TASK-021: http_resource allow-mask via method_set

Replace std::map<std::string, bool> method_state with a 32-bit
method_set bitmask. Public API now takes http_method enum values
instead of strings; is_allowed and get_allowed_methods are const
noexcept; sizeof(http_resource) collapses to vptr + uint32_t + padding.

The wire-string-to-enum decode happens once at the dispatch boundary
(webserver_impl::answer_to_connection) and the result is cached on
modded_request::method_enum so finalize_answer can ask is_allowed
without a per-request strcmp loop. Allow-header serialization moves
to enum-declaration order; the only in-tree assertion ("HEAD, POST")
is preserved by coincidence of head=1, post=2.

In-tree string callers (test/integ/basic.cpp, test/integ/ws_start_stop.cpp,
examples/allowing_disallowing_methods.cpp, examples/custom_error.cpp)
migrated to the typed API. resource_init and the std::map data member
are gone; http_resource.hpp drops <map>/<string>/<vector>/<utility>/
<iostream>, leaving only <memory> and httpserver/http_method.hpp.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: etr

examples/allowing_disallowing_methods.cpp

@@ -34,7 +34,7 @@ int main() {
 
     hello_world_resource hwr;
     hwr.disallow_all();
-    hwr.set_allowing("GET", true);
+    hwr.set_allowing(httpserver::http_method::get, true);
     ws.register_resource("/hello", &hwr);
     ws.start(true);
 

examples/custom_error.cpp

@@ -44,7 +44,7 @@ int main() {
 
     hello_world_resource hwr;
     hwr.disallow_all();
-    hwr.set_allowing("GET", true);
+    hwr.set_allowing(httpserver::http_method::get, true);
     ws.register_resource("/hello", &hwr);
     ws.start(true);
 

specs/tasks/M4-handlers/TASK-021.md

@@ -8,12 +8,12 @@
 Replace `http_resource`'s `std::map<std::string, bool> method_state` with a `method_set` bitmask, shrink `sizeof(http_resource)`, and make `is_allowed`/`get_allowed_methods` const.
 
 **Action Items:**
-- [ ] Replace `std::map<std::string, bool> method_state` with `method_set methods_allowed_;` member.
-- [ ] `bool is_allowed(http_method m) const noexcept` returns `methods_allowed_.contains(m)`.
-- [ ] `method_set get_allowed_methods() const noexcept` returns `methods_allowed_` by value.
-- [ ] `void set_allowing(http_method m, bool allow) noexcept` (mutator stays non-const).
-- [ ] `void allow_all() noexcept;` `void disallow_all() noexcept;`
-- [ ] Convert internal v1 callers that passed method names as strings to use `http_method` enum values; provide a string→enum helper if existing user-facing setters need to keep their string form.
+- [x] Replace `std::map<std::string, bool> method_state` with `method_set methods_allowed_;` member.
+- [x] `bool is_allowed(http_method m) const noexcept` returns `methods_allowed_.contains(m)`.
+- [x] `method_set get_allowed_methods() const noexcept` returns `methods_allowed_` by value.
+- [x] `void set_allowing(http_method m, bool allow) noexcept` (mutator stays non-const).
+- [x] `void allow_all() noexcept;` `void disallow_all() noexcept;`
+- [x] Convert internal v1 callers that passed method names as strings to use `http_method` enum values. The string-based public API (`set_allowing(const std::string&, bool)` / `is_allowed(const std::string&)` / vector-returning `get_allowed_methods()`) was removed outright on this branch (Decision 1 in plan). The wire-string-to-enum decode happens once at `webserver_impl::answer_to_connection` and the result is recorded on `modded_request::method_enum`; no public string-to-enum helper is shipped.
 
 **Dependencies:**
 - Blocked by: TASK-005
@@ -29,4 +29,4 @@ Replace `http_resource`'s `std::map<std::string, bool> method_state` with a `met
 **Related Requirements:** PRD-REQ-REQ-002, PRD-REQ-REQ-003
 **Related Decisions:** DR-006, §4.4
 
-**Status:** Not Started
+**Status:** Done

specs/tasks/_index.md

@@ -103,7 +103,7 @@ Nominally: **13 sequential tasks**, each S–XL. Most other tasks parallelize of
 | TASK-018 | `http_request` single-key getters return `string_view`, all const | M3 | Done | TASK-015, TASK-016 |
 | TASK-019 | High-level GnuTLS accessors replacing `gnutls_session_t` | M3 | Done | TASK-015 |
 | TASK-020 | Final public-header backend-include sweep | M3 | Done | TASK-014, TASK-015, TASK-019 |
-| TASK-021 | `http_resource` allow-mask via `method_set` | M4 | Not Started | TASK-005 |
+| TASK-021 | `http_resource` allow-mask via `method_set` | M4 | Done | TASK-005 |
 | TASK-022 | Snake_case `render_*` overrides on `http_resource` | M4 | Not Started | TASK-021 |
 | TASK-023 | Smart-pointer `register_resource` overloads | M4 | Not Started | TASK-014 |
 | TASK-024 | `register_path` and `register_prefix` (replace `bool family`) | M4 | Not Started | TASK-023 |

src/http_resource.cpp

@@ -19,28 +19,13 @@
 */
 
 #include "httpserver/http_resource.hpp"
-#include <microhttpd.h>
-#include <iosfwd>
-#include <map>
+
 #include <memory>
-#include <string>
+
 #include "httpserver/http_response.hpp"
 
 namespace httpserver {
 
-// RESOURCE
-void resource_init(std::map<std::string, bool>* method_state) {
-    (*method_state)[MHD_HTTP_METHOD_GET] = true;
-    (*method_state)[MHD_HTTP_METHOD_POST] = true;
-    (*method_state)[MHD_HTTP_METHOD_PUT] = true;
-    (*method_state)[MHD_HTTP_METHOD_HEAD] = true;
-    (*method_state)[MHD_HTTP_METHOD_DELETE] = true;
-    (*method_state)[MHD_HTTP_METHOD_TRACE] = true;
-    (*method_state)[MHD_HTTP_METHOD_CONNECT] = true;
-    (*method_state)[MHD_HTTP_METHOD_OPTIONS] = true;
-    (*method_state)[MHD_HTTP_METHOD_PATCH] = true;
-}
-
 namespace detail {
 
 std::shared_ptr<http_response> empty_render(const http_request&) {

src/httpserver/detail/modded_request.hpp

@@ -31,6 +31,7 @@
 #include <memory>
 #include <fstream>
 
+#include "httpserver/http_method.hpp"
 #include "httpserver/http_request.hpp"
 
 namespace httpserver {
@@ -45,6 +46,14 @@ struct modded_request {
 
     std::shared_ptr<http_response> (httpserver::http_resource::*callback)(const httpserver::http_request&);
 
+    // TASK-021: enum form of the wire method, decoded once at the
+    // dispatch boundary in webserver_impl::answer_to_connection. Used
+    // by finalize_answer to ask http_resource::is_allowed without a
+    // per-request string compare. Defaults to count_ — a sentinel
+    // outside the valid_method_mask, so is_allowed returns false for
+    // unrecognized verbs (the 405 path).
+    httpserver::http_method method_enum = httpserver::http_method::count_;
+
     std::unique_ptr<http_request> dhr = nullptr;
     std::shared_ptr<http_response> dhrs;
     bool has_body = false;

src/httpserver/detail/webserver_impl.hpp

@@ -235,8 +235,10 @@ class webserver_impl {
     MHD_Result requests_answer_second_step(MHD_Connection* connection,
             const char* method, const char* version, const char* upload_data,
             size_t* upload_data_size, modded_request* mr);
-    MHD_Result finalize_answer(MHD_Connection* connection, modded_request* mr,
-                               const char* method);
+    // TASK-021: the wire-string `method` parameter was dropped because
+    // finalize_answer now consults mr->method_enum (set once by
+    // answer_to_connection) for the is_allowed check.
+    MHD_Result finalize_answer(MHD_Connection* connection, modded_request* mr);
     MHD_Result complete_request(MHD_Connection* connection, modded_request* mr,
                                 const char* version, const char* method);
     struct MHD_Response* get_raw_response_with_fallback(modded_request* mr);

src/httpserver/http_resource.hpp

@@ -25,15 +25,9 @@
 #ifndef SRC_HTTPSERVER_HTTP_RESOURCE_HPP_
 #define SRC_HTTPSERVER_HTTP_RESOURCE_HPP_
 
-#ifdef DEBUG
-#include <iostream>
-#endif
-
-#include <map>
 #include <memory>
-#include <string>
-#include <utility>
-#include <vector>
+
+#include "httpserver/http_method.hpp"
 
 namespace httpserver { class http_request; }
 namespace httpserver { class http_response; }
@@ -44,8 +38,6 @@ namespace httpserver {
 
 namespace detail { std::shared_ptr<http_response> empty_render(const http_request& r); }
 
-void resource_init(std::map<std::string, bool>* res);
-
 /**
  * Class representing a callable http resource.
 **/
@@ -147,81 +139,62 @@ class http_resource {
      }
 
      /**
-      * Method used to set if a specific method is allowed or not on this request
-      * @param method method to set permission on
-      * @param allowed boolean indicating if the method is allowed or not
+      * Toggle whether a specific http_method is allowed on this resource.
+      * @param method enum identifying the method (no string lookup)
+      * @param allow true to enable the method, false to disable it
      **/
-     void set_allowing(const std::string& method, bool allowed) {
-         if (method_state.count(method)) {
-             method_state[method] = allowed;
+     void set_allowing(http_method method, bool allow) noexcept {
+         if (allow) {
+             methods_allowed_.set(method);
+         } else {
+             methods_allowed_.clear(method);
          }
      }
 
      /**
-      * Method used to implicitly allow all methods
+      * Allow every defined http_method on this resource.
      **/
-     void allow_all() {
-         std::map<std::string, bool>::iterator it;
-         for (it=method_state.begin(); it != method_state.end(); ++it) {
-             method_state[(*it).first] = true;
-         }
+     void allow_all() noexcept {
+         methods_allowed_.set_all();
      }
 
      /**
-      * Method used to implicitly disallow all methods
+      * Disallow every http_method on this resource.
      **/
-     void disallow_all() {
-         std::map<std::string, bool>::iterator it;
-         for (it=method_state.begin(); it != method_state.end(); ++it) {
-             method_state[(*it).first] = false;
-         }
+     void disallow_all() noexcept {
+         methods_allowed_.clear_all();
      }
 
      /**
-      * Method used to discover if an http method is allowed or not for this resource
-      * @param method Method to discover allowings
-      * @return true if the method is allowed
+      * Test whether `method` is allowed on this resource. Const-noexcept
+      * because the answer is a single bitmask test on a trivial member;
+      * no string lookup, no allocation.
+      * @param method enum identifying the method to query
+      * @return true if the method is currently allowed
      **/
-     bool is_allowed(const std::string& method) {
-         if (method_state.count(method)) {
-             return method_state[method];
-         } else {
-#ifdef DEBUG
-             std::map<std::string, bool>::iterator it;
-             for (it = method_state.begin(); it != method_state.end(); ++it) {
-                 std::cout << (*it).first << " -> " << (*it).second << std::endl;
-             }
-#endif  // DEBUG
-             return false;
-         }
+     bool is_allowed(http_method method) const noexcept {
+         return methods_allowed_.contains(method);
      }
 
      /**
-      * Method used to return a list of currently allowed HTTP methods for this resource
-      * @return vector of strings
+      * Return the full allow-mask by value. The returned method_set is
+      * trivially copyable (sizeof == 4) so by-value is the natural ABI.
      **/
-     std::vector<std::string> get_allowed_methods() {
-         std::vector<std::string> allowed_methods;
-
-         for (auto it = method_state.cbegin(); it != method_state.cend(); ++it) {
-             if ( (*it).second ) {
-                 allowed_methods.push_back((*it).first);
-             }
-         }
-
-         return allowed_methods;
+     method_set get_allowed_methods() const noexcept {
+         return methods_allowed_;
      }
 
  protected:
      /**
-      * Constructor of the class
+      * Constructor of the class. The default state allows every defined
+      * http_method, matching the v1 behaviour where `resource_init`
+      * marked all nine methods true.
      **/
-     http_resource() {
-         resource_init(&method_state);
-     }
+     http_resource() = default;
 
      /**
-      * Copy constructor
+      * Copy / move special members are trivial — the only data member
+      * is method_set (a 32-bit aggregate).
      **/
      http_resource(const http_resource& b) = default;
      http_resource(http_resource&& b) noexcept = default;
@@ -231,9 +204,19 @@ class http_resource {
  private:
      friend class webserver;
      friend class detail::webserver_impl;  // TASK-014: dispatch helpers
-     friend void resource_init(std::map<std::string, bool>* res);
-     std::map<std::string, bool> method_state;
+
+     // Default-allow every valid method. method_set::set_all() is
+     // constexpr, so the chained call is a constant expression and the
+     // default member initialiser stays well-formed.
+     method_set methods_allowed_ = method_set{}.set_all();
 };
 
+// TASK-021 acceptance: http_resource is now a vptr plus a 32-bit
+// method_set plus padding. The cap below leaves headroom for one
+// future small member (e.g. an arena tag) without re-invalidating
+// PRD-REQ-REQ-002 / PRD-REQ-REQ-003.
+static_assert(sizeof(http_resource) <= sizeof(void*) + sizeof(method_set) * 2,
+              "http_resource should be approximately vptr + method_set");
+
 }  // namespace httpserver
 #endif  // SRC_HTTPSERVER_HTTP_RESOURCE_HPP_

src/webserver.cpp

@@ -1329,7 +1329,7 @@ struct MHD_Response* webserver_impl::get_raw_response_with_fallback(detail::modd
     }
 }
 
-MHD_Result webserver_impl::finalize_answer(MHD_Connection* connection, struct detail::modded_request* mr, const char* method) {
+MHD_Result webserver_impl::finalize_answer(MHD_Connection* connection, struct detail::modded_request* mr) {
     int to_ret = MHD_NO;
 
 #ifdef HAVE_WEBSOCKET
@@ -1501,20 +1501,30 @@ MHD_Result webserver_impl::finalize_answer(MHD_Connection* connection, struct de
                 MHD_destroy_post_processor(mr->pp);
                 mr->pp = nullptr;
             }
-            if (hrm->is_allowed(method)) {
+            if (hrm->is_allowed(mr->method_enum)) {
                 mr->dhrs = ((hrm)->*(mr->callback))(*mr->dhr);  // copy in memory (move in case)
                 if (mr->dhrs.get() == nullptr || mr->dhrs->get_status() == -1) {
                     mr->dhrs = internal_error_page(mr);
                 }
             } else {
                 mr->dhrs = method_not_allowed_page(mr);
 
-                vector<string> allowed_methods = hrm->get_allowed_methods();
-                if (allowed_methods.size() > 0) {
-                    string header_value = allowed_methods[0];
-                    for (auto it = allowed_methods.cbegin() + 1; it != allowed_methods.cend(); ++it) {
-                        header_value += ", " + (*it);
+                // TASK-021: serialize the allow-mask in enum-declaration
+                // order (GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS,
+                // TRACE, PATCH). v1 used std::map iteration order
+                // (alphabetical); the only existing assertion in-tree is
+                // "HEAD, POST" which is preserved by enum order.
+                method_set allowed = hrm->get_allowed_methods();
+                string header_value;
+                for (std::uint8_t i = 0;
+                     i < static_cast<std::uint8_t>(http_method::count_); ++i) {
+                    auto m = static_cast<http_method>(i);
+                    if (allowed.contains(m)) {
+                        if (!header_value.empty()) header_value += ", ";
+                        header_value += std::string(to_string(m));
                     }
+                }
+                if (!header_value.empty()) {
                     mr->dhrs->with_header(http_utils::http_header_allow, header_value);
                 }
             }
@@ -1550,7 +1560,7 @@ MHD_Result webserver_impl::complete_request(MHD_Connection* connection, struct d
     mr->dhr->set_method(method);
     mr->dhr->set_version(version);
 
-    return finalize_answer(connection, mr, method);
+    return finalize_answer(connection, mr);
 }
 
 MHD_Result webserver_impl::answer_to_connection(void* cls, MHD_Connection* connection, const char* url, const char* method,
@@ -1579,29 +1589,44 @@ MHD_Result webserver_impl::answer_to_connection(void* cls, MHD_Connection* conne
     webserver_impl::access_log(impl->parent, mr->complete_uri + " METHOD: " + method);
 
     // Case-sensitive per RFC 7230 §3.1.1: HTTP method is case-sensitive.
+    // TASK-021: also record the enum form once so finalize_answer can
+    // call hrm->is_allowed without re-scanning the wire string.
     if (0 == strcmp(method, http_utils::http_method_get)) {
         mr->callback = &http_resource::render_GET;
+        mr->method_enum = http_method::get;
     } else if (0 == strcmp(method, http_utils::http_method_post)) {
         mr->callback = &http_resource::render_POST;
+        mr->method_enum = http_method::post;
         mr->has_body = true;
     } else if (0 == strcmp(method, http_utils::http_method_put)) {
         mr->callback = &http_resource::render_PUT;
+        mr->method_enum = http_method::put;
         mr->has_body = true;
     } else if (0 == strcmp(method, http_utils::http_method_delete)) {
         mr->callback = &http_resource::render_DELETE;
+        mr->method_enum = http_method::del;
         mr->has_body = true;
     } else if (0 == strcmp(method, http_utils::http_method_patch)) {
         mr->callback = &http_resource::render_PATCH;
+        mr->method_enum = http_method::patch;
         mr->has_body = true;
     } else if (0 == strcmp(method, http_utils::http_method_head)) {
         mr->callback = &http_resource::render_HEAD;
+        mr->method_enum = http_method::head;
     } else if (0 == strcmp(method, http_utils::http_method_connect)) {
         mr->callback = &http_resource::render_CONNECT;
+        mr->method_enum = http_method::connect;
     } else if (0 == strcmp(method, http_utils::http_method_trace)) {
         mr->callback = &http_resource::render_TRACE;
+        mr->method_enum = http_method::trace;
     } else if (0 == strcmp(method, http_utils::http_method_options)) {
         mr->callback = &http_resource::render_OPTIONS;
+        mr->method_enum = http_method::options;
     }
+    // Else: mr->method_enum stays at the default (count_), so
+    // is_allowed(count_) returns false and the request takes the 405
+    // path. Pre-existing latent bug: mr->callback may also be left
+    // un-set here; see TASK-027 for the dispatch redesign.
 
     return impl->requests_answer_first_step(connection, mr);
 }