files.com 1.1.813 → 1.1.815

data/lib/files.com/transfer/upload_plan.rb

@@ -0,0 +1,157 @@
+# frozen_string_literal: true
+
+require "digest"
+require "uri"
+
+module Files
+  module Transfer
+    # How an upload sizes its parts. Nothing in the API's answers grants this by name: an upload chooses its own part size
+    # only where its first answer shows every part going straight to Amazon S3 as one ordinary multipart upload (route),
+    # whose signed URLs bind neither a part's length nor its bytes. There partsize and next_partsize are recommendations,
+    # and each part is sent with a Content-Length of exactly its bytes. Everywhere else the API sizes the parts.
+    # parallel_parts says only whether parts may be sent at once, never how large they may be.
+    #
+    # The limits are the SDK's own for planning an upload to S3, within S3's: parts but the last of at least 5 MiB; parts
+    # of at most 1 GiB, which bounds what one part holds for its retries; at most 10,000 parts, or fewer when the first
+    # answer's available_parts says so; and files of at most 5 TiB. They promise nothing of Files.com's or S3's own
+    # limits, and bind no other destination: a file they cannot plan is sized by the API, unless it is of at most 5 TiB
+    # and buffer_bytes could not hold even the smallest part that fits it in the parts available, which the API's plan
+    # would need as well. That file is refused (part_size), and its upload keeps no plan for it.
+    module UploadPlan
+      MIB = 1024 * 1024
+      MIN_PART_BYTES = 5 * MIB
+      MAX_PART_BYTES = 1024 * MIB
+      MAX_PARTS = 10_000
+      MAX_FILE_BYTES = 5 * 1024 * 1024 * MIB
+      # The size every part but the last has, unless the file needs larger parts to fit the parts available, or the
+      # caller's buffer_bytes smaller ones.
+      PREFERRED_PART_BYTES = 8 * MIB
+      # The query parameters a presigned UploadPart may have: those naming the part and its upload, and SigV4's own.
+      QUERY_PARAMETERS = %w[partNumber uploadId X-Amz-Algorithm X-Amz-Credential X-Amz-Date X-Amz-Expires X-Amz-SignedHeaders X-Amz-Signature
+                            X-Amz-Security-Token].freeze
+
+      # The size of every part but the last of an upload of total bytes: PREFERRED_PART_BYTES, or the larger size, in
+      # whole MiB, that fits total in the parts available, but no larger than most, the largest part buffer_bytes holds
+      # as the upload reserves it (Float::INFINITY when parts stream), and never smaller than the least that fits: the
+      # parts available, and 5 MiB unless the whole file is one part. A size above most is a plan buffer_bytes cannot
+      # hold, refused before anything is read or sent. Nil, for the API to size the parts, when total is larger than
+      # MAX_FILE_BYTES, or needs parts larger than MAX_PART_BYTES in the parts available: those are only the SDK's
+      # limits. A total needing parts that large and larger than most too raises BufferLimitError instead, never giving
+      # a size: the API's parts, in the parts available, could not be smaller, so no plan could send it within
+      # buffer_bytes, and no size it gives is ever larger than MAX_PART_BYTES.
+      def self.part_size(total, available_parts, most)
+        parts = available_parts.is_a?(Integer) && available_parts.positive? ? [ available_parts, MAX_PARTS ].min : MAX_PARTS
+        return if total > MAX_FILE_BYTES
+
+        needed = (total + parts - 1) / parts
+        if needed > MAX_PART_BYTES
+          return if needed <= most
+
+          raise BufferLimitError, "The #{total}-byte upload needs parts of at least #{needed} bytes in its #{parts} available parts, " \
+                                  "more than the #{most} bytes buffer_bytes can hold for a part"
+        end
+
+        preferred = [ (([ PREFERRED_PART_BYTES, needed ].max + MIB - 1) / MIB) * MIB, MAX_PART_BYTES ].min
+        least = [ needed, MIN_PART_BYTES ].max
+        [ [ preferred, most ].min, total <= least ? total : least ].max
+      end
+
+      # The ordinary multipart upload straight to Amazon S3 that upload, the API's answer for part number, is for: a
+      # digest of its endpoint, object and upload ID, which is all a checkpoint keeps of it, or nil when the answer is not
+      # exactly that. Every condition is read from the answer as the API gave it, and all must hold:
+      #
+      #   action                  put/write: an ordinary write, not an append or restart
+      #   http_method             PUT
+      #   part_number             number
+      #   upload_uri              https on the default port, without user information or fragment, to an S3
+      #                           general-purpose endpoint (general_purpose_endpoint?), and a SigV4 presigned UploadPart:
+      #                           partNumber naming number; uploadId; X-Amz-Algorithm AWS4-HMAC-SHA256; X-Amz-Credential
+      #                           scoped to s3; X-Amz-SignedHeaders host alone, so that neither the length nor the bytes
+      #                           are signed; X-Amz-Signature; each once, and no parameter but QUERY_PARAMETERS, so none
+      #                           binding a checksum, digest or length
+      #   headers, parameters     none
+      #   send                    exactly the part's size as its Content-Length and its bytes as the body
+      #   direct_connection_info  none
+      #
+      # Anything else, such as a host that only resembles S3's, a custom or S3-compatible endpoint, a Files.com or agent
+      # URL, or a parallel flag on its own, is not this route. The URL is only read: the part goes to it exactly as given.
+      def self.route(upload, number)
+        attributes = upload.respond_to?(:attributes) && upload.attributes.is_a?(Hash) ? upload.attributes : {}
+        url = attributes[:upload_uri]
+        return unless attributes[:action] == "put/write" && attributes[:http_method] == "PUT" && attributes[:part_number] == number &&
+                      attributes[:direct_connection_info].nil? && none?(attributes[:headers]) && none?(attributes[:parameters]) &&
+                      ordinary_send?(attributes[:send]) && url.is_a?(String) && url.include?("?") && !url.include?("#")
+
+        uri = ::URI.parse(url)
+        return unless uri.scheme.to_s.casecmp?("https") && uri.port == 443 && uri.userinfo.nil? && uri.path.to_s.length > 1 &&
+                      general_purpose_endpoint?(uri.host.to_s)
+
+        resource, query = url.split("?", 2)
+        values = signed_query(query)
+        return unless values && !values["uploadId"].to_s.empty? && values["partNumber"] == number.to_s &&
+                      values["X-Amz-Algorithm"] == "AWS4-HMAC-SHA256" && values["X-Amz-Credential"].to_s.end_with?("/s3/aws4_request") &&
+                      values["X-Amz-SignedHeaders"] == "host" && !values["X-Amz-Signature"].to_s.empty?
+
+        "sha256:#{Digest::SHA256.new.update(resource).update("\n").update(values["uploadId"]).hexdigest}"
+      rescue ::URI::InvalidURIError
+        nil
+      end
+
+      # s3, s3.<region>, s3-<region> or s3.dualstack.<region> under amazonaws.com or amazonaws.com.cn, alone, with the
+      # bucket in the path, or after a bucket of one or more labels. Not S3's accelerate, FIPS, website, access point,
+      # Object Lambda, Outposts, Express or control endpoints, which this SDK does not size parts for.
+      def self.general_purpose_endpoint?(host)
+        host = host.downcase
+        within = %w[.amazonaws.com .amazonaws.com.cn].filter_map { |suffix| host.delete_suffix(suffix) if host.end_with?(suffix) }.first
+        return false if within.nil? || within.empty?
+
+        labels = within.split(".", -1)
+        endpoint = labels.rindex("s3")
+        if endpoint
+          after = labels[(endpoint + 1)..]
+          return false unless after.empty? || (after.size == 1 && region?(after[0])) || (after.size == 2 && after[0] == "dualstack" && region?(after[1]))
+        else
+          endpoint = labels.size - 1
+          return false unless labels[endpoint].start_with?("s3-") && region?(labels[endpoint].delete_prefix("s3-"))
+        end
+        labels[0...endpoint].none?(&:empty?)
+      end
+
+      # A region such as us-east-1, eu-central-2 or us-gov-west-1: two letters, words of letters, then a number.
+      private_class_method def self.region?(label)
+        words = label.split("-", -1)
+        words.size >= 3 && words[0].length == 2 && words[0...-1].all? { |word| word.match?(/\A[a-z]+\z/) } && words[-1].match?(/\A[0-9]+\z/)
+      end
+
+      # The query's parameters, each name with its percent-decoded value, or nil unless every one is among
+      # QUERY_PARAMETERS, as it is written there, given once and with a value.
+      private_class_method def self.signed_query(query)
+        values = {}
+        query.split("&", -1).each do |pair|
+          name, value = pair.split("=", 2)
+          return nil if value.nil? || !QUERY_PARAMETERS.include?(name) || values.key?(name)
+
+          values[name] = unescape(value)
+        end
+        values
+      end
+
+      # Percent-decoding alone, as a query has it: a plus sign stays as it is.
+      private_class_method def self.unescape(text)
+        text.b.gsub(/%\h\h/) { |escape| escape[1, 2].hex.chr }
+      end
+
+      private_class_method def self.none?(field)
+        field.nil? || (field.is_a?(Hash) && field.empty?)
+      end
+
+      # Exactly the part's size as its Content-Length and its bytes as the body.
+      private_class_method def self.ordinary_send?(instructions)
+        return false unless instructions.is_a?(Hash) && instructions.size == 2
+
+        instructions = instructions.transform_keys(&:to_s)
+        instructions["partsize"].is_a?(String) && instructions["partsize"].casecmp?("required-header Content-Length") && instructions["partdata"] == "body"
+      end
+    end
+  end
+end

data/lib/files.com.rb

@@ -32,6 +32,19 @@ require "files.com/util"
 require "files.com/list"
 require "files.com/uri"
 require "files.com/path_util"
+require "files.com/transfer/errors"
+require "files.com/transfer/options"
+require "files.com/transfer/clock"
+require "files.com/transfer/policy"
+require "files.com/transfer/controller"
+require "files.com/transfer/budgets"
+require "files.com/transfer/storage_retry"
+require "files.com/transfer/http_transport"
+require "files.com/transfer/checkpoint"
+require "files.com/transfer/job"
+require "files.com/transfer/upload_plan"
+require "files.com/transfer/upload_coordinator"
+require "files.com/transfer/download_coordinator"
 
 require "files.com/models/account_line_item"
 require "files.com/models/action"

data/spec/lib/api_client_spec.rb

@@ -583,11 +583,133 @@ RSpec.describe Files::ApiClient do
   end
 
   describe "User-Agent" do
-    it "reports the SDK version the package declares" do
+    around do |example|
+      original = [ Files.app_info, Files.default_headers, Files.api_key ]
+      example.run
+    ensure
+      Files.app_info, Files.default_headers, Files.api_key = original
+    end
+
+    let(:user_agents) { [] }
+    let(:client) do
+      sent = user_agents
+      stubbed_api_client do |stub|
+        stub.get("/api/rest/v1/workspaces/1") do |env|
+          sent << env.request_headers["User-Agent"]
+          json_response(200, { id: 1 })
+        end
+      end
+    end
+    let(:identity) { "Files.com Ruby SDK v#{Files::VERSION}" }
+
+    def find_workspace(options = {})
+      Files::Workspace.find(1, {}, { api_key: "key", client: client }.merge(options))
+    end
+
+    # identity followed by the one comment the SDK's own User-Agent ends with: a coarse operating system family and the
+    # Ruby runtime, with its version when it can carry it.
+    def sdk_user_agent(identity)
+      /\A#{Regexp.escape(identity)}(?<metadata> \(files-sdk-meta\/1; os=(?<os>[a-z][a-z0-9-]{0,15}); runtime=ruby(?:\/(?<version>[0-9][A-Za-z0-9.+_-]{0,47}))?\))\z/
+    end
+
+    it "names the package's version, then this Ruby and its operating system's family in one comment, on API requests" do
       package_version = Gem::Specification.load(File.expand_path("../../files.com.gemspec", __dir__)).version.to_s
-      user_agent = described_class.new.send(:request_headers, nil, nil, :get, nil)["User-Agent"]
 
-      expect(user_agent).to match(/\AFiles\.com Ruby SDK v#{Regexp.escape(package_version)}(?: |\z)/)
+      find_workspace
+
+      user_agent = user_agents.first
+      parts = sdk_user_agent("Files.com Ruby SDK v#{package_version}").match(user_agent)
+      expect(parts).not_to be_nil, "#{user_agent.inspect} is not the SDK's identity followed by its metadata comment"
+      expect(user_agent.bytesize).to be <= 190
+      expect(parts[:metadata].bytesize).to be <= 128
+      family = { /android/ => "android", /darwin/ => "macos", /linux/ => "linux", /mswin|mingw/ => "windows" }.find { |pattern, _| RbConfig::CONFIG["host_os"].match?(pattern) }&.last
+      expect(parts[:os]).to eq(family) if family
+      expect(parts[:version]).to eq(RUBY_VERSION) if RUBY_ENGINE == "ruby"
+    end
+
+    it "sends a User-Agent the caller sets exactly as given, however much it looks like the SDK's own" do
+      sdk_shaped = "Files.com Ruby SDK v0.0.1 (files-sdk-meta/1; os=linux; runtime=ruby/1.0)"
+
+      Files.default_headers = { "User-Agent" => sdk_shaped }
+      find_workspace
+      Files.default_headers = -> { { "User-Agent" => "Reporter from a Proc" } }
+      find_workspace
+      find_workspace("User-Agent" => "Reporter for one request")
+
+      expect(user_agents).to eq([ sdk_shaped, "Reporter from a Proc", "Reporter for one request" ])
+    end
+
+    it "keeps app info where it was, and adds no comment after app info that is not printable ASCII or leaves it no room" do
+      Files.app_info = { name: "Reporter", version: "2.1", url: "https://reporter.example" }
+      find_workspace
+      Files.app_info = { name: "Café" }
+      find_workspace
+      Files.app_info = { name: "R" * 160 }
+      find_workspace
+
+      expect(user_agents[0]).to match(sdk_user_agent("#{identity} Reporter/2.1 (https://reporter.example)"))
+      expect(user_agents[1..]).to eq([ "#{identity} Café", "#{identity} #{'R' * 160}" ])
+    end
+
+    it "gives a transfer's API requests the app info and default headers the transfer began with, whatever changes after" do
+      Files.app_info = { name: "Reporter", version: "2.1" }
+      began_with_app_info = described_class.transfer_settings
+      Files.app_info = nil
+      Files.default_headers = { "User-Agent" => "Captured reporter" }
+      began_with_headers = described_class.transfer_settings
+      Files.app_info = { name: "Later" }
+      Files.default_headers = {}
+
+      [ began_with_app_info, began_with_headers ].each { |settings| client.execute_request(:get, "/workspaces/1", api_key: "key", settings: settings) }
+      find_workspace
+
+      expect(user_agents[0]).to match(sdk_user_agent("#{identity} Reporter/2.1"))
+      expect(user_agents[1]).to eq("Captured reporter")
+      expect(user_agents[2]).to match(sdk_user_agent("#{identity} Later"))
+    end
+
+    it "leaves out a runtime version it cannot carry, and then the whole comment, rather than shorten the SDK's identity" do
+      sdk = "Files.com Ruby SDK v1.2.3"
+      with_metadata = lambda do |name = sdk, **facts|
+        described_class.user_agent_with_metadata(name, **{ host_os: "linux-gnu", ruby_engine: "ruby", ruby_version: "3.4.4" }.merge(facts))
+      end
+      # sdk, padded to bytes.
+      padded = ->(bytes) { sdk + ("0" * (bytes - sdk.bytesize)) }
+
+      expect(with_metadata.call).to eq("#{sdk} (files-sdk-meta/1; os=linux; runtime=ruby/3.4.4)")
+      { "darwin24" => "macos", "mingw32" => "windows", "linux-android" => "android", "freebsd14.1" => "freebsd", "solaris2.11" => "other", "" => "unknown" }.each do |host_os, family|
+        expect(with_metadata.call(host_os: host_os)).to eq("#{sdk} (files-sdk-meta/1; os=#{family}; runtime=ruby/3.4.4)")
+      end
+      [ "3.5.0 dev", "", nil ].each do |version|
+        expect(with_metadata.call(ruby_version: version)).to eq("#{sdk} (files-sdk-meta/1; os=linux; runtime=ruby)")
+      end
+      # Another engine's RUBY_VERSION is the language it follows, not its own.
+      expect(with_metadata.call(ruby_engine: "jruby", ruby_version: "3.1.4")).to eq("#{sdk} (files-sdk-meta/1; os=linux; runtime=ruby)")
+      expect(with_metadata.call(padded.call(141))).to eq("#{padded.call(141)} (files-sdk-meta/1; os=linux; runtime=ruby/3.4.4)")
+      expect(with_metadata.call(padded.call(142))).to eq("#{padded.call(142)} (files-sdk-meta/1; os=linux; runtime=ruby)")
+      expect(with_metadata.call(padded.call(147))).to eq("#{padded.call(147)} (files-sdk-meta/1; os=linux; runtime=ruby)")
+      expect(with_metadata.call(padded.call(148))).to eq(padded.call(148))
+      expect(with_metadata.call("#{sdk} Café")).to eq("#{sdk} Café")
+    end
+
+    it "sends a transfer request with only the User-Agent it is given, and no API credential" do
+      Files.api_key = "library-wide-key"
+      url = "https://storage.example.test/part?X-Amz-Signature=signed"
+      sent = []
+      connection = Faraday.new do |builder|
+        builder.adapter :test do |stub|
+          stub.put(url) do |env|
+            sent << env.request_headers
+            [ 200, { "ETag" => "\"part\"" }, "" ]
+          end
+        end
+      end
+
+      described_class.new(connection).remote_request(:put, url, { "User-Agent" => "Storage client" }, "part")
+
+      expect(sent.size).to eq(1)
+      expect(sent.first["User-Agent"]).to eq("Storage client")
+      expect(sent.first.keys.map(&:downcase)).not_to include("x-filesapi-key", "x-filesapi-auth", "x-files-client-user-agent")
     end
   end
 

data/spec/models/file_transfer_spec.rb

@@ -221,13 +221,18 @@ RSpec.describe Files::File, "transfers" do
       expect(requests.map(&:first)).to eq(%i[begin part])
     end
 
-    it "uploads as before when a part's non-success status is returned and no progress is given" do
+    it "refuses a part answered with a non-success status it returns, before ending the upload, when no progress is given" do
       requests = []
       client = upload_api(requests, partsize: 4, part_response: ->(_number) { [ 302, {}, "" ] })
 
-      with_local_file("abcdefghij") { |path| described_class.upload_file(path, "report.bin", { client: client }) }
-
-      expect(requests.map(&:first)).to eq(%i[begin part begin part begin part end])
+      with_local_file("abcdefghij") do |path|
+        expect { described_class.upload_file(path, "report.bin", { client: client }) }
+          .to raise_error(Files::APIError, "Transfer request failed") { |error|
+            expect(error.http_status).to eq(302)
+            expect(error.full_message).not_to include("storage.example.test")
+          }
+      end
+      expect(requests.map(&:first)).to eq(%i[begin part])
     end
 
     it "stops at a part answered 500, reporting nothing and not ending the upload" do
@@ -254,6 +259,26 @@ RSpec.describe Files::File, "transfers" do
     end
   end
 
+  describe ".upload_io" do
+    it "uploads a stream without a size one part at a time, to its end, and ends the upload with what it read" do
+      requests = []
+      reader = short_reader("abcdefghij", max_read: 3)
+
+      described_class.upload_io(reader, "report.bin", { client: upload_api(requests, partsize: 4) }, transfer: true)
+
+      expect(parts_sent(requests)).to eq([ [ 1, "abcd" ], [ 2, "efgh" ], [ 3, "ij" ] ])
+      expect(requests.last[0..1]).to match([ :end, hash_including("action" => "end", "size" => "10") ])
+    end
+
+    it "refuses a size that is not a non-negative Integer before sending anything" do
+      requests = []
+
+      expect { described_class.upload_io(StringIO.new("ab"), "report.bin", { client: upload_api(requests, partsize: 4) }, size: -1, transfer: true) }
+        .to raise_error(Files::InvalidParameterError)
+      expect(requests).to be_empty
+    end
+  end
+
   describe "#download_content" do
     def download(raw_response, range: [])
       server = serve(raw_response)
@@ -372,6 +397,17 @@ RSpec.describe Files::File, "transfers" do
       expect(sink.string).to be_empty
     end
 
+    it "refuses a response from the Files.com web app before writing any of it, and closes the caller's IO" do
+      page = "<html>Sign in</html>"
+      server = serve(response("200 OK", { "X-Files-Frontend-App" => "true", "Content-Length" => page.bytesize }, page))
+
+      expect { remote_file(server).download_content(sink) }.to raise_error(Files::Transfer::FrontendResponseError) { |error|
+        expect(error.full_message).not_to include("/objects/", "X-Amz", "fixture-signature")
+      }
+      expect(sink.string).to be_empty
+      expect(sink).to be_closed
+    end
+
     it "raises the caller IO's own write error, even when closing that IO fails too" do
       write_error = IOError.new("destination is full")
       failing_sink = Class.new(StringIO) do
@@ -439,6 +475,19 @@ RSpec.describe Files::File, "transfers" do
       file
     end
 
+    it "refuses transfer: and progress: before it opens a pipe or starts a download" do
+      requests = []
+      server = serve { |_client| requests << :download }
+      file = remote_file(server)
+      pipes = open_pipes.size
+
+      expect { file.read_io(transfer: true) }.to raise_error(Files::InvalidParameterError, /read_io cannot transfer adaptively/)
+      expect { file.read_io(progress: ->(_report) {}) }.to raise_error(Files::InvalidParameterError)
+      expect(open_pipes.size).to be <= pipes
+      expect(server.requests).to be_empty
+      expect(requests).to be_empty
+    end
+
     {
       "read" => ->(reader) { reader.read },
       "read(n) until eof?" => ->(reader) { reader.read(1024) until reader.eof? },

data/spec/support/transfer_server.rb

@@ -3,9 +3,18 @@ require "socket"
 # A loopback HTTP server for transfer specs. It answers each connection with
 # one canned response, written byte for byte, so a spec controls exactly the
 # framing a storage provider sends, including bodies that end early. Every
-# request it receives is recorded.
+# request it receives is recorded, with its method and body.
+#
+# With concurrent: true it answers each connection on its own thread, so a spec
+# can see requests that are really in flight at once: each Request records how
+# many were (itself included) when it arrived, and peak_in_flight the most at
+# any time. A request counts as in flight from when it has been read until its
+# response is written.
 class TransferServer
-  Request = Struct.new(:target, :headers)
+  Request = Struct.new(:target, :headers, :http_method, :body, :in_flight)
+
+  # How long close waits for each concurrent connection still being answered.
+  SHUTDOWN_SECONDS = 5
 
   attr_reader :requests
 
@@ -15,10 +24,19 @@ class TransferServer
   end
 
   # The block receives each client socket once its request has been read, and
-  # the connection closes when the block returns.
-  def initialize(&respond)
+  # the connection closes when the block returns. With concurrent: true it
+  # receives the Request instead and returns the response to write: a String,
+  # or an Array of Strings written in turn and callables called between them,
+  # such as a sleep that holds a body back after its headers.
+  def initialize(concurrent: false, &respond)
     @respond = respond
+    @concurrent = concurrent
     @requests = []
+    @lock = Mutex.new
+    @changed = ConditionVariable.new
+    @in_flight = 0
+    @peak = 0
+    @handlers = []
     @listener = TCPServer.new("127.0.0.1", 0)
     @thread = Thread.new { serve }
   end
@@ -27,9 +45,48 @@ class TransferServer
     "http://127.0.0.1:#{@listener.addr[1]}#{target}"
   end
 
+  def peak_in_flight
+    @lock.synchronize { @peak }
+  end
+
+  # Waits until at least count requests have been in flight at once, for at
+  # most timeout seconds, and returns whether they were.
+  def wait_for_peak(count, timeout: 5)
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+    @lock.synchronize do
+      until @peak >= count
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return false unless remaining.positive?
+
+        @changed.wait(@lock, remaining)
+      end
+      true
+    end
+  end
+
+  # Waits until at least count requests have arrived at a concurrent server, for
+  # at most timeout seconds, and returns whether they did.
+  def wait_for_requests(count, timeout: 5)
+    deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + timeout
+    @lock.synchronize do
+      until @requests.size >= count
+        remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+        return false unless remaining.positive?
+
+        @changed.wait(@lock, remaining)
+      end
+      true
+    end
+  end
+
+  # Stops accepting connections and returns once the server has stopped
+  # writing. A concurrent connection still being answered after
+  # SHUTDOWN_SECONDS is stopped.
   def close
     @listener.close
     @thread.join
+    handlers = @lock.synchronize { @handlers.dup }
+    handlers.each { |handler| handler.join(SHUTDOWN_SECONDS) || handler.kill }
   end
 
   private
@@ -37,24 +94,66 @@ class TransferServer
   def serve
     loop do
       client = @listener.accept
-      @requests << read_request(client)
-      @respond.call(client)
-    rescue Errno::EPIPE, Errno::ECONNRESET
-      next # The client stopped reading, which some specs do on purpose.
-    ensure
-      client&.close
+      if @concurrent
+        @lock.synchronize { @handlers << Thread.new(client) { |connection| answer(connection) } }
+      else
+        answer_serially(client)
+      end
     end
   rescue IOError, Errno::EBADF
     nil # The listener was closed.
   end
 
+  def answer_serially(client)
+    request = read_request(client)
+    return unless request
+
+    @requests << request
+    @respond.call(client)
+  rescue Errno::EPIPE, Errno::ECONNRESET
+    nil # The client stopped reading, which some specs do on purpose.
+  ensure
+    client.close
+  end
+
+  def answer(client)
+    request = read_request(client)
+    return unless request
+
+    @lock.synchronize do
+      @in_flight += 1
+      @peak = [ @peak, @in_flight ].max
+      request.in_flight = @in_flight
+      @requests << request
+      @changed.broadcast
+    end
+    begin
+      response = @respond.call(request)
+    ensure
+      @lock.synchronize do
+        @in_flight -= 1
+        @changed.broadcast
+      end
+    end
+    Array(response).each { |piece| piece.respond_to?(:call) ? piece.call : client.write(piece) }
+  rescue Errno::EPIPE, Errno::ECONNRESET, IOError
+    nil # The client stopped reading or the server is closing.
+  ensure
+    client.close
+  end
+
   def read_request(client)
-    target = client.gets("\r\n").split[1]
+    line = client.gets("\r\n")
+    return unless line
+
+    method, target = line.split
     headers = {}
-    while (line = client.gets("\r\n")) && line != "\r\n"
-      name, value = line.chomp("\r\n").split(": ", 2)
+    while (header = client.gets("\r\n")) && header != "\r\n"
+      name, value = header.chomp("\r\n").split(": ", 2)
       headers[name.downcase] = value
     end
-    Request.new(target, headers)
+    length = headers["content-length"].to_i
+    body = length.positive? ? client.read(length).to_s : ""
+    Request.new(target, headers, method, body.b)
   end
 end