From 64a9fde2043ca319315443213ffa6dd5e997ad7f Mon Sep 17 00:00:00 2001
From: k2safe <k2safe@icloud.com>
Date: Tue, 22 Sep 2026 23:43:34 +0800
Subject: [PATCH] test: verify HTTP2 proxy negotiation

---
 scripts/verifyProxy.py | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/scripts/verifyProxy.py b/scripts/verifyProxy.py
index 76cd3ef..3181e57 100644
--- a/scripts/verifyProxy.py
+++ b/scripts/verifyProxy.py
@@ -73,6 +73,7 @@ http {{
 
     server {{
         listen 127.0.0.1:{edge_port} ssl;
+        http2 on;
         ssl_certificate /etc/nginx/certs/cert.pem;
         ssl_certificate_key /etc/nginx/certs/key.pem;
 
@@ -146,6 +147,28 @@ def wait_for_proxy(edge_port: int, timeout: float) -> None:
     raise RuntimeError(f"Nginx proxy did not become healthy: {last_error}")
 
 
+def verify_http2(edge_port: int) -> None:
+    expected = b'{"code":"OK","message":"success","data":{"status":"ok"},"requestId":"proxyCheck"}\n'
+    result = subprocess.run(
+        [
+            "curl", "--silent", "--show-error", "--fail", "--http2", "--insecure",
+            "-H", "X-Request-ID: proxyCheck", "-w", "\\n%{http_version}",
+            f"https://127.0.0.1:{edge_port}/health",
+        ],
+        capture_output=True,
+        check=False,
+    )
+    if result.returncode != 0:
+        raise AssertionError(f"HTTP/2 curl failed: {result.stderr.decode(errors='replace')}")
+    output = result.stdout
+    try:
+        body, version = output.rsplit(b"\n", 1)
+    except ValueError as error:
+        raise AssertionError(f"HTTP/2 curl output missing protocol version: {output!r}") from error
+    if version != b"2" or body != expected:
+        raise AssertionError(f"expected HTTP/2 response, got version={version!r} body={body!r}")
+
+
 def verify_timeout(edge_port: int) -> None:
     context = ssl._create_unverified_context()
     connection = http.client.HTTPSConnection("127.0.0.1", edge_port, context=context, timeout=3)
@@ -166,6 +189,8 @@ def main() -> None:
         raise SystemExit("docker is required for proxy verification")
     if shutil.which("openssl") is None:
         raise SystemExit("openssl is required for proxy verification")
+    if shutil.which("curl") is None:
+        raise SystemExit("curl with HTTP/2 support is required for proxy verification")
     if not Path("/proc").exists():
         raise SystemExit("proxy verification must run on Linux")
 
@@ -231,6 +256,8 @@ def main() -> None:
                 raise RuntimeError(
                     f"{error}; nginx logs={nginx_logs!r}; backend logs={backend_logs!r}"
                 ) from error
+            verify_http2(edge_port)
+            print("PASS Nginx HTTP/2 edge negotiation and HTTP/1.1 native backhaul", flush=True)
             verify_keep_alive(edge_port)
             verify_timeout(edge_port)
             print("PASS Nginx TLS proxy, Keep-Alive and upstream timeout", flush=True)