {

registered_resources_regex.insert(map<details::http_endpoint, http_resource*>::value_type(idx, hrm));

}

registered_resources_lock.unlock();

invalidate_route_cache();

return true;

}

return false;

struct {

MHD_OptionItem operator ()(enum MHD_OPTION opt, intptr_t val, void *ptr = nullptr) {

MHD_OptionItem x = {opt, val, ptr};

return x;

}

} gen;

vector<struct MHD_OptionItem> iov;

iov.push_back(gen(MHD_OPTION_NOTIFY_COMPLETED, (intptr_t) &request_completed, nullptr));

iov.push_back(gen(MHD_OPTION_URI_LOG_CALLBACK, (intptr_t) &uri_log, this));

iov.push_back(gen(MHD_OPTION_EXTERNAL_LOGGER, (intptr_t) &error_log, this));

iov.push_back(gen(MHD_OPTION_UNESCAPE_CALLBACK, (intptr_t) &unescaper_func, this));

iov.push_back(gen(MHD_OPTION_CONNECTION_TIMEOUT, connection_timeout));

if (bind_socket != 0) {

iov.push_back(gen(MHD_OPTION_LISTEN_SOCKET, bind_socket));

}

if (start_method == http_utils::THREAD_PER_CONNECTION && (max_threads != 0 || max_thread_stack_size != 0)) {

throw std::invalid_argument("Cannot specify maximum number of threads when using a thread per connection");

}

if (max_threads != 0) {

iov.push_back(gen(MHD_OPTION_THREAD_POOL_SIZE, max_threads));

}

if (max_connections != 0) {

iov.push_back(gen(MHD_OPTION_CONNECTION_LIMIT, max_connections));

}

if (memory_limit != 0) {

iov.push_back(gen(MHD_OPTION_CONNECTION_MEMORY_LIMIT, memory_limit));

}

if (per_IP_connection_limit != 0) {

iov.push_back(gen(MHD_OPTION_PER_IP_CONNECTION_LIMIT, per_IP_connection_limit));

}

if (max_thread_stack_size != 0) {

iov.push_back(gen(MHD_OPTION_THREAD_STACK_SIZE, max_thread_stack_size));

}

#ifdef HAVE_DAUTH

if (nonce_nc_size != 0) {

iov.push_back(gen(MHD_OPTION_NONCE_NC_SIZE, nonce_nc_size));

}

#endif // HAVE_DAUTH

if (use_ssl) {

// Need for const_cast to respect MHD interface that needs a void*

iov.push_back(gen(MHD_OPTION_HTTPS_MEM_KEY, 0, reinterpret_cast<void*>(const_cast<char*>(https_mem_key.c_str()))));

}

if (use_ssl) {

// Need for const_cast to respect MHD interface that needs a void*

iov.push_back(gen(MHD_OPTION_HTTPS_MEM_CERT, 0, reinterpret_cast<void*>(const_cast<char*>(https_mem_cert.c_str()))));

}

if (https_mem_trust != "" && use_ssl) {

// Need for const_cast to respect MHD interface that needs a void*

iov.push_back(gen(MHD_OPTION_HTTPS_MEM_TRUST, 0, reinterpret_cast<void*>(const_cast<char*>(https_mem_trust.c_str()))));

}

if (https_priorities != "" && use_ssl) {

// Need for const_cast to respect MHD interface that needs a void*

iov.push_back(gen(MHD_OPTION_HTTPS_PRIORITIES, 0, reinterpret_cast<void*>(const_cast<char*>(https_priorities.c_str()))));

}

#ifdef HAVE_DAUTH

if (digest_auth_random != "") {

// Need for const_cast to respect MHD interface that needs a char*

iov.push_back(gen(MHD_OPTION_DIGEST_AUTH_RANDOM, digest_auth_random.size(), const_cast<char*>(digest_auth_random.c_str())));

}

#endif // HAVE_DAUTH

#ifdef HAVE_GNUTLS

if (cred_type != http_utils::NONE) {

iov.push_back(gen(MHD_OPTION_HTTPS_CRED_TYPE, cred_type));

}

if (psk_cred_handler != nullptr && use_ssl) {

iov.push_back(gen(MHD_OPTION_GNUTLS_PSK_CRED_HANDLER,

(intptr_t)&psk_cred_handler_func, this));

}

#ifdef MHD_OPTION_HTTPS_CERT_CALLBACK

if (sni_callback != nullptr && use_ssl) {

iov.push_back(gen(MHD_OPTION_HTTPS_CERT_CALLBACK,

(intptr_t)&sni_cert_callback_func, this));

}

#endif // MHD_OPTION_HTTPS_CERT_CALLBACK

#endif // HAVE_GNUTLS

iov.push_back(gen(MHD_OPTION_END, 0, nullptr));

int start_conf = start_method;

if (use_ssl) {

start_conf |= MHD_USE_SSL;

}

if (use_ipv6) {

start_conf |= MHD_USE_IPv6;

}

if (use_dual_stack) {

start_conf |= MHD_USE_DUAL_STACK;

}

if (debug) {

start_conf |= MHD_USE_DEBUG;

}

if (pedantic) {

start_conf |= MHD_USE_PEDANTIC_CHECKS;

}

if (deferred_enabled) {

start_conf |= MHD_USE_SUSPEND_RESUME;

}

#ifdef USE_FASTOPEN

start_conf |= MHD_USE_TCP_FASTOPEN;

#endif

daemon = nullptr;

if (bind_address == nullptr) {

daemon = MHD_start_daemon(start_conf, port, &policy_callback, this,

&answer_to_connection, this, MHD_OPTION_ARRAY,

&iov[0], MHD_OPTION_END);

} else {

daemon = MHD_start_daemon(start_conf, 1, &policy_callback, this,

&answer_to_connection, this, MHD_OPTION_ARRAY,

&iov[0], MHD_OPTION_SOCK_ADDR, bind_address, MHD_OPTION_END);

}

if (daemon == nullptr) {

throw std::invalid_argument("Unable to connect daemon to port: " + std::to_string(port));

}

bool value_onclose = false;

running = true;

if (blocking) {

pthread_mutex_lock(&mutexwait);

while (blocking && running) {

pthread_cond_wait(&mutexcond, &mutexwait);

}

pthread_mutex_unlock(&mutexwait);

value_onclose = true;

}

return value_onclose;

if (!running) return false;

pthread_mutex_lock(&mutexwait);

running = false;

pthread_cond_signal(&mutexcond);

pthread_mutex_unlock(&mutexwait);

MHD_stop_daemon(daemon);

shutdown(bind_socket, 2);

return true;

std::lock_guard<std::mutex> lock(route_cache_mutex);

route_cache_list.clear();

route_cache_map.clear();

// family does not matter - it just checks the url_normalized anyhow

details::http_endpoint he(resource, false, true, regex_checking);

std::unique_lock registered_resources_lock(registered_resources_mutex);

// Invalidate cache while holding registered_resources_mutex to prevent

// any thread from retrieving dangling resource pointers from the cache

// after we erase from the resource maps.

{

std::lock_guard<std::mutex> cache_lock(route_cache_mutex);

route_cache_list.clear();

route_cache_map.clear();

}

registered_resources.erase(he);

registered_resources.erase(he.get_url_complete());

registered_resources_str.erase(he.get_url_complete());

registered_resources_regex.erase(he);

std::unique_lock bans_lock(bans_mutex);

ip_representation t_ip(ip);

set<ip_representation>::iterator it = bans.find(t_ip);

if (it != bans.end() && (t_ip.weight() < (*it).weight())) {

bans.erase(it);

bans.insert(t_ip);

} else {

bans.insert(t_ip);

}

std::unique_lock allowances_lock(allowances_mutex);

ip_representation t_ip(ip);

set<ip_representation>::iterator it = allowances.find(t_ip);

if (it != allowances.end() && (t_ip.weight() < (*it).weight())) {

allowances.erase(it);

allowances.insert(t_ip);

} else {

allowances.insert(t_ip);

}

struct MHD_Connection* connection,

const char* username,

void** psk,

size_t* psk_size) {

std::ignore = connection; // Not needed - we get context from cls

webserver* ws = static_cast<webserver*>(cls);

// Initialize output to safe values

*psk = nullptr;

*psk_size = 0;

if (ws == nullptr || ws->psk_cred_handler == nullptr) {

return -1;

}

std::string psk_hex = ws->psk_cred_handler(std::string(username));

if (psk_hex.empty()) {

return -1;

}

// Validate hex string before allocating memory

size_t psk_len = psk_hex.size() / 2;

if (psk_len == 0 || (psk_hex.size() % 2 != 0) ||

!string_utilities::is_valid_hex(psk_hex)) {

return -1;

}

// Allocate with malloc - MHD will free this

unsigned char* psk_data = static_cast<unsigned char*>(malloc(psk_len));

if (psk_data == nullptr) {

return -1;

}

// Convert hex string to binary

for (size_t i = 0; i < psk_len; i++) {

psk_data[i] = static_cast<unsigned char>(

(string_utilities::hex_char_to_val(psk_hex[i * 2]) << 4) |

string_utilities::hex_char_to_val(psk_hex[i * 2 + 1]));

}

*psk = psk_data;

*psk_size = psk_len;

return 0;

struct MHD_Connection* connection,

const char* server_name,

gnutls_certificate_credentials_t* creds) {

std::ignore = connection;

webserver* ws = static_cast<webserver*>(cls);

if (ws == nullptr || ws->sni_callback == nullptr || server_name == nullptr) {

return -1;

}

std::string name(server_name);

// Check if we have cached credentials for this server name

{

std::shared_lock lock(ws->sni_credentials_mutex);

auto it = ws->sni_credentials_cache.find(name);

if (it != ws->sni_credentials_cache.end()) {

*creds = it->second;

return 0;

}

}

// Call user's callback to get cert/key pair

auto [cert_pem, key_pem] = ws->sni_callback(name);

if (cert_pem.empty() || key_pem.empty()) {

return -1; // Use default certificate

}

// Create new credentials for this server name

gnutls_certificate_credentials_t new_creds;

if (gnutls_certificate_allocate_credentials(&new_creds) != GNUTLS_E_SUCCESS) {

return -1;

}

gnutls_datum_t cert_data = {

reinterpret_cast<unsigned char*>(const_cast<char*>(cert_pem.data())),

static_cast<unsigned int>(cert_pem.size())

};

gnutls_datum_t key_data = {

reinterpret_cast<unsigned char*>(const_cast<char*>(key_pem.data())),

static_cast<unsigned int>(key_pem.size())

};

int ret = gnutls_certificate_set_x509_key_mem(new_creds, &cert_data, &key_data, GNUTLS_X509_FMT_PEM);

if (ret != GNUTLS_E_SUCCESS) {

gnutls_certificate_free_credentials(new_creds);

return -1;

}

// Cache the credentials with double-check to avoid race condition

{

std::unique_lock lock(ws->sni_credentials_mutex);

// Re-check after acquiring exclusive lock - another thread may have inserted

auto it = ws->sni_credentials_cache.find(name);

if (it != ws->sni_credentials_cache.end()) {

// Another thread already cached credentials, use theirs and free ours

gnutls_certificate_free_credentials(new_creds);

*creds = it->second;

return 0;

}

ws->sni_credentials_cache[name] = new_creds;

}

*creds = new_creds;

return 0;

// Parameter needed to respect MHD interface, but not needed here.

std::ignore = addrlen;

const auto ws = static_cast<webserver*>(cls);

if (!ws->ban_system_enabled) return MHD_YES;

std::shared_lock bans_lock(ws->bans_mutex);

std::shared_lock allowances_lock(ws->allowances_mutex);

const bool is_banned = ws->bans.count(ip_representation(addr));

const bool is_allowed = ws->allowances.count(ip_representation(addr));

if ((ws->default_policy == http_utils::ACCEPT && is_banned && !is_allowed) ||

(ws->default_policy == http_utils::REJECT && (!is_allowed || is_banned))) {

return MHD_NO;

}

return MHD_YES;

webserver* dws = static_cast<webserver*>(cls);

std::string msg;

msg.resize(80); // Asssume one line will be enought most of the time.

va_list va;

va_copy(va, ap); // Stash a copy in case we need to try again.

size_t r = vsnprintf(&*msg.begin(), msg.size(), fmt, ap);

va_end(ap);

if (msg.size() < r) {

msg.resize(r);

r = vsnprintf(&*msg.begin(), msg.size(), fmt, va);

}

va_end(va);

msg.resize(r);

if (dws->log_error != nullptr) dws->log_error(msg);

// Parameter needed to respect MHD interface, but not needed here.

std::ignore = cls;

std::ignore = c;

// THIS IS USED TO AVOID AN UNESCAPING OF URL BEFORE THE ANSWER.

// IT IS DUE TO A BOGUS ON libmicrohttpd (V0.99) THAT PRODUCING A

// STRING CONTAINING '\0' AFTER AN UNESCAPING, IS UNABLE TO PARSE

// ARGS WITH get_connection_values FUNC OR lookup FUNC.

return std::string(s).size();

const char *key, const char *filename, const char *content_type,

const char *transfer_encoding, const char *data, uint64_t off, size_t size) {

// Parameter needed to respect MHD interface, but not needed here.

std::ignore = kind;

struct details::modded_request* mr = (struct details::modded_request*) cls;

if (!filename) {

// There is no actual file, just set the arg key/value and return.

if (off > 0) {

mr->dhr->grow_last_arg(key, std::string(data, size));

return MHD_YES;

}

mr->dhr->set_arg(key, std::string(data, size));

return MHD_YES;

}

try {

if (mr->ws->file_upload_target != FILE_UPLOAD_DISK_ONLY) {

mr->dhr->set_arg_flat(key, std::string(mr->dhr->get_arg(key)) + std::string(data, size));

}

if (*filename != '\0' && mr->ws->file_upload_target != FILE_UPLOAD_MEMORY_ONLY) {

// either get the existing file info struct or create a new one in the file map

http::file_info& file = mr->dhr->get_or_create_file_info(key, filename);

// if the file_system_file_name is not filled yet, this is a new entry and the name has to be set

// (either random or copy of the original filename)

if (file.get_file_system_file_name().empty()) {

if (mr->ws->generate_random_filename_on_upload) {

file.set_file_system_file_name(http_utils::generate_random_upload_filename(mr->ws->file_upload_dir));

} else {

std::string safe_name = http_utils::sanitize_upload_filename(filename);

if (safe_name.empty()) {

return MHD_NO;

}

file.set_file_system_file_name(mr->ws->file_upload_dir + "/" + safe_name);

}

// to not append to an already existing file, delete an already existing file

unlink(file.get_file_system_file_name().c_str());

if (content_type != nullptr) {

file.set_content_type(content_type);

}

if (transfer_encoding != nullptr) {

file.set_transfer_encoding(transfer_encoding);

}

}

// if multiple files are uploaded, a different filename or a different key indicates

// the start of a new file, so close the previous one

if (mr->upload_filename.empty() ||

mr->upload_key.empty() ||

0 != strcmp(filename, mr->upload_filename.c_str()) ||

0 != strcmp(key, mr->upload_key.c_str())) {

if (mr->upload_ostrm != nullptr) {

mr->upload_ostrm->close();

}

}

if (mr->upload_ostrm == nullptr || !mr->upload_ostrm->is_open()) {

mr->upload_key = key;

mr->upload_filename = filename;

mr->upload_ostrm = std::make_unique<std::ofstream>();

mr->upload_ostrm->open(file.get_file_system_file_name(), std::ios::binary | std::ios::app);

}

if (size > 0) {

mr->upload_ostrm->write(data, size);

if (!mr->upload_ostrm->good()) {

return MHD_NO;

}

}

// update the file size in the map

file.grow_file_size(size);

}

return MHD_YES;

} catch(const http::generateFilenameException& e) {

return MHD_NO;

}

std::ignore = cls;

std::ignore = connection;

std::ignore = con_cls;

std::ignore = upgrade_socket;

if (not_found_resource != nullptr) {

return not_found_resource(*mr->dhr);

} else {

return std::make_shared<string_response>(NOT_FOUND_ERROR, http_utils::http_not_found);

}

if (method_not_allowed_resource != nullptr) {

return method_not_allowed_resource(*mr->dhr);

} else {

return std::make_shared<string_response>(METHOD_ERROR, http_utils::http_method_not_allowed);

}

if (internal_error_resource != nullptr && !force_our) {

return internal_error_resource(*mr->dhr);

} else {

return std::make_shared<string_response>(GENERIC_ERROR, http_utils::http_internal_server_error);

}

// Normalize path: resolve ".." and "." segments to prevent bypass

std::string normalized;

{

std::vector<std::string> segments;

std::string::size_type start = 0;

// Skip leading slash

if (!path.empty() && path[0] == '/') {

start = 1;

}

while (start < path.size()) {

auto end = path.find('/', start);

if (end == std::string::npos) end = path.size();

std::string seg = path.substr(start, end - start);

if (seg == "..") {

if (!segments.empty()) segments.pop_back();

} else if (!seg.empty() && seg != ".") {

segments.push_back(seg);

}

start = end + 1;

}

normalized = "/";

for (size_t i = 0; i < segments.size(); i++) {

if (i > 0) normalized += "/";

normalized += segments[i];

}

}

for (const auto& skip_path : auth_skip_paths) {

if (skip_path == normalized) return true;

// Support wildcard suffix (e.g., "/public/*")

if (skip_path.size() > 2 && skip_path.back() == '*' &&

skip_path[skip_path.size() - 2] == '/') {

std::string prefix = skip_path.substr(0, skip_path.size() - 1);

if (normalized.compare(0, prefix.size(), prefix) == 0) return true;

}

}

return false;

mr->dhr.reset(new http_request(connection, unescaper));

mr->dhr->set_file_cleanup_callback(file_cleanup_callback);

if (!mr->has_body) {

return MHD_YES;

}

mr->dhr->set_content_size_limit(content_size_limit);

const char *encoding = MHD_lookup_connection_value(connection, MHD_HEADER_KIND, http_utils::http_header_content_type);

if (post_process_enabled &&

(nullptr != encoding &&

((0 == strncasecmp(http_utils::http_post_encoding_form_urlencoded, encoding, strlen(http_utils::http_post_encoding_form_urlencoded))) ||

(0 == strncasecmp(http_utils::http_post_encoding_multipart_formdata, encoding, strlen(http_utils::http_post_encoding_multipart_formdata)))))) {

const size_t post_memory_limit(32 * 1024); // Same as #MHD_POOL_SIZE_DEFAULT

mr->pp = MHD_create_post_processor(connection, post_memory_limit, &post_iterator, mr);

} else {

mr->pp = nullptr;

}

return MHD_YES;

const char* version, const char* upload_data,

size_t* upload_data_size, struct details::modded_request* mr) {

if (0 == *upload_data_size) return complete_request(connection, mr, version, method);

if (mr->has_body) {

#ifdef DEBUG

std::cout << "Writing content: " << std::string(upload_data, *upload_data_size) << std::endl;

#endif // DEBUG

// The post iterator is only created from the libmicrohttpd for content of type

// multipart/form-data and application/x-www-form-urlencoded

// all other content (which is indicated by mr-pp == nullptr)

// has to be put to the content even if put_processed_data_to_content is set to false

if (mr->pp == nullptr || put_processed_data_to_content) {

mr->dhr->grow_content(upload_data, *upload_data_size);

}

if (mr->pp != nullptr) {

mr->ws = this;

MHD_post_process(mr->pp, upload_data, *upload_data_size);

if (mr->upload_ostrm != nullptr && mr->upload_ostrm->is_open()) {

mr->upload_ostrm->close();

}

}

}

*upload_data_size = 0;

return MHD_YES;

int to_ret = MHD_NO;

map<string, http_resource*>::iterator fe;

http_resource* hrm;

bool found = false;

struct MHD_Response* raw_response;

{

std::shared_lock registered_resources_lock(registered_resources_mutex);

if (!single_resource) {

const char* st_url = mr->standardized_url.c_str();

fe = registered_resources_str.find(st_url);

if (fe == registered_resources_str.end()) {

if (regex_checking) {

details::http_endpoint endpoint(st_url, false, false, false);

// Data needed for parameter extraction after match.

// On cache hit, we copy these while holding the cache lock

// to avoid use-after-free if another thread invalidates cache.

vector<string> matched_url_pars;

vector<int> matched_chunks;

// Check the LRU route cache first

{

std::lock_guard<std::mutex> cache_lock(route_cache_mutex);

auto cache_it = route_cache_map.find(mr->standardized_url);

if (cache_it != route_cache_map.end()) {

// Cache hit — move to front of LRU list

route_cache_list.splice(route_cache_list.begin(), route_cache_list, cache_it->second);

const route_cache_entry& cached = cache_it->second->second;

matched_url_pars = cached.matched_endpoint.get_url_pars();

matched_chunks = cached.matched_endpoint.get_chunk_positions();

hrm = cached.resource;

found = true;

}

}

if (!found) {

// Cache miss — perform regex scan

map<details::http_endpoint, http_resource*>::iterator found_endpoint;

size_t len = 0;

size_t tot_len = 0;

for (auto it = registered_resources_regex.begin(); it != registered_resources_regex.end(); ++it) {

size_t endpoint_pieces_len = it->first.get_url_pieces().size();

size_t endpoint_tot_len = it->first.get_url_complete().size();

if (!found || endpoint_pieces_len > len || (endpoint_pieces_len == len && endpoint_tot_len > tot_len)) {

if (it->first.match(endpoint)) {

found = true;

len = endpoint_pieces_len;

tot_len = endpoint_tot_len;

found_endpoint = it;

}

}

}

if (found) {

// Safe to reference: registered_resources_mutex (shared) is still held

matched_url_pars = found_endpoint->first.get_url_pars();

matched_chunks = found_endpoint->first.get_chunk_positions();

hrm = found_endpoint->second;

// Store in LRU cache

{

std::lock_guard<std::mutex> cache_lock(route_cache_mutex);

route_cache_list.emplace_front(mr->standardized_url, route_cache_entry{found_endpoint->first, hrm});

route_cache_map[mr->standardized_url] = route_cache_list.begin();

if (route_cache_map.size() > ROUTE_CACHE_MAX_SIZE) {

route_cache_map.erase(route_cache_list.back().first);

route_cache_list.pop_back();

}

}

}

}

// Extract URL parameters from matched endpoint

if (found) {

const auto& url_pieces = endpoint.get_url_pieces();

for (unsigned int i = 0; i < matched_url_pars.size(); i++) {

if (matched_chunks[i] >= 0 && static_cast<size_t>(matched_chunks[i]) < url_pieces.size()) {

mr->dhr->set_arg(matched_url_pars[i], url_pieces[matched_chunks[i]]);

}

}

}

}

} else {

hrm = fe->second;

found = true;

}

} else {

hrm = registered_resources.begin()->second;

found = true;

}

}

// Check centralized authentication if handler is configured

if (found && auth_handler != nullptr) {

std::string path(mr->dhr->get_path());

if (!should_skip_auth(path)) {

std::shared_ptr<http_response> auth_response = auth_handler(*mr->dhr);

if (auth_response != nullptr) {

mr->dhrs = auth_response;

found = false; // Skip resource rendering, go directly to response

}

}

}

if (found) {

try {

if (mr->pp != nullptr) {

MHD_destroy_post_processor(mr->pp);

mr->pp = nullptr;

}

if (hrm->is_allowed(method)) {

mr->dhrs = ((hrm)->*(mr->callback))(*mr->dhr); // copy in memory (move in case)

if (mr->dhrs.get() == nullptr || mr->dhrs->get_response_code() == -1) {

mr->dhrs = internal_error_page(mr);

}

} else {

mr->dhrs = method_not_allowed_page(mr);