aspera-cli 4.27.5 → 4.28.0

data/lib/aspera/markdown.rb

@@ -1,141 +1,178 @@
 # frozen_string_literal: true
 
+require 'aspera/assert'
+
 module Aspera
   # Formatting for Markdown
-  class Markdown
+  module Markdown
+    extend self
+
     # Matches: **bold**, `code`, or an HTML entity (&, ©, 💩)
-    FORMATS = /(?:\*\*(?<bold>[^*]+?)\*\*)|(?:`(?<code>[^`]+)`)|&(?<entity>(?:[A-Za-z][A-Za-z0-9]{1,31}|#\d{1,7}|#x[0-9A-Fa-f]{1,6}));/m
+    INLINE_MARKUP_RE = /(?:\*\*(?<bold>[^*]+?)\*\*)|(?:`(?<code>[^`]+)`)|&(?<entity>(?:[A-Za-z][A-Za-z0-9]{1,31}|#\d{1,7}|#x[0-9A-Fa-f]{1,6}));/m
+    # HTML line-break tag used in Markdown table cells to separate multi-line values.
     HTML_BREAK = '<br/>'
+    # Matches a Markdown heading line (e.g. `## Title`); group 1 = `#` chars, group 2 = text.
+    HEADING_RE = /^(\#{1,6})[ \t]+(\S.*)$/
+    # Matches the start or end of a fenced code block; group 1 = fence (``` or ~~~).
+    FENCE_RE = /^ {0,3}(`{3,}|~{3,})/
+    # Maximum column width (in characters) for generated Markdown tables.
+    COL_WIDTH = 80
+    # Accepted admonition types.
+    ADMONITION_TYPES = %w[NOTE CAUTION WARNING IMPORTANT TIP INFO].freeze
 
-    class << self
-      COL_WIDTH = 80
-
-      # Convert a Markdown heading text to a GitHub-flavoured anchor.
-      # Rules: downcase, keep letters/digits/spaces/hyphens, replace spaces with hyphens.
-      # Duplicate anchors are disambiguated by appending -1, -2, … (pass a seen Hash to track).
-      # @param text  [String]           raw heading text (without leading # and spaces)
-      # @param seen  [Hash{String=>Integer}, nil]  mutable counter; pass the same Hash across a document
-      # @return [String] anchor slug (without leading #)
-      def heading_to_anchor(text, seen: nil)
-        slug = text
-          .downcase
-          .gsub(/[`*_]/, '')           # strip inline code/bold/italic markers
-          .gsub(/&[a-z]+;/, '')        # strip HTML entities
-          .gsub(/[^\w\s-]/, '')        # keep word chars, spaces, hyphens
-          .gsub(/\s+/, '-')            # spaces → hyphens
-          .squeeze('-')                # collapse consecutive hyphens
-          .strip
-        if seen
-          count = seen[slug].to_i
-          seen[slug] = count + 1
-          slug = "#{slug}-#{count}" if count > 0
-        end
-        slug
-      end
+    # --- Parsing ---
 
-      # Extract the table of contents from a Markdown document.
-      # @param content [String]  full Markdown source
-      # @return [Array<Hash>]   array of { level, title, anchor }
-      HEADING_RE = /^(\#{1,6})\s+(.+)$/
-
-      def toc(content)
-        seen = {}
-        content.each_line.filter_map do |line|
-          m = line.match(HEADING_RE)
-          next unless m
-          title = m[2].strip
-          {level: m[1].length, title: title, anchor: heading_to_anchor(title, seen: seen)}
-        end
+    # Convert a Markdown heading text to a GitHub-flavoured anchor.
+    # Rules: downcase, keep letters/digits/spaces/hyphens, replace spaces with hyphens.
+    # Duplicate anchors are disambiguated by appending -1, -2, … (pass a seen Hash to track).
+    # @param text  [String]           raw heading text (without leading # and spaces)
+    # @param seen  [Hash{String=>Integer}, nil]  mutable counter; pass the same Hash across a document
+    # @return [String] anchor slug (without leading #)
+    def heading_to_anchor(text, seen: nil)
+      slug = text
+        .downcase
+        .gsub(/[`*_]/, '')           # strip inline code/bold/italic markers
+        .gsub(/&[a-z]+;/, '')        # strip HTML entities
+        .gsub(/[^\w\s-]/, '')        # keep word chars, spaces, hyphens
+        .gsub(/\s+/, '-')            # spaces → hyphens
+        .squeeze('-')                # collapse consecutive hyphens
+        .strip
+      if seen
+        count = seen[slug].to_i
+        seen[slug] = count + 1
+        slug = "#{slug}-#{count}" if count > 0
       end
+      slug
+    end
 
-      # Extract the content of a single section (heading + body until next heading of same/higher level).
-      # @param content   [String]  full Markdown source
-      # @param anchor    [String]  GitHub anchor slug (without #)
-      # @return [String, nil]  the section content, or nil if not found
-      def extract_section(content, anchor)
-        seen = {}
-        section_level = nil
-        result = []
-        content.each_line do |line|
-          m = line.match(HEADING_RE)
-          if m
-            slug = heading_to_anchor(m[2].strip, seen: seen)
-            if section_level.nil?
-              # not yet found: check if this heading matches
-              next unless slug == anchor
-              section_level = m[1].length
-            elsif m[1].length <= section_level
-              # already in section: stop at same/higher level heading
-              break
-            end
+    # Iterate on the lines of a Markdown document, with the heading match of each line.
+    # A line in a fenced code block is not a heading (e.g. a shell comment `# ...`).
+    # @param content [String] full Markdown source
+    # @yieldparam line    [String]           the line
+    # @yieldparam heading [MatchData, nil]   match of HEADING_RE, or nil if not a heading
+    def each_line_with_heading(content)
+      fence = nil
+      content.each_line do |line|
+        if (f = line.match(FENCE_RE))
+          # a code block ends with the same kind of fence, at least as long, without info string
+          if fence.nil?
+            fence = f[1]
+          elsif f[1].start_with?(fence) && line.strip.eql?(f[1])
+            fence = nil
           end
-          result << line if section_level
+          yield(line, nil)
+        else
+          yield(line, fence.nil? ? line.match(HEADING_RE) : nil)
         end
-        result.empty? ? nil : result.join
       end
+    end
 
-      # Generate markdown from the provided 2D table
-      # @param table [Array<Array<String>>] 2D array of strings
-      # @return [String] markdown table
-      def table(table)
-        # get max width of each columns
-        col_widths = table.transpose.map do |col|
-          [col.flat_map { |c| c.to_s.delete('`').split(HTML_BREAK).map(&:size) }.max, COL_WIDTH].min
-        end
-        # do not modify caller's table
-        table = table.dup
-        headings = table.shift
-        table.unshift(col_widths.map { |col_width| '-' * col_width })
-        table.unshift(headings)
-        lines = table.map { |line| "| #{line.map { |i| i.to_s.gsub('\\', '\\\\').gsub('|', '\|') }.join(' | ')} |\n" }
-        lines[1] = lines[1].tr(' ', '-')
-        return lines.join.chomp
+    # Extract the table of contents from a Markdown document.
+    # @param content   [String]       full Markdown source
+    # @param max_level [Integer, nil] maximum level of headings, or nil for all
+    # @return [Array<Hash>]   array of { level, title, anchor } (String keys, as other results: `--select` applies)
+    def toc(content, max_level: nil)
+      seen = {}
+      result = []
+      each_line_with_heading(content) do |_line, m|
+        next unless m
+        title = m[2].strip
+        # anchor of every heading, so that duplicate anchors are numbered as in the whole document
+        anchor = heading_to_anchor(title, seen: seen)
+        result.push({'level' => m[1].length, 'title' => title, 'anchor' => anchor}) if max_level.nil? || m[1].length <= max_level
       end
+      result
+    end
 
-      # Generate markdown list from the provided list
-      # @param items [Array<String>] list of items
-      # @return [String] markdown unordered list
-      def list(items)
-        items.map { |i| "- #{i}" }.join("\n")
+    # Extract the content of a single section (heading + body until next heading of same/higher level).
+    # @param content   [String]  full Markdown source
+    # @param anchor    [String]  GitHub anchor slug (without #)
+    # @return [String, nil]  the section content, or nil if not found
+    def extract_section(content, anchor)
+      seen = {}
+      section_level = nil
+      result = []
+      each_line_with_heading(content) do |line, m|
+        if m
+          slug = heading_to_anchor(m[2].strip, seen: seen)
+          if section_level.nil?
+            # not yet found: check if this heading matches
+            next unless slug == anchor
+            section_level = m[1].length
+          elsif m[1].length <= section_level
+            # already in section: stop at same/higher level heading
+            break
+          end
+        end
+        result << line if section_level
       end
+      result.empty? ? nil : result.join
+    end
 
-      # Generate a markdown heading
-      # @param title [String] heading text
-      # @param level [Integer] heading level (1–6)
-      # @return [String] markdown heading
-      def heading(title, level: 1)
-        "#{'#' * level} #{title}\n\n"
-      end
+    # --- Generation ---
 
-      # Generate a GitHub-flavoured admonition block
-      # @param lines [Array<String>] lines of the admonition body
-      # @param type [String] admonition type: NOTE, CAUTION, WARNING, IMPORTANT, TIP, INFO
-      # @return [String] markdown admonition block
-      def admonition(lines, type: 'INFO')
-        "> [!#{type}]\n#{lines.map { |l| "> #{l}" }.join("\n")}\n\n"
-      end
+    # Wrap text in inline code backticks
+    # @param text [String] text to wrap
+    # @return [String] inline code span
+    def icode(text)
+      "`#{text}`"
+    end
 
-      # Generate a fenced code block
-      # @param lines [Array<String>] lines of code
-      # @param type [String] language identifier for syntax highlighting
-      # @return [String] markdown fenced code block
-      def code(lines, type: 'shell')
-        "```#{type}\n#{lines.join("\n")}\n```\n\n"
-      end
+    # Wrap text in a markdown paragraph (trailing blank line)
+    # @param text [String] paragraph content
+    # @return [String] paragraph with trailing newlines
+    def paragraph(text)
+      "#{text}\n\n"
+    end
 
-      # Wrap text in inline code backticks
-      # @param text [String] text to wrap
-      # @return [String] inline code span
-      def icode(text)
-        "`#{text}`"
-      end
+    # Generate a markdown heading
+    # @param title [String] heading text
+    # @param level [Integer] heading level (1–6)
+    # @return [String] markdown heading
+    def heading(title, level: 1)
+      paragraph("#{'#' * level} #{title}")
+    end
+
+    # Generate a fenced code block
+    # @param lines [Array<String>] lines of code
+    # @param type [String] language identifier for syntax highlighting
+    # @return [String] markdown fenced code block
+    def code(lines, type: 'shell')
+      paragraph("```#{type}\n#{lines.join("\n")}\n```")
+    end
+
+    # Generate a GitHub-flavoured admonition block
+    # @param lines [Array<String>] lines of the admonition body
+    # @param type [String] admonition type, one of {ADMONITION_TYPES}
+    # @return [String] markdown admonition block
+    def admonition(lines, type: 'INFO')
+      Aspera.assert_values(type, ADMONITION_TYPES) { 'admonition type' }
+      paragraph((["[!#{type}]"] + lines).map { |l| "> #{l}" }.join("\n"))
+    end
+
+    # Generate markdown list from the provided list
+    # @param items [Array<String>] list of items
+    # @return [String] markdown unordered list
+    def list(items)
+      items.map { |i| "- #{i}" }.join("\n")
+    end
 
-      # Wrap text in a markdown paragraph (trailing blank line)
-      # @param text [String] paragraph content
-      # @return [String] paragraph with trailing newlines
-      def paragraph(text)
-        "#{text}\n\n"
+    # Generate markdown from the provided 2D table
+    # @param table [Array<Array<String>>] 2D array of strings
+    # @return [String] markdown table
+    def table(table)
+      # get max width of each columns
+      col_widths = table.transpose.map do |col|
+        [col.flat_map { |c| c.to_s.delete('`').split(HTML_BREAK).map(&:size) }.max, COL_WIDTH].min
       end
+      # do not modify caller's table
+      table = table.dup
+      headings = table.shift
+      table.unshift(col_widths.map { |col_width| '-' * col_width })
+      table.unshift(headings)
+      lines = table.map { |line| "| #{line.map { |i| i.to_s.gsub('\\', '\\\\').gsub('|', '\|') }.join(' | ')} |\n" }
+      lines[1] = lines[1].tr(' ', '-')
+      return lines.join.chomp
     end
   end
 end

data/lib/aspera/mime.rb

@@ -9,8 +9,14 @@ module Aspera
     WWW = 'application/x-www-form-urlencoded'
     # Plain text body
     TEXT = 'text/plain'
+    # XML body
+    XML = 'application/xml'
+    # Multipart form body (file upload)
+    MULTIPART = 'multipart/form-data'
     # JSON:API body (https://jsonapi.org)
     JSON_API = 'application/vnd.api+json'
+    # Server-Sent Events stream
+    EVENT_STREAM = 'text/event-stream'
     # Check if a media type is JSON: `application/json` or structured syntax suffix `+json` (RFC 6839)
     # @param mime [String] Media type, without parameters (see `Rest.parse_header`)
     # @return [Boolean] `true` if JSON

data/lib/aspera/nagios.rb

@@ -13,6 +13,8 @@ module Aspera
     DATE_WARN_OFFSET = 2
     DATE_CRIT_OFFSET = 5
     private_constant :LEVELS, :ADD_PREFIX, :DATE_WARN_OFFSET, :DATE_CRIT_OFFSET
+    # Exit code when the check itself fails
+    UNKNOWN = LEVELS.index(:unknown)
 
     # add methods to add nagios error levels, each take component name and message
     LEVELS.each_index do |code|
@@ -32,7 +34,7 @@ module Aspera
         # keep only errors in case of problem, other ok are assumed so
         data = res_errors unless res_errors.empty?
         # first is most critical
-        data.sort! { |a, b| LEVELS.index(a['status'].to_sym) <=> LEVELS.index(b['status'].to_sym) }
+        data = data.sort { |a, b| LEVELS.index(a['status'].to_sym) <=> LEVELS.index(b['status'].to_sym) }
         # build message: if multiple components: concatenate
         # message = data.map{|i|"#{i['component']}:#{i['message']}"}.join(', ').gsub("\n",' ')
         message = data

data/lib/aspera/node_emulator.rb

@@ -2,7 +2,6 @@
 
 # cspell:ignore precalc noxfer euid gettime
 require 'aspera/assert'
-require 'aspera/mime'
 require 'aspera/ascp/installation'
 require 'aspera/agent/transferd'
 require 'aspera/transfer/spec'
@@ -10,8 +9,8 @@ require 'aspera/transfer/error'
 require 'aspera/secret_hider'
 require 'aspera/string_ext'
 require 'aspera/log'
+require 'aspera/servlet_helpers'
 require 'webrick'
-require 'openssl'
 require 'etc'
 require 'securerandom'
 require 'json'
@@ -319,59 +318,25 @@ module Aspera
       Aspera.assert(in_docroot?(File.realpath(folder_path))) { "Path outside docroot: #{path}" }
       Aspera.assert(File.directory?(folder_path)) { "Not a folder: #{path}" }
       folder_virtual = virtual_path(folder_path)
-
-      # Build self structure
-      folder_stat = File.stat(folder_path)
-      structure = {
-        'self'  => {
-          'path'        => folder_virtual,
-          'basename'    => File.basename(folder_path),
-          'type'        => 'directory',
-          # Node API reports 0 for folders
-          'size'        => 0,
-          'mtime'       => folder_stat.mtime.utc.iso8601,
-          'permissions' => permissions(folder_path)
-        },
-        'items' => []
-      }
-
-      # Iterate over folder contents
-      Dir.foreach(folder_path) do |entry|
-        next if entry == '.' || entry == '..' # Skip current and parent directory
-
-        item_path = File.join(folder_path, entry)
-        item_type = File.ftype(item_path) rescue 'unknown' # Get the type of file
-        item_type = FILE_TYPES.fetch(item_type, item_type)
-        item_stat = File.lstat(item_path) # Use lstat to handle symbolic links correctly
-
-        item = {
-          'path'        => File.join(folder_virtual, entry),
-          'basename'    => entry,
-          'type'        => item_type,
-          'size'        => item_type.eql?('directory') ? 0 : item_stat.size,
-          'mtime'       => item_stat.mtime.utc.iso8601,
-          'permissions' => permissions(item_path)
-        }
-
-        # Add additional details for specific types
-        case item_type
-        when 'file'
-          item['partial_file'] = false
-        when 'symbolic_link'
-          item['target'] = link_target(item_path)
-        when 'unknown'
-          item['note'] = 'File type could not be determined'
+      # stable order for paging: only the items of the page are read
+      names = Dir.children(folder_path).sort
+      items = names.drop(skip).first(count || names.length).map do |name|
+        item_path = File.join(folder_path, name)
+        # a symbolic link is not followed
+        item = item_info(item_path, File.join(folder_virtual, name), File.lstat(item_path))
+        case item['type']
+        when 'file' then item['partial_file'] = false
+        when 'symbolic_link' then item['target'] = link_target(item_path)
+        when 'unknown' then item['note'] = 'File type could not be determined'
         end
-
-        structure['items'] << item
+        item
       end
-
-      # stable order for paging
-      all_items = structure['items'].sort_by { |item| item['basename'] }
-      structure['items'] = all_items.drop(skip).first(count || all_items.length)
-      structure['item_count'] = structure['items'].length
-      structure['total_count'] = all_items.length
-      structure
+      {
+        'self'        => item_info(folder_path, folder_virtual, File.stat(folder_path)),
+        'items'       => items,
+        'item_count'  => items.length,
+        'total_count' => names.length
+      }
     end
 
     # Start a transfer, and monitor it in a thread until terminated
@@ -379,8 +344,8 @@ module Aspera
     # @return [String] transfer id
     def start(transfer_spec)
       Transfer::Spec.fix_transferd_resume_policy(transfer_spec)
-      # deep copy, returned in transfer `start_spec`
-      start_spec = SecretHider.instance.deep_remove_secret(JSON.parse(transfer_spec.to_json))
+      # copy without secrets, returned in transfer `start_spec`
+      start_spec = SecretHider.instance.hidden_copy(transfer_spec)
       Log.dump(:start_spec, start_spec)
       request = ::Transferd::Api::TransferRequest.new(
         transferType: ::Transferd::Api::TransferType::FILE_REGULAR,
@@ -478,10 +443,23 @@ module Aspera
     def real_path(path)
       # `./` prevents expansion of `~`
       real = File.expand_path("./#{path.to_s.sub(%r{\A/+}, '')}", @docroot)
-      Aspera.assert(in_docroot?(real)) { "Path outside docroot: #{path}" }
+      # symbolic links shall not lead out of the docroot
+      resolved = resolved_path(real) if in_docroot?(real)
+      Aspera.assert(!resolved.nil? && in_docroot?(resolved)) { "Path outside docroot: #{path}" }
       real
     end
 
+    # Resolve symbolic links of the existing part of a path: a destination may not exist yet
+    # @param real [String] absolute path, without `..`, within the docroot
+    # @return [String, nil] real path of the longest existing part of `real`, `nil` if it is a dangling symbolic link
+    def resolved_path(real)
+      # stops at the docroot, which exists
+      real = File.dirname(real) until File.exist?(real) || File.symlink?(real)
+      File.realpath(real)
+    rescue Errno::ENOENT, Errno::ELOOP
+      nil
+    end
+
     # Convert a real path to a Node API path
     # @param real [String] real path within the docroot
     # @return [String] path relative to the docroot, with leading `/`
@@ -496,6 +474,23 @@ module Aspera
       real.eql?(@docroot) || real.start_with?(@docroot.end_with?('/') ? @docroot : "#{@docroot}/")
     end
 
+    # Get the Node API fields of a folder or of an item of a folder
+    # @param real    [String]     real path within the docroot
+    # @param virtual [String]     Node API path
+    # @param stat    [File::Stat] information on the item
+    # @return [Hash] Node API fields common to a folder and its items
+    def item_info(real, virtual, stat)
+      {
+        'path'        => virtual,
+        'basename'    => File.basename(real),
+        'type'        => FILE_TYPES.fetch(stat.ftype, stat.ftype),
+        # Node API reports 0 for folders
+        'size'        => stat.directory? ? 0 : stat.size,
+        'mtime'       => stat.mtime.utc.iso8601,
+        'permissions' => permissions(real)
+      }
+    end
+
     # Get the Node API permissions of an item
     # @param real [String] real path within the docroot
     # @return [Array<Hash>] Node API permissions, from the access of the emulator on the item
@@ -581,6 +576,8 @@ module Aspera
   # Answers a subset of the Node API, transfers are delegated to a NodeEmulator
   # a new instance is created for each request
   class NodeEmulatorServlet < WEBrick::HTTPServlet::AbstractServlet
+    include ServletHelpers
+
     PATH_TRANSFERS = '/ops/transfers'
     PATH_ONE_TRANSFER = %r{/ops/transfers/(.+)$}
     PATH_BROWSE = '/files/browse'
@@ -589,6 +586,8 @@ module Aspera
     CANCEL_STATUSES = %w[canceled cancelled stopped].freeze
     # `PUT` fields modified by transferd
     MODIFIABLE = %w[target_rate_kbps min_rate_kbps rate_policy].freeze
+    # HTTP methods with a JSON body
+    JSON_METHODS = %w[POST PUT].freeze
     # Create the servlet, with optional Basic authentication
     # @param server    [WEBrick::HTTPServer]
     # @param config    [Hash] `username` and `password` (Basic authentication expected from clients, optional)
@@ -599,14 +598,12 @@ module Aspera
       @expected_auth = "#{config[:username]}:#{config[:password]}" unless config[:username].nil?
     end
 
-    # Check authentication, dispatch to `do_<verb>`, and send errors in Node API format
+    # Refuse requests of web pages, check authentication, dispatch to `do_<verb>`, and send errors in Node API format
     # @param request  [WEBrick::HTTPRequest]
     # @param response [WEBrick::HTTPResponse]
     def service(request, response)
-      unless authorized?(request)
-        response['WWW-Authenticate'] = %Q(Basic realm="#{REALM}")
-        return set_error(request, response, 401, 'Invalid or missing credentials')
-      end
+      check_request(request, json: JSON_METHODS.include?(request.request_method))
+      return set_error(request, response, 401, 'Invalid or missing credentials', headers: {'WWW-Authenticate' => %Q(Basic realm="#{REALM}")}) unless authorized?(request)
       super
     rescue WEBrick::HTTPStatus::Error => e
       set_error(request, response, e.code, e.message)
@@ -623,40 +620,35 @@ module Aspera
     # @param request  [WEBrick::HTTPRequest]
     # @param response [WEBrick::HTTPResponse]
     def do_POST(request, response)
-      case request.path
-      when PATH_TRANSFERS
-        set_json_response(request, response, @simulator.transfer(@simulator.start(JSON.parse(request.body))))
-      when PATH_BROWSE
-        req = JSON.parse(request.body)
-        set_json_response(request, response, @simulator.browse(req['path'] || '/', skip: req['skip'].to_i, count: req['count']&.to_i))
-      else
-        set_error(request, response, 404, "Unknown path: #{request.path}")
-      end
+      json =
+        case request.path
+        when PATH_TRANSFERS
+          @simulator.transfer(@simulator.start(JSON.parse(request.body.to_s)))
+        when PATH_BROWSE
+          req = JSON.parse(request.body.to_s)
+          @simulator.browse(req['path'] || '/', skip: req['skip'].to_i, count: req['count']&.to_i)
+        else raise WEBrick::HTTPStatus::NotFound, "Unknown path: #{request.path}"
+        end
+      set_json_response(request, response, json)
     end
 
     # Get the node information, the list of transfers, or one transfer
     # @param request  [WEBrick::HTTPRequest]
     # @param response [WEBrick::HTTPResponse]
     def do_GET(request, response)
-      case request.path
-      when '/info'
-        set_json_response(request, response, @simulator.info)
-      when PATH_TRANSFERS
-        set_json_response(request, response, @simulator.transfers(
-          active_only: query_boolean(request, 'active_only'),
-          direction:   request.query['direction']&.to_s,
-          count:       query_positive(request, 'count')
-        ))
-      when PATH_ONE_TRANSFER
-        transfer = @simulator.transfer(request.path.match(PATH_ONE_TRANSFER)[1])
-        if transfer.nil?
-          set_error(request, response, 404, 'Unknown transfer')
-        else
-          set_json_response(request, response, transfer)
+      json =
+        case request.path
+        when '/info' then @simulator.info
+        when PATH_TRANSFERS
+          @simulator.transfers(
+            active_only: query_boolean(request, 'active_only'),
+            direction:   request.query['direction']&.to_s,
+            count:       query_positive(request, 'count')
+          )
+        when PATH_ONE_TRANSFER then known_transfer(@simulator.transfer(transfer_id(request)))
+        else raise WEBrick::HTTPStatus::NotFound, "Unknown path: #{request.path}"
         end
-      else
-        set_error(request, response, 404, "Unknown path: #{request.path}")
-      end
+      set_json_response(request, response, json)
     end
 
     # Modify a transfer, or cancel it with `status`
@@ -676,7 +668,7 @@ module Aspera
         raise WEBrick::HTTPStatus::BadRequest, "Unsupported status: #{status}" unless CANCEL_STATUSES.include?(status)
         found = @simulator.cancel(id)
       end
-      return set_error(request, response, 404, 'Unknown transfer') unless found
+      known_transfer(found)
       set_json_response(request, response, @simulator.transfer(id))
     end
 
@@ -684,7 +676,7 @@ module Aspera
     # @param request  [WEBrick::HTTPRequest]
     # @param response [WEBrick::HTTPResponse]
     def do_CANCEL(request, response)
-      return set_error(request, response, 404, 'Unknown transfer') unless @simulator.cancel(transfer_id(request))
+      known_transfer(@simulator.cancel(transfer_id(request)))
       response.status = 204
     end
 
@@ -700,6 +692,14 @@ module Aspera
       match[1]
     end
 
+    # @param found [Object] Result of the emulator for a transfer: `nil` or `false` if unknown
+    # @return [Object] found
+    # @raise [WEBrick::HTTPStatus::NotFound] if the transfer is unknown
+    def known_transfer(found)
+      raise WEBrick::HTTPStatus::NotFound, 'Unknown transfer' unless found
+      found
+    end
+
     # Read a boolean query parameter
     # @param request [WEBrick::HTTPRequest]
     # @param name    [String] name of the query parameter
@@ -730,18 +730,16 @@ module Aspera
     # @param response [WEBrick::HTTPResponse]
     # @param code     [Integer] HTTP status code
     # @param message  [String]  message for the user
-    def set_error(request, response, code, message)
-      set_json_response(request, response, {error: {code: code, reason: WEBrick::HTTPStatus.reason_phrase(code), user_message: message}}, code: code)
+    # @param headers  [Hash{String => String}] Other headers of the response
+    def set_error(request, response, code, message, headers: {})
+      set_json_response(request, response, {error: {code: code, reason: WEBrick::HTTPStatus.reason_phrase(code), user_message: message}}, code: code, headers: headers)
     end
 
     # Check the Basic credentials of the request
     # @param request [WEBrick::HTTPRequest]
     # @return [Boolean] `true` if the request has the expected Basic credentials, or if none are expected
     def authorized?(request)
-      return true if @expected_auth.nil?
-      scheme, value = request['Authorization'].to_s.split(' ', 2)
-      # constant time comparison
-      scheme.to_s.casecmp?('Basic') && OpenSSL.secure_compare(value.to_s.unpack1('m'), @expected_auth)
+      @expected_auth.nil? || basic_authorized?(request, @expected_auth)
     end
 
     # Set the status and the JSON body of the response
@@ -749,11 +747,10 @@ module Aspera
     # @param response [WEBrick::HTTPResponse]
     # @param json     [Hash, Array] body of the response
     # @param code     [Integer] HTTP status code
-    def set_json_response(request, response, json, code: 200)
-      response.status = code
-      response['Content-Type'] = Mime::JSON
-      response.body = json.to_json
-      Log.log.trace1 { Log.obj_dump("response for #{request.request_method} #{request.path}", json) }
+    # @param headers  [Hash{String => String}] Other headers of the response
+    def set_json_response(request, response, json, code: 200, headers: {})
+      json_response(response, code, json, headers: headers)
+      Log.dump("response for #{request.request_method} #{request.path}", json, level: :trace1)
     end
   end
 end