Client vs Server

package main

import (
	"bufio"
	"fmt"
	"net"
	"net/http"
	"strconv"
	"strings"
)

// The price lives on the server. The client never gets to decide it.
var prices = map[string]int{"book": 500}

// /trust believes whatever the client sent, price included.
func trust(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query()
	qty, _ := strconv.Atoi(q.Get("qty"))
	price, _ := strconv.Atoi(q.Get("price"))
	fmt.Fprintf(w, "charged %d", qty*price)
}

// /checkout takes only what the user chose, and decides everything else itself.
func checkout(w http.ResponseWriter, r *http.Request) {
	q := r.URL.Query()
	price, ok := prices[q.Get("item")]
	if !ok {
		http.Error(w, "no such item", http.StatusNotFound)
		return
	}
	qty, err := strconv.Atoi(q.Get("qty"))
	if err != nil || qty < 1 || qty > 10 {
		w.WriteHeader(http.StatusBadRequest)
		fmt.Fprint(w, "qty must be 1 to 10")
		return
	}
	fmt.Fprintf(w, "charged %d", qty*price)
}

// send writes an HTTP request by hand, the way any program could, and returns "status body".
func send(addr, path string) string {
	conn, err := net.Dial("tcp", addr)
	if err != nil {
		panic(err)
	}
	defer conn.Close()
	fmt.Fprintf(conn, "GET %s HTTP/1.1\r\nHost: shop\r\nConnection: close\r\n\r\n", path)
	reply := bufio.NewReader(conn)
	status, _ := reply.ReadString('\n') // "HTTP/1.1 200 OK"
	for {                               // skip the headers: they end at the first empty line
		line, err := reply.ReadString('\n')
		if line == "\r\n" || err != nil {
			break
		}
	}
	body, _ := reply.ReadString(0)
	return strings.Fields(status)[1] + " " + strings.TrimSpace(body)
}

func main() {
	mux := http.NewServeMux()
	mux.HandleFunc("/trust", trust)
	mux.HandleFunc("/checkout", checkout)
	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		panic(err)
	}
	go http.Serve(ln, mux)
	addr := ln.Addr().String()

	fmt.Println("a book costs 500 taka; that price is stored on the server")
	fmt.Printf("%-6s %-22s %-20s %s\n", "sender", "asks for", "/trust", "/checkout")
	for _, c := range [][2]string{
		{"app", "item=book&qty=2&price=500"},
		{"curl", "item=book&qty=2&price=1"},
		{"curl", "item=book&qty=-3&price=500"},
	} {
		fmt.Printf("%-6s %-22s %-20s %s\n", c[0], strings.TrimPrefix(c[1], "item=book&"), send(addr, "/trust?"+c[1]), send(addr, "/checkout?"+c[1]))
	}
}

const http = require("node:http");
const net = require("node:net");

// The price lives on the server. The client never gets to decide it.
const prices = { book: 500 };

const handlers = {
  // /trust believes whatever the client sent, price included.
  "/trust": (q) => [200, `charged ${Number(q.get("qty")) * Number(q.get("price"))}`],
  // /checkout takes only what the user chose, and decides everything else itself.
  "/checkout": (q) => {
    const price = prices[q.get("item")];
    if (price === undefined) return [404, "no such item"];
    const qty = Number(q.get("qty"));
    if (!Number.isInteger(qty) || qty < 1 || qty > 10) return [400, "qty must be 1 to 10"];
    return [200, `charged ${qty * price}`];
  },
};

const server = http.createServer((req, res) => {
  const url = new URL(req.url, "http://shop");
  const [status, body] = handlers[url.pathname]?.(url.searchParams) ?? [404, "not found"];
  res.writeHead(status, { "Content-Length": Buffer.byteLength(body) }).end(body);
});

// send writes an HTTP request by hand, the way any program could, and resolves to "status body".
const send = (port, path) =>
  new Promise((resolve, reject) => {
    const conn = net.connect(port, "127.0.0.1", () =>
      conn.write(`GET ${path} HTTP/1.1\r\nHost: shop\r\nConnection: close\r\n\r\n`),
    );
    let reply = "";
    conn.on("data", (d) => (reply += d));
    conn.on("end", () => {
      const [head, body] = reply.split("\r\n\r\n"); // the headers end at the first empty line
      resolve(`${head.split(" ")[1]} ${body.trim()}`);
    });
    conn.on("error", reject);
  });

server.listen(0, "127.0.0.1", async () => {
  const { port } = server.address();
  console.log("a book costs 500 taka; that price is stored on the server");
  console.log(`${"sender".padEnd(6)} ${"asks for".padEnd(22)} ${"/trust".padEnd(20)} /checkout`);
  for (const [who, query] of [
    ["app", "item=book&qty=2&price=500"],
    ["curl", "item=book&qty=2&price=1"],
    ["curl", "item=book&qty=-3&price=500"],
  ]) {
    const trusted = await send(port, `/trust?${query}`);
    const checked = await send(port, `/checkout?${query}`);
    console.log(`${who.padEnd(6)} ${query.replace("item=book&", "").padEnd(22)} ${trusted.padEnd(20)} ${checked}`);
  }
  server.close();
});

use std::collections::HashMap;
use std::io::{BufRead, BufReader, Read, Write};
use std::net::{TcpListener, TcpStream};
use std::thread;

// The price lives on the server. The client never gets to decide it.
fn price_of(item: &str) -> Option<i64> {
    match item {
        "book" => Some(500),
        _ => None,
    }
}

// /trust believes whatever the client sent, price included.
fn trust(q: &HashMap<&str, &str>) -> (u16, String) {
    let qty: i64 = q.get("qty").and_then(|v| v.parse().ok()).unwrap_or(0);
    let price: i64 = q.get("price").and_then(|v| v.parse().ok()).unwrap_or(0);
    (200, format!("charged {}", qty * price))
}

// /checkout takes only what the user chose, and decides everything else itself.
fn checkout(q: &HashMap<&str, &str>) -> (u16, String) {
    let Some(price) = q.get("item").and_then(|i| price_of(i)) else {
        return (404, "no such item".into());
    };
    let qty: i64 = q.get("qty").and_then(|v| v.parse().ok()).unwrap_or(0);
    if !(1..=10).contains(&qty) {
        return (400, "qty must be 1 to 10".into());
    }
    (200, format!("charged {}", qty * price))
}

// Reads the request line ("GET /trust?qty=2 HTTP/1.1"), routes it, and answers.
fn handle(conn: TcpStream) {
    let mut reader = BufReader::new(&conn);
    let mut line = String::new();
    reader.read_line(&mut line).unwrap();
    let target = line.split_whitespace().nth(1).unwrap_or("/");
    let (path, query) = target.split_once('?').unwrap_or((target, ""));
    let q: HashMap<&str, &str> = query.split('&').filter_map(|kv| kv.split_once('=')).collect();
    let (status, body) = match path {
        "/trust" => trust(&q),
        "/checkout" => checkout(&q),
        _ => (404, "not found".into()),
    };
    let mut header = String::new();
    while reader.read_line(&mut header).unwrap_or(0) > 2 {
        header.clear(); // skip the headers: they end at the first empty line
    }
    let reason = match status {
        200 => "OK",
        400 => "Bad Request",
        _ => "Not Found",
    };
    let mut out = &conn;
    write!(out, "HTTP/1.1 {status} {reason}\r\nContent-Length: {}\r\nConnection: close\r\n\r\n{body}", body.len()).unwrap();
}

// Writes an HTTP request by hand, the way any program could, and returns "status body".
fn send(addr: &str, path: &str) -> String {
    let mut conn = TcpStream::connect(addr).unwrap();
    write!(conn, "GET {path} HTTP/1.1\r\nHost: shop\r\nConnection: close\r\n\r\n").unwrap();
    let mut reply = String::new();
    conn.read_to_string(&mut reply).unwrap();
    let (head, body) = reply.split_once("\r\n\r\n").unwrap(); // the headers end at the first empty line
    format!("{} {}", head.split_whitespace().nth(1).unwrap(), body.trim())
}

fn main() {
    let listener = TcpListener::bind("127.0.0.1:0").unwrap();
    let addr = listener.local_addr().unwrap().to_string();
    thread::spawn(move || {
        for conn in listener.incoming() {
            handle(conn.unwrap());
        }
    });

    println!("a book costs 500 taka; that price is stored on the server");
    println!("{:<6} {:<22} {:<20} /checkout", "sender", "asks for", "/trust");
    for (who, query) in [
        ("app", "item=book&qty=2&price=500"),
        ("curl", "item=book&qty=2&price=1"),
        ("curl", "item=book&qty=-3&price=500"),
    ] {
        let trusted = send(&addr, &format!("/trust?{query}"));
        let checked = send(&addr, &format!("/checkout?{query}"));
        println!("{:<6} {:<22} {:<20} {}", who, query.replace("item=book&", ""), trusted, checked);
    }
}

import socket, threading
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from urllib.parse import parse_qs, urlsplit

# The price lives on the server. The client never gets to decide it.
PRICES = {"book": 500}


def trust(q):
    """/trust believes whatever the client sent, price included."""
    return 200, f"charged {int(q['qty']) * int(q['price'])}"


def checkout(q):
    """/checkout takes only what the user chose, and decides everything else itself."""
    price = PRICES.get(q.get("item"))
    if price is None:
        return 404, "no such item"
    try:
        qty = int(q.get("qty", ""))
    except ValueError:
        qty = 0
    if not 1 <= qty <= 10:
        return 400, "qty must be 1 to 10"
    return 200, f"charged {qty * price}"


class Shop(BaseHTTPRequestHandler):
    def do_GET(self):
        url = urlsplit(self.path)
        q = {k: v[0] for k, v in parse_qs(url.query).items()}
        handler = {"/trust": trust, "/checkout": checkout}.get(url.path)
        status, body = handler(q) if handler else (404, "not found")
        self.send_response(status)
        self.send_header("Content-Length", str(len(body)))
        self.end_headers()
        self.wfile.write(body.encode())

    def log_message(self, *args):  # keep the output quiet
        pass


def send(port, path):
    """Writes an HTTP request by hand, the way any program could, and returns "status body"."""
    with socket.create_connection(("127.0.0.1", port)) as conn:
        conn.sendall(f"GET {path} HTTP/1.1\r\nHost: shop\r\nConnection: close\r\n\r\n".encode())
        reply = b""
        while chunk := conn.recv(4096):
            reply += chunk
    head, body = reply.decode().split("\r\n\r\n", 1)  # the headers end at the first empty line
    return f"{head.split()[1]} {body.strip()}"


server = ThreadingHTTPServer(("127.0.0.1", 0), Shop)
threading.Thread(target=server.serve_forever, daemon=True).start()
port = server.server_port

print("a book costs 500 taka; that price is stored on the server")
print(f"{'sender':<6} {'asks for':<22} {'/trust':<20} /checkout")
for who, query in [
    ("app", "item=book&qty=2&price=500"),
    ("curl", "item=book&qty=2&price=1"),
    ("curl", "item=book&qty=-3&price=500"),
]:
    trusted = send(port, f"/trust?{query}")
    checked = send(port, f"/checkout?{query}")
    print(f"{who:<6} {query.replace('item=book&', ''):<22} {trusted:<20} {checked}")

import com.sun.net.httpserver.HttpExchange;
import com.sun.net.httpserver.HttpServer;
import java.io.OutputStream;
import java.net.InetSocketAddress;
import java.net.Socket;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.Map;

public class Main {
    // The price lives on the server. The client never gets to decide it.
    static final Map<String, Integer> PRICES = Map.of("book", 500);

    record Reply(int status, String body) {}

    static Map<String, String> query(HttpExchange ex) {
        Map<String, String> q = new HashMap<>();
        String raw = ex.getRequestURI().getQuery();
        if (raw != null) for (String kv : raw.split("&")) {
            String[] p = kv.split("=", 2);
            if (p.length == 2) q.put(p[0], p[1]);
        }
        return q;
    }

    static int number(String s) {
        try { return Integer.parseInt(s); } catch (NumberFormatException e) { return 0; }
    }

    // /trust believes whatever the client sent, price included.
    static Reply trust(Map<String, String> q) {
        return new Reply(200, "charged " + number(q.get("qty")) * number(q.get("price")));
    }

    // /checkout takes only what the user chose, and decides everything else itself.
    static Reply checkout(Map<String, String> q) {
        Integer price = PRICES.get(q.get("item"));
        if (price == null) return new Reply(404, "no such item");
        int qty = number(q.get("qty"));
        if (qty < 1 || qty > 10) return new Reply(400, "qty must be 1 to 10");
        return new Reply(200, "charged " + qty * price);
    }

    static void route(HttpServer server, String path, java.util.function.Function<Map<String, String>, Reply> fn) {
        server.createContext(path, ex -> {
            Reply r = fn.apply(query(ex));
            byte[] body = r.body().getBytes(StandardCharsets.UTF_8);
            ex.sendResponseHeaders(r.status(), body.length);
            try (OutputStream out = ex.getResponseBody()) { out.write(body); }
        });
    }

    // Writes an HTTP request by hand, the way any program could, and returns "status body".
    static String send(int port, String path) throws Exception {
        try (Socket conn = new Socket("127.0.0.1", port)) {
            conn.getOutputStream().write(("GET " + path + " HTTP/1.1\r\nHost: shop\r\nConnection: close\r\n\r\n").getBytes());
            String reply = new String(conn.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
            String[] parts = reply.split("\r\n\r\n", 2); // the headers end at the first empty line
            return parts[0].split(" ")[1] + " " + parts[1].trim();
        }
    }

    public static void main(String[] args) throws Exception {
        HttpServer server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
        route(server, "/trust", Main::trust);
        route(server, "/checkout", Main::checkout);
        server.start();
        int port = server.getAddress().getPort();

        System.out.println("a book costs 500 taka; that price is stored on the server");
        System.out.printf("%-6s %-22s %-20s %s%n", "sender", "asks for", "/trust", "/checkout");
        String[][] calls = {
            {"app", "item=book&qty=2&price=500"},
            {"curl", "item=book&qty=2&price=1"},
            {"curl", "item=book&qty=-3&price=500"},
        };
        for (String[] c : calls) {
            String trusted = send(port, "/trust?" + c[1]);
            String checked = send(port, "/checkout?" + c[1]);
            System.out.printf("%-6s %-22s %-20s %s%n", c[0], c[1].replace("item=book&", ""), trusted, checked);
        }
        server.stop(0);
    }
}