@mentra/acs-meeting 3.2.0-dev.221 → 3.2.0-dev.223

package/android/src/test/java/com/mentra/acsmeeting/source/SoftApSdpGuardTest.kt

@@ -0,0 +1,275 @@
+package com.mentra.acsmeeting.source
+
+import com.mentra.acsmeeting.network.Ipv4Prefix
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.Test
+
+/**
+ * Pins the candidate classification the SoftAP path depends on.
+ *
+ * The cases here deliberately mirror
+ * `com.mentra.asg_client.io.streaming.config.IcePostPolicyTest` on the glasses. The two
+ * implementations cannot share code across the module boundary, and if they disagree the symptom is
+ * a call that negotiates and then carries nothing: one side posts an offer it considers ready while
+ * the other rejects it, or worse, both accept a candidate pair that cannot actually reach across
+ * the hotspot.
+ */
+class SoftApSdpGuardTest {
+
+  private val hostCandidate =
+    "a=candidate:1 1 udp 2122260223 192.168.43.20 51234 typ host generation 0"
+  private val srflxCandidate =
+    "a=candidate:2 1 udp 1686052607 203.0.113.7 51234 typ srflx raddr 192.168.43.20 rport 51234"
+
+  private fun sdp(vararg lines: String) =
+    (listOf("v=0", "m=video 9 UDP/TLS/RTP/SAVPF 96") + lines).joinToString("\r\n")
+
+  // -----------------------------------------------------------------
+  // Accepting a usable negotiation
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `an sdp with a hotspot host candidate is accepted`() {
+    val verdict = SoftApSdpGuard.inspect(sdp(hostCandidate))
+
+    assertThat(verdict).isInstanceOf(SoftApSdpGuard.Verdict.Ok::class.java)
+    val ok = verdict as SoftApSdpGuard.Verdict.Ok
+    assertThat(ok.hostCandidates).hasSize(1)
+    assertThat(ok.routableCandidates).isEmpty()
+  }
+
+  /**
+   * Not a rejection. A stale glasses build may still gather srflx candidates, and dropping the call
+   * over it would be worse than a warning when a usable hotspot candidate is also present — but it
+   * is reported, because ICE could otherwise select it.
+   */
+  @Test
+  fun `a stray srflx candidate is reported but does not reject`() {
+    val verdict = SoftApSdpGuard.inspect(sdp(hostCandidate, srflxCandidate))
+
+    val ok = verdict as SoftApSdpGuard.Verdict.Ok
+    assertThat(ok.hostCandidates).hasSize(1)
+    assertThat(ok.routableCandidates).hasSize(1)
+    assertThat(ok.routableCandidates.single()).contains("typ srflx")
+  }
+
+  @Test
+  fun `any rfc1918 subnet counts, not just the default hotspot range`() {
+    // A hotspot on a non-default subnet must not silently fail the gate.
+    for (address in listOf("192.168.1.5", "10.0.0.9", "172.16.4.4", "172.31.255.254")) {
+      val verdict = SoftApSdpGuard.inspect(
+        sdp("a=candidate:1 1 udp 2122260223 $address 51234 typ host generation 0"),
+      )
+
+      assertThat(verdict)
+        .describedAs(address)
+        .isInstanceOf(SoftApSdpGuard.Verdict.Ok::class.java)
+    }
+  }
+
+  // -----------------------------------------------------------------
+  // Rejecting an unusable negotiation
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `an sdp with only a srflx candidate is rejected`() {
+    val verdict = SoftApSdpGuard.inspect(sdp(srflxCandidate))
+
+    val rejected = verdict as SoftApSdpGuard.Verdict.Rejected
+    assertThat(rejected.code).isEqualTo(SoftApSdpGuard.REASON_ONLY_NON_HOTSPOT)
+    assertThat(rejected.detail).contains("typ srflx")
+  }
+
+  @Test
+  fun `an sdp with no candidates at all is rejected and says so`() {
+    val verdict = SoftApSdpGuard.inspect(sdp())
+
+    val rejected = verdict as SoftApSdpGuard.Verdict.Rejected
+    assertThat(rejected.code).isEqualTo(SoftApSdpGuard.REASON_NO_CANDIDATES)
+    assertThat(rejected.detail).isEqualTo("no candidates at all")
+  }
+
+  /** Public and loopback host candidates are unreachable from the glasses. */
+  @Test
+  fun `a host candidate on a public or loopback address is rejected`() {
+    for (address in listOf("203.0.113.7", "127.0.0.1", "8.8.8.8", "172.32.0.1", "192.169.0.1")) {
+      val verdict = SoftApSdpGuard.inspect(
+        sdp("a=candidate:1 1 udp 2122260223 $address 51234 typ host generation 0"),
+      )
+
+      assertThat(verdict)
+        .describedAs(address)
+        .isInstanceOf(SoftApSdpGuard.Verdict.Rejected::class.java)
+    }
+  }
+
+  /**
+   * A link-local address means the interface never got a DHCP lease from the glasses. ICE would
+   * gather it and connect to nothing.
+   */
+  @Test
+  fun `a link local host candidate is rejected`() {
+    val verdict = SoftApSdpGuard.inspect(
+      sdp("a=candidate:1 1 udp 2122260223 169.254.10.20 51234 typ host generation 0"),
+    )
+
+    assertThat(verdict).isInstanceOf(SoftApSdpGuard.Verdict.Rejected::class.java)
+  }
+
+  /**
+   * libwebrtc emits these to hide private addresses from remote peers. The glasses cannot resolve
+   * them, so a negotiation carrying only mDNS candidates is broken however healthy it looks.
+   */
+  @Test
+  fun `an mdns obfuscated candidate is rejected`() {
+    val verdict = SoftApSdpGuard.inspect(
+      sdp(
+        "a=candidate:1 1 udp 2122260223 " +
+          "b8e7c1f2-0000-4000-8000-000000000000.local 51234 typ host generation 0",
+      ),
+    )
+
+    val rejected = verdict as SoftApSdpGuard.Verdict.Rejected
+    assertThat(rejected.code).isEqualTo(SoftApSdpGuard.REASON_ONLY_NON_HOTSPOT)
+  }
+
+  @Test
+  fun `an ipv6 host candidate does not satisfy the gate`() {
+    // The SoftAP link is IPv4 only, so an IPv6 candidate cannot carry this media.
+    val verdict = SoftApSdpGuard.inspect(
+      sdp("a=candidate:1 1 udp 2122260223 fe80::1 51234 typ host generation 0"),
+    )
+
+    assertThat(verdict).isInstanceOf(SoftApSdpGuard.Verdict.Rejected::class.java)
+  }
+
+  @Test
+  fun `empty and non sdp input is malformed rather than candidate-less`() {
+    for (input in listOf(null, "", "   ", "v=0\r\no=- 0 0 IN IP4 0.0.0.0")) {
+      val verdict = SoftApSdpGuard.inspect(input)
+
+      assertThat((verdict as SoftApSdpGuard.Verdict.Rejected).code)
+        .describedAs(input.orEmpty())
+        .isEqualTo(SoftApSdpGuard.REASON_MALFORMED)
+    }
+  }
+
+  // -----------------------------------------------------------------
+  // Parsing details
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `candidate extraction strips the attribute prefix and ignores other lines`() {
+    val candidates = SoftApSdpGuard.candidateLines(
+      sdp("a=mid:0", hostCandidate, "a=sendrecv", srflxCandidate),
+    )
+
+    assertThat(candidates).hasSize(2)
+    assertThat(candidates).allSatisfy { assertThat(it).startsWith("candidate:") }
+  }
+
+  @Test
+  fun `candidate extraction tolerates trailing whitespace and lone newlines`() {
+    val candidates = SoftApSdpGuard.candidateLines("m=video 9\n$hostCandidate  \n")
+
+    assertThat(candidates).hasSize(1)
+  }
+
+  @Test
+  fun `private ipv4 boundaries match rfc1918 exactly`() {
+    assertThat(SoftApSdpGuard.isPrivateIpv4("10.0.0.0")).isTrue()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("10.255.255.255")).isTrue()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("172.15.0.1")).isFalse()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("172.16.0.0")).isTrue()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("172.31.0.0")).isTrue()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("172.32.0.0")).isFalse()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("192.168.0.0")).isTrue()
+    assertThat(SoftApSdpGuard.isPrivateIpv4("192.167.0.0")).isFalse()
+  }
+
+  @Test
+  fun `malformed addresses are not private`() {
+    for (token in listOf("192.168.1", "192.168.1.1.1", "192.168.1.256", "a.b.c.d", "", "host")) {
+      assertThat(SoftApSdpGuard.isPrivateIpv4(token)).describedAs(token).isFalse()
+    }
+  }
+
+  @Test
+  fun `a candidate must be typ host to count`() {
+    assertThat(SoftApSdpGuard.isSoftApHostCandidate(hostCandidate.removePrefix("a="))).isTrue()
+    assertThat(
+      SoftApSdpGuard.isSoftApHostCandidate(
+        "candidate:1 1 udp 2122260223 192.168.43.20 51234 typ relay",
+      ),
+    ).isFalse()
+  }
+
+  @Test
+  fun `the candidate address is read positionally, with or without the a= prefix`() {
+    assertThat(SoftApSdpGuard.candidateAddress(hostCandidate)).isEqualTo("192.168.43.20")
+    assertThat(
+      SoftApSdpGuard.candidateAddress(
+        "candidate:3558496604 1 udp 2122260223 10.48.51.202 35664 typ host generation 0",
+      ),
+    ).isEqualTo("10.48.51.202")
+  }
+
+  /** `raddr` would win a scan for anything dotted-quad-shaped and blame the wrong interface. */
+  @Test
+  fun `a reflexive candidate reports its local address, not its raddr`() {
+    assertThat(
+      SoftApSdpGuard.candidateAddress(
+        "candidate:2 1 udp 1686052607 203.0.113.9 44444 typ srflx raddr 192.168.43.20 rport 51234",
+      ),
+    ).isEqualTo("203.0.113.9")
+  }
+
+  @Test
+  fun `a line without an address reports none rather than a stray token`() {
+    assertThat(SoftApSdpGuard.candidateAddress("a=mid:0")).isNull()
+    assertThat(SoftApSdpGuard.candidateAddress("")).isNull()
+  }
+
+  // -----------------------------------------------------------------
+  // Pinning a cellular-substituted host address back onto the hotspot
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `a cellular host address is rewritten to the scoped SoftAP address`() {
+    val prefix = Ipv4Prefix("192.168.43.79", 24)
+    val original =
+      sdp("a=candidate:1 1 udp 2122260223 10.48.51.202 35664 typ host generation 0")
+
+    val pinned = SoftApSdpGuard.pinHostAddresses(original, "192.168.43.79", prefix)
+
+    assertThat(pinned.rewritten).containsExactly("10.48.51.202")
+    assertThat(pinned.sdp).contains("192.168.43.79 35664 typ host")
+    assertThat(pinned.sdp).doesNotContain("10.48.51.202")
+    assertThat(SoftApSdpGuard.inspect(pinned.sdp, prefix)).isInstanceOf(SoftApSdpGuard.Verdict.Ok::class.java)
+  }
+
+  @Test
+  fun `a host address already on the hotspot is left alone`() {
+    val prefix = Ipv4Prefix("192.168.43.79", 24)
+    val original = sdp(hostCandidate)
+
+    val pinned = SoftApSdpGuard.pinHostAddresses(original, "192.168.43.79", prefix)
+
+    assertThat(pinned.rewritten).isEmpty()
+    assertThat(pinned.sdp).isEqualTo(original)
+  }
+
+  @Test
+  fun `a reflexive raddr is not treated as the connection address to pin`() {
+    // Field 5 is 203.0.113.7; raddr is already the hotspot. Rewriting raddr would hide a srflx
+    // that ICE could still select, and would not fix the address the glasses send to.
+    val prefix = Ipv4Prefix("192.168.43.79", 24)
+    val original = sdp(srflxCandidate)
+
+    val pinned = SoftApSdpGuard.pinHostAddresses(original, "192.168.43.79", prefix)
+
+    assertThat(pinned.rewritten).isEmpty()
+    assertThat(pinned.sdp).contains("203.0.113.7")
+    assertThat(pinned.sdp).contains("raddr 192.168.43.20")
+  }
+}

package/android/src/test/java/com/mentra/acsmeeting/source/TrackRegistryTest.kt

@@ -33,4 +33,13 @@ class TrackRegistryTest {
     assertThat(registry.claim("track-a")).isTrue()
     assertThat(registry.size()).isEqualTo(1)
   }
+
+  @Test
+  fun softapWhipReconnectCanReclaimVideo0() {
+    val registry = TrackRegistry()
+    assertThat(registry.claim("video0")).isTrue()
+    assertThat(registry.claim("video0")).isFalse()
+    registry.reset()
+    assertThat(registry.claim("video0")).isTrue()
+  }
 }

package/android/src/test/java/com/mentra/acsmeeting/source/WhipIngestProtocolTest.kt

@@ -0,0 +1,356 @@
+package com.mentra.acsmeeting.source
+
+import com.mentra.acsmeeting.source.WhipIngestProtocol.Action
+import com.mentra.acsmeeting.source.WhipIngestProtocol.Endpoint
+import com.mentra.acsmeeting.source.WhipIngestProtocol.Request
+import com.mentra.acsmeeting.source.WhipIngestProtocol.State
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.Test
+
+/**
+ * The endpoint's decision table.
+ *
+ * These are the cases that are painful to provoke against a live device and cheap to state here: a
+ * duplicate POST during a gather, a DELETE against an id that has already been replaced, a POST
+ * that lands after teardown. Each one has a specific status the glasses' WHIP client reacts to
+ * differently, so the statuses are pinned rather than merely "not 200".
+ */
+class WhipIngestProtocolTest {
+
+  private val endpoint = Endpoint("192.168.43.20", 8790)
+  private val free = State()
+  private val offer = "v=0\r\nm=video 9 UDP/TLS/RTP/SAVPF 96\r\n"
+
+  private fun post(
+    body: String = offer,
+    contentType: String? = "application/sdp",
+    length: Long? = body.length.toLong(),
+    target: String = "/whip",
+  ) = Request("POST", target, contentType, length, body)
+
+  // -----------------------------------------------------------------
+  // The happy path
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `a valid offer on a free endpoint negotiates`() {
+    val action = WhipIngestProtocol.decide(post(), free, "sess-1")
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+    val negotiate = action as Action.Negotiate
+    assertThat(negotiate.sessionId).isEqualTo("sess-1")
+    assertThat(negotiate.offer).isEqualTo(offer)
+  }
+
+  @Test
+  fun `a lowercase method still negotiates`() {
+    // HTTP methods are case-sensitive in the spec, but accepting the variant costs nothing and
+    // failing it would present as an unexplained 405 on device.
+    val action = WhipIngestProtocol.decide(post().copy(method = "post"), free, "sess-1")
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+  }
+
+  @Test
+  fun `a query string does not hide the base path`() {
+    val action = WhipIngestProtocol.decide(post(target = "/whip?x=1"), free, "sess-1")
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+  }
+
+  @Test
+  fun `a trailing slash is the same resource`() {
+    val action = WhipIngestProtocol.decide(post(target = "/whip/"), free, "sess-1")
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+  }
+
+  @Test
+  fun `a content type with parameters is still sdp`() {
+    val action =
+      WhipIngestProtocol.decide(post(contentType = "application/SDP; charset=utf-8"), free, "s")
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+  }
+
+  // -----------------------------------------------------------------
+  // 201 carries the absolute Location the client will DELETE
+  // -----------------------------------------------------------------
+
+  /**
+   * Absolute, not `/whip/<id>`. WHIP terminations go to the URL in `Location`, and the glasses'
+   * client has not been verified to resolve a relative one against the request URL.
+   */
+  @Test
+  fun `201 returns an absolute location and the answer`() {
+    val response = WhipIngestProtocol.respondNegotiated(endpoint, "sess-1", "v=0 answer")
+
+    assertThat(response.status).isEqualTo(201)
+    assertThat(response.headers["Location"]).isEqualTo("http://192.168.43.20:8790/whip/sess-1")
+    assertThat(response.headers["Content-Type"]).isEqualTo("application/sdp")
+    assertThat(response.body).isEqualTo("v=0 answer")
+  }
+
+  @Test
+  fun `the location url is what a delete is accepted on`() {
+    val sessionUrl = endpoint.sessionUrl("sess-1")
+    val path = sessionUrl.removePrefix("http://192.168.43.20:8790")
+
+    val action = WhipIngestProtocol.decide(
+      Request("DELETE", path),
+      State(activeSessionId = "sess-1"),
+      "unused",
+    )
+
+    assertThat(action).isEqualTo(Action.Terminate("sess-1"))
+  }
+
+  // -----------------------------------------------------------------
+  // One publisher
+  // -----------------------------------------------------------------
+
+  /**
+   * A second POST usually means the glasses retried a request whose reply they never saw. Replacing
+   * a live peer with a speculative one would drop a working call, so the live session wins.
+   */
+  @Test
+  fun `a second offer while publishing conflicts and keeps the live session`() {
+    val action = WhipIngestProtocol.decide(post(), State(activeSessionId = "sess-1"), "sess-2")
+
+    val response = (action as Action.Reply).response
+    assertThat(response.status).isEqualTo(409)
+    assertThat(response.headers["Location"]).isEqualTo("sess-1")
+    assertThat(response.body).contains("sess-1")
+  }
+
+  // -----------------------------------------------------------------
+  // Termination
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `deleting the active session terminates it`() {
+    val action =
+      WhipIngestProtocol.decide(Request("DELETE", "/whip/sess-1"), State("sess-1"), "unused")
+
+    assertThat(action).isEqualTo(Action.Terminate("sess-1"))
+  }
+
+  /**
+   * A stale DELETE must not tear down whoever holds the slot now. This is the rejoin race: the
+   * glasses DELETE an old session while a new one is already publishing.
+   */
+  @Test
+  fun `deleting a stale session is a 404 and spares the current publisher`() {
+    val action =
+      WhipIngestProtocol.decide(Request("DELETE", "/whip/old"), State("sess-2"), "unused")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(404)
+  }
+
+  @Test
+  fun `deleting when nothing is active is a 404`() {
+    val action = WhipIngestProtocol.decide(Request("DELETE", "/whip/sess-1"), free, "unused")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(404)
+  }
+
+  @Test
+  fun `termination returns no content`() {
+    assertThat(WhipIngestProtocol.terminated().status).isEqualTo(204)
+    assertThat(WhipIngestProtocol.terminated().body).isEmpty()
+  }
+
+  // -----------------------------------------------------------------
+  // The tombstone
+  // -----------------------------------------------------------------
+
+  /**
+   * After stop, a well-formed POST is still refused. Granting it a session would attach a publisher
+   * to an endpoint whose peer and scoped network are already gone.
+   */
+  @Test
+  fun `a well formed offer after stop is gone, not created`() {
+    val action = WhipIngestProtocol.decide(post(), State(stopped = true), "sess-1")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(410)
+  }
+
+  @Test
+  fun `a delete after stop is gone rather than 404`() {
+    val action = WhipIngestProtocol.decide(
+      Request("DELETE", "/whip/sess-1"),
+      State(activeSessionId = "sess-1", stopped = true),
+      "unused",
+    )
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(410)
+  }
+
+  // -----------------------------------------------------------------
+  // Malformed requests
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `a non post on the base path is 405 and advertises post`() {
+    val action = WhipIngestProtocol.decide(Request("GET", "/whip"), free, "sess-1")
+
+    val response = (action as Action.Reply).response
+    assertThat(response.status).isEqualTo(405)
+    assertThat(response.headers["Allow"]).isEqualTo("POST")
+  }
+
+  @Test
+  fun `a non delete on the session path is 405 and advertises delete`() {
+    val action = WhipIngestProtocol.decide(Request("GET", "/whip/sess-1"), State("sess-1"), "x")
+
+    val response = (action as Action.Reply).response
+    assertThat(response.status).isEqualTo(405)
+    assertThat(response.headers["Allow"]).isEqualTo("DELETE")
+  }
+
+  @Test
+  fun `a non sdp content type is 415`() {
+    val action = WhipIngestProtocol.decide(post(contentType = "application/json"), free, "s")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(415)
+  }
+
+  @Test
+  fun `a missing content type is 415`() {
+    val action = WhipIngestProtocol.decide(post(contentType = null), free, "s")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(415)
+  }
+
+  /** Length is checked before type, because an oversized body is never read and so never typed. */
+  @Test
+  fun `an oversized offer is 413 even before the type is considered`() {
+    val action = WhipIngestProtocol.decide(
+      post(contentType = "application/json", length = WhipIngestProtocol.MAX_BODY_BYTES + 1),
+      free,
+      "s",
+    )
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(413)
+  }
+
+  @Test
+  fun `an offer exactly at the cap is accepted`() {
+    val action = WhipIngestProtocol.decide(
+      post(length = WhipIngestProtocol.MAX_BODY_BYTES),
+      free,
+      "s",
+    )
+
+    assertThat(action).isInstanceOf(Action.Negotiate::class.java)
+  }
+
+  @Test
+  fun `an empty offer body is 400`() {
+    val action = WhipIngestProtocol.decide(post(body = "   ", length = 3), free, "s")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(400)
+  }
+
+  @Test
+  fun `an unrelated path is 404`() {
+    val action = WhipIngestProtocol.decide(post(target = "/health"), free, "s")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(404)
+  }
+
+  @Test
+  fun `a nested session path is not a session id`() {
+    val action =
+      WhipIngestProtocol.decide(Request("DELETE", "/whip/a/b"), State("a"), "unused")
+
+    assertThat((action as Action.Reply).response.status).isEqualTo(404)
+  }
+
+  @Test
+  fun `negotiation failure is a 500, not a client error`() {
+    // The publisher did nothing wrong and a retry may succeed, so this must not read as 4xx.
+    val response = WhipIngestProtocol.respondNegotiationFailed("gather_timeout")
+
+    assertThat(response.status).isEqualTo(500)
+    assertThat(response.body).isEqualTo("gather_timeout")
+  }
+
+  // -----------------------------------------------------------------
+  // Wire rendering
+  // -----------------------------------------------------------------
+
+  /**
+   * A missing `Content-Length` turns a clean refusal into a hang: the client waits for a body that
+   * never ends, then retries on timeout, which is exactly what the tombstone is meant to prevent.
+   */
+  @Test
+  fun `every response carries a content length and closes the connection`() {
+    val rendered = WhipIngestProtocol.render(WhipIngestProtocol.terminated())
+
+    assertThat(rendered).startsWith("HTTP/1.1 204 No Content\r\n")
+    assertThat(rendered).contains("Content-Length: 0\r\n")
+    assertThat(rendered).contains("Connection: close\r\n")
+    assertThat(rendered).endsWith("\r\n\r\n")
+  }
+
+  @Test
+  fun `the rendered length counts utf8 bytes rather than characters`() {
+    val rendered = WhipIngestProtocol.render(
+      WhipIngestProtocol.Response(500, "Internal Server Error", body = "café"),
+    )
+
+    assertThat(rendered).contains("Content-Length: 5\r\n")
+  }
+
+  @Test
+  fun `an sdp answer keeps its own content type`() {
+    val rendered =
+      WhipIngestProtocol.render(WhipIngestProtocol.respondNegotiated(endpoint, "s", "v=0"))
+
+    assertThat(rendered).contains("Content-Type: application/sdp\r\n")
+    assertThat(rendered).doesNotContain("text/plain")
+    assertThat(rendered).endsWith("\r\n\r\nv=0")
+  }
+
+  @Test
+  fun `a plain text body gets a default content type`() {
+    val rendered =
+      WhipIngestProtocol.render(WhipIngestProtocol.Response(410, "Gone", body = "stopped"))
+
+    assertThat(rendered).contains("Content-Type: text/plain; charset=utf-8\r\n")
+  }
+
+  // -----------------------------------------------------------------
+  // Request line and header parsing
+  // -----------------------------------------------------------------
+
+  @Test
+  fun `a request line parses into method and target`() {
+    assertThat(WhipIngestProtocol.parseRequestLine("POST /whip HTTP/1.1"))
+      .isEqualTo("POST" to "/whip")
+  }
+
+  @Test
+  fun `a request line with extra spacing still parses`() {
+    assertThat(WhipIngestProtocol.parseRequestLine("  DELETE   /whip/s1   HTTP/1.1  "))
+      .isEqualTo("DELETE" to "/whip/s1")
+  }
+
+  @Test
+  fun `an absolute or garbage request target is rejected`() {
+    // Only origin-form targets are accepted; anything else would bypass the path routing above.
+    assertThat(WhipIngestProtocol.parseRequestLine("POST http://host/whip HTTP/1.1")).isNull()
+    assertThat(WhipIngestProtocol.parseRequestLine("garbage")).isNull()
+    assertThat(WhipIngestProtocol.parseRequestLine("")).isNull()
+  }
+
+  @Test
+  fun `header lookup ignores case as clients assume`() {
+    val headers = mapOf("content-TYPE" to "application/sdp", "Content-Length" to "12")
+
+    assertThat(WhipIngestProtocol.headerValue(headers, "Content-Type")).isEqualTo("application/sdp")
+    assertThat(WhipIngestProtocol.headerValue(headers, "CONTENT-LENGTH")).isEqualTo("12")
+    assertThat(WhipIngestProtocol.headerValue(headers, "Missing")).isNull()
+  }
+}