*
 * ## Warning: Certificate Pinning is Dangerous!
 *
 * Pinning certificates limits your server team's abilities to update their TLS certificates. By
 * pinning certificates, you take on additional operational complexity and limit your ability to
 * migrate between certificate authorities. Do not use certificate pinning without the blessing of
 * your server's TLS administrator!
 *
 * ### Note about self-signed certificates
 *

    val address = factory.newAddress()
    proxySelector.proxies.add(Proxy.NO_PROXY)
    val routeSelector = newRouteSelector(address)
    proxySelector.assertRequests(address.url.toUri())

    // Only the origin server will be attempted.
    assertThat(routeSelector.hasNext()).isTrue()
    dns[uriHost] = dns.allocate(1)
    val selection = routeSelector.next()

 * is used to verify the signature of the "www.squareup.com" certificate.
 *
 * This roles are reversed for client authentication. In that case the client has a private key and
 * a chain of certificates. The server uses a set of trusted root certificates to authenticate the
 * client. Subject alternative names are not used for client authentication.
 */
@Suppress("DEPRECATION")
class HeldCertificate(

      override fun matches(header: DerHeader): Boolean = true

      override fun fromDer(reader: DerReader): AnyValue {
        reader.read("ANY") { header ->
          val bytes = reader.readUnknown()
          return AnyValue(
            tagClass = header.tagClass,
            tag = header.tag,
            constructed = header.constructed,
            length = header.length,
            bytes = bytes,

    object : DerAdapter<Long> {
      override fun matches(header: DerHeader): Boolean {
        return Adapters.UTC_TIME.matches(header) || Adapters.GENERALIZED_TIME.matches(header)
      }

      override fun fromDer(reader: DerReader): Long {
        val peekHeader =
          reader.peekHeader()
            ?: throw ProtocolException("expected time but was exhausted at $reader")

        return when {

 */
class Http2Reader(
  /** Creates a frame reader with max header table size of 4096. */
  private val source: BufferedSource,
  private val client: Boolean,
) : Closeable {
  private val continuation: ContinuationSource = ContinuationSource(this.source)
  private val hpackReader: Hpack.Reader =
    Hpack.Reader(
      source = continuation,
      headerTableSizeSetting = 4096,
    )

   *
   * Otherwise if the response has a `Content-Type` header that specifies a charset, that is used
   * to determine the charset of the response bytes.
   *
   * Otherwise the response bytes are decoded as UTF-8.
   */
  fun charStream(): Reader =
    reader ?: BomAwareReader(source(), charset()).also {
      reader = it
    }

  /**
   * Returns the response as a string.
   *

        "custom-foo",
        "custom-header",
        "custom-bar",
        "custom-header",
        "custom-baz",
        "custom-header",
      )
    bytesIn.writeByte(0x40) // Literal indexed
    bytesIn.writeByte(0x0a) // Literal name (len = 10)
    bytesIn.writeUtf8("custom-foo")
    bytesIn.writeByte(0x0d) // Literal value (len = 13)
    bytesIn.writeUtf8("custom-header")
    bytesIn.writeByte(0x40) // Literal indexed

  val clientTestRule = OkHttpClientTestRule()
  private lateinit var server: MockWebServer
  private var client = clientTestRule.newClient()
  private val callback = RecordingCallback()

  @BeforeEach
  fun setUp(server: MockWebServer) {
    this.server = server
  }

  @Test
  fun applicationInterceptorsCanShortCircuitResponses() {
    server.shutdown() // Accept no connections.
    val request =
      Request.Builder()

    open fun url(url: URL) = url(url.toString().toHttpUrl())

    /**
     * Sets the header named [name] to [value]. If this request already has any headers
     * with that name, they are all replaced.
     */
    open fun header(
      name: String,
      value: String,
    ) = commonHeader(name, value)

    /**
     * Adds a header with [name] and [value]. Prefer this method for multiply-valued
     * headers like "Cookie".