refactor: Carry the gzip collaborators instead of plumbing their sizes

HandlerConfig now holds the RequestBodyReader and the ResponseRenderer
themselves rather than the two longs they are built from, and Builder
constructs both. Since HandlerConfig already reached every wiring
method, the extra parameters threaded through wireBindings, wireBinding
and wireExtras all go away, and with them both java:S107 suppressions —
the parameter counts were the signal that the numbers were at the wrong
altitude.

Also reuses ContentTypeHeader.parameter for the Accept-Encoding q weight
instead of hand-rolling a second parameter parser, replaces the capped
inflate loop with a single bounded readNBytes, and drops the gzipStream
alias for the JDK constructor it wrapped.

The five gzip files go 530 to 470 lines and OpenApiServer sheds 36.

Author: thced

src/main/java/com/retailsvc/http/OpenApiServer.java

@@ -66,8 +66,8 @@ record HandlerConfig(
       Map<String, RequestHandler> extras,
       boolean externalAuth,
       List<AfterResponseHook> afterHooks,
-      long maxDecompressedRequestBytes,
-      long minimumGzipResponseBytes) {}
+      RequestBodyReader bodyReader,
+      ResponseRenderer renderer) {}
 
   OpenApiServer(
       List<SpecBinding> bindings,
@@ -86,7 +86,6 @@ record HandlerConfig(
     requireNonNull(bodyMappers, "bodyMappers must not be null");
 
     long t0 = System.currentTimeMillis();
-    ExceptionHandler exceptionHandler = handlerConfig.exceptionHandler();
 
     InetSocketAddress socketAddress =
         (bindAddress == null)
@@ -95,26 +94,8 @@ record HandlerConfig(
     this.httpServer = createHttpServer(socketAddress, sslContext);
     httpServer.setExecutor(newThreadPerTaskExecutor(ofVirtual().name("http-", 0).factory()));
 
-    ResponseRenderer renderer =
-        new ResponseRenderer(bodyMappers, handlerConfig.minimumGzipResponseBytes());
-    RequestBodyReader bodyReader =
-        new RequestBodyReader(handlerConfig.maxDecompressedRequestBytes());
-    boolean anyBindingAtRoot =
-        wireBindings(
-            httpServer,
-            bindings,
-            bodyMappers,
-            handlerConfig,
-            exceptionHandler,
-            renderer,
-            bodyReader);
-    wireExtras(
-        httpServer,
-        anyBindingAtRoot,
-        handlerConfig.extras(),
-        exceptionHandler,
-        renderer,
-        bodyReader);
+    boolean anyBindingAtRoot = wireBindings(httpServer, bindings, bodyMappers, handlerConfig);
+    wireExtras(httpServer, anyBindingAtRoot, handlerConfig);
 
     httpServer.start();
     this.shutdownTimeoutSeconds = shutdownTimeoutSeconds;
@@ -131,42 +112,26 @@ private static HttpServer createHttpServer(InetSocketAddress addr, SSLContext ss
     return HttpServer.create(addr, 0);
   }
 
-  @SuppressWarnings("java:S107")
   private static boolean wireBindings(
       HttpServer httpServer,
       List<SpecBinding> bindings,
       Map<String, TypeMapper> bodyMappers,
-      HandlerConfig handlerConfig,
-      ExceptionHandler exceptionHandler,
-      ResponseRenderer renderer,
-      RequestBodyReader bodyReader) {
+      HandlerConfig handlerConfig) {
     boolean anyBindingAtRoot = false;
     for (SpecBinding binding : bindings) {
       String basePath = Optional.ofNullable(binding.spec().basePath()).orElse("/");
       anyBindingAtRoot |= "/".equals(basePath);
-      wireBinding(
-          httpServer,
-          basePath,
-          binding,
-          bodyMappers,
-          handlerConfig,
-          exceptionHandler,
-          renderer,
-          bodyReader);
+      wireBinding(httpServer, basePath, binding, bodyMappers, handlerConfig);
     }
     return anyBindingAtRoot;
   }
 
-  @SuppressWarnings("java:S107")
   private static void wireBinding(
       HttpServer httpServer,
       String basePath,
       SpecBinding binding,
       Map<String, TypeMapper> bodyMappers,
-      HandlerConfig handlerConfig,
-      ExceptionHandler exceptionHandler,
-      ResponseRenderer renderer,
-      RequestBodyReader bodyReader) {
+      HandlerConfig handlerConfig) {
     Map<String, Operation> operationsById =
         binding.spec().operations().stream()
             .collect(Collectors.toUnmodifiableMap(Operation::operationId, op -> op));
@@ -178,10 +143,10 @@ private static void wireBinding(
                 binding.router(),
                 binding.validator(),
                 bodyMappers,
-                exceptionHandler,
-                renderer,
+                handlerConfig.exceptionHandler(),
+                handlerConfig.renderer(),
                 handlerConfig.afterHooks(),
-                bodyReader));
+                handlerConfig.bodyReader()));
     ctx.getFilters()
         .add(
             new SecurityFilter(
@@ -195,26 +160,25 @@ private static void wireBinding(
             binding.handlers(),
             handlerConfig.interceptors(),
             handlerConfig.decorators(),
-            renderer));
+            handlerConfig.renderer()));
   }
 
   private static void wireExtras(
-      HttpServer httpServer,
-      boolean anyBindingAtRoot,
-      Map<String, RequestHandler> extras,
-      ExceptionHandler exceptionHandler,
-      ResponseRenderer renderer,
-      RequestBodyReader bodyReader) {
+      HttpServer httpServer, boolean anyBindingAtRoot, HandlerConfig handlerConfig) {
+    Map<String, RequestHandler> extras = handlerConfig.extras();
     if (anyBindingAtRoot) {
       if (!extras.isEmpty()) {
         throw new IllegalStateException(
             "extras cannot be registered when a binding owns basePath '/'");
       }
       return;
     }
-    ExtrasRouter extrasRouter = new ExtrasRouter(extras, renderer, bodyReader);
+    ExtrasRouter extrasRouter =
+        new ExtrasRouter(extras, handlerConfig.renderer(), handlerConfig.bodyReader());
     HttpContext extrasCtx = httpServer.createContext("/", extrasRouter);
-    extrasCtx.getFilters().add(new ExceptionFilter(exceptionHandler, renderer));
+    extrasCtx
+        .getFilters()
+        .add(new ExceptionFilter(handlerConfig.exceptionHandler(), handlerConfig.renderer()));
   }
 
   private void logStartup(long t0) {
@@ -510,8 +474,8 @@ public OpenApiServer build() throws IOException {
               extras,
               externalAuth,
               List.copyOf(afterHooks),
-              maxDecompressedRequestBytes,
-              minimumGzipResponseBytes);
+              new RequestBodyReader(maxDecompressedRequestBytes),
+              new ResponseRenderer(resolved, minimumGzipResponseBytes));
       int resolvedPort = resolvePort();
       SSLContext sslContext =
           httpsCertChain != null ? PemSslContext.load(httpsCertChain, httpsPrivateKey) : null;

src/main/java/com/retailsvc/http/internal/AcceptEncodingHeader.java

@@ -5,8 +5,6 @@
 /** Parses {@code Accept-Encoding} request header values (RFC 9110 §12.5.3). */
 public final class AcceptEncodingHeader {
 
-  private static final double DEFAULT_QUALITY = 1.0;
-
   private AcceptEncodingHeader() {}
 
   /**
@@ -22,14 +20,9 @@ public static boolean acceptsGzip(String header) {
     boolean gzipAccepted = false;
     boolean wildcardAccepted = false;
     for (String token : header.split(",")) {
-      String trimmed = token.trim();
-      if (trimmed.isEmpty()) {
-        continue;
-      }
-      int semi = trimmed.indexOf(';');
-      String coding =
-          (semi < 0 ? trimmed : trimmed.substring(0, semi)).trim().toLowerCase(Locale.ROOT);
-      boolean accepted = quality(semi < 0 ? null : trimmed.substring(semi + 1)) > 0;
+      int semi = token.indexOf(';');
+      String coding = (semi < 0 ? token : token.substring(0, semi)).trim().toLowerCase(Locale.ROOT);
+      boolean accepted = positiveWeight(token);
       if ("gzip".equals(coding) || "x-gzip".equals(coding)) {
         gzipSeen = true;
         gzipAccepted |= accepted;
@@ -41,28 +34,18 @@ public static boolean acceptsGzip(String header) {
   }
 
   /**
-   * Reads the {@code q} weight from a token's parameter list. An absent or unparsable weight is
-   * read as the default 1.0 — a malformed header should not silently disable compression.
+   * Whether the token's {@code q} weight admits the coding. An absent or unparsable weight reads as
+   * the default 1.0 — a malformed header should not silently disable compression.
    */
-  private static double quality(String parameters) {
-    if (parameters == null) {
-      return DEFAULT_QUALITY;
+  private static boolean positiveWeight(String token) {
+    String weight = ContentTypeHeader.parameter(token, "q").orElse(null);
+    if (weight == null) {
+      return true;
     }
-    for (String parameter : parameters.split(";")) {
-      String trimmed = parameter.trim();
-      int equals = trimmed.indexOf('=');
-      if (equals <= 0) {
-        continue;
-      }
-      String name = trimmed.substring(0, equals).trim().toLowerCase(Locale.ROOT);
-      if ("q".equals(name)) {
-        try {
-          return Double.parseDouble(trimmed.substring(equals + 1).trim());
-        } catch (NumberFormatException e) {
-          return DEFAULT_QUALITY;
-        }
-      }
+    try {
+      return Double.parseDouble(weight) > 0;
+    } catch (NumberFormatException _) {
+      return true;
     }
-    return DEFAULT_QUALITY;
   }
 }

src/main/java/com/retailsvc/http/internal/RequestBodyReader.java

@@ -8,7 +8,6 @@
 import com.sun.net.httpserver.Headers;
 import com.sun.net.httpserver.HttpExchange;
 import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.EOFException;
 import java.io.IOException;
 import java.util.function.UnaryOperator;
@@ -29,13 +28,15 @@ public final class RequestBodyReader {
   private static final int BUFFER_SIZE = 8192;
 
   private final long maxDecompressedBytes;
+  private final int readLimit;
 
   public RequestBodyReader(long maxDecompressedBytes) {
     if (maxDecompressedBytes <= 0) {
       throw new IllegalArgumentException(
           "maxDecompressedBytes must be positive, got " + maxDecompressedBytes);
     }
     this.maxDecompressedBytes = maxDecompressedBytes;
+    this.readLimit = (int) Math.min(maxDecompressedBytes, Integer.MAX_VALUE - 1) + 1;
   }
 
   /**
@@ -67,20 +68,13 @@ private byte[] inflate(byte[] raw) throws IOException {
       return raw;
     }
     try (GZIPInputStream in = new GZIPInputStream(new ByteArrayInputStream(raw), BUFFER_SIZE)) {
-      ByteArrayOutputStream out = new ByteArrayOutputStream();
-      byte[] buffer = new byte[BUFFER_SIZE];
-      long total = 0;
-      int read;
-      while ((read = in.read(buffer)) != -1) {
-        total += read;
-        if (total > maxDecompressedBytes) {
-          throw new BadRequestException(
-              HTTP_ENTITY_TOO_LARGE,
-              "decompressed request body exceeds " + maxDecompressedBytes + " bytes");
-        }
-        out.write(buffer, 0, read);
+      byte[] inflated = in.readNBytes(readLimit);
+      if (inflated.length > maxDecompressedBytes) {
+        throw new BadRequestException(
+            HTTP_ENTITY_TOO_LARGE,
+            "decompressed request body exceeds " + maxDecompressedBytes + " bytes");
       }
-      return out.toByteArray();
+      return inflated;
     } catch (ZipException | EOFException e) {
       throw new BadRequestException(HTTP_BAD_REQUEST, "malformed gzip request body", e);
     }

src/main/java/com/retailsvc/http/internal/ResponseCompression.java

@@ -2,7 +2,6 @@
 
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.OutputStream;
 import java.util.Set;
 import java.util.zip.GZIPOutputStream;
 
@@ -53,12 +52,4 @@ public static byte[] gzip(byte[] body) throws IOException {
     }
     return out.toByteArray();
   }
-
-  /**
-   * Wraps {@code out} so a streamed body is deflated as it is written. Closing the returned stream
-   * writes the gzip trailer and releases the deflater's native memory, so the caller must close it.
-   */
-  public static OutputStream gzipStream(OutputStream out) throws IOException {
-    return new GZIPOutputStream(out);
-  }
 }

src/main/java/com/retailsvc/http/internal/ResponseRenderer.java

@@ -14,6 +14,7 @@
 import java.io.OutputStream;
 import java.util.Locale;
 import java.util.Map;
+import java.util.zip.GZIPOutputStream;
 
 /** Writes a {@link Response} to an {@link HttpExchange}. */
 public final class ResponseRenderer {
@@ -65,9 +66,7 @@ public void render(HttpExchange exchange, Response response) throws IOException
    */
   private void renderEmpty(HttpExchange exchange, Headers headers, int status, String contentType)
       throws IOException {
-    if (contentType != null && !headers.containsKey(CONTENT_TYPE)) {
-      headers.add(CONTENT_TYPE, contentType);
-    }
+    defaultContentType(headers, contentType);
     long declared = declaredLength(headers);
     if (shouldCompress(exchange, headers, status, contentType, declared) && declared >= 0) {
       headers.remove(CONTENT_LENGTH);
@@ -78,24 +77,26 @@ private void renderEmpty(HttpExchange exchange, Headers headers, int status, Str
   private void renderStream(
       HttpExchange exchange, Headers headers, int status, String contentType, BodyWriter writer)
       throws IOException {
-    if (contentType != null && !headers.containsKey(CONTENT_TYPE)) {
-      headers.add(CONTENT_TYPE, contentType);
-    }
+    defaultContentType(headers, contentType);
     long declared = writer instanceof BodyWriter.Sized sized ? sized.length() : UNKNOWN_LENGTH;
-    if (shouldCompress(exchange, headers, status, contentType, declared)) {
+    boolean gzip = shouldCompress(exchange, headers, status, contentType, declared);
+    if (gzip) {
       headers.set(CONTENT_ENCODING, GZIP);
-      exchange.sendResponseHeaders(status, CHUNKED);
-      try (OutputStream out = ResponseCompression.gzipStream(exchange.getResponseBody())) {
-        writer.writeTo(out);
-      }
-      return;
     }
-    exchange.sendResponseHeaders(status, Math.max(declared, CHUNKED));
-    try (OutputStream out = exchange.getResponseBody()) {
+    exchange.sendResponseHeaders(status, gzip ? CHUNKED : Math.max(declared, CHUNKED));
+    try (OutputStream out =
+        gzip ? new GZIPOutputStream(exchange.getResponseBody()) : exchange.getResponseBody()) {
       writer.writeTo(out);
     }
   }
 
+  /** Adds the response's own content type unless the handler already set one. */
+  private static void defaultContentType(Headers headers, String contentType) {
+    if (contentType != null && !headers.containsKey(CONTENT_TYPE)) {
+      headers.add(CONTENT_TYPE, contentType);
+    }
+  }
+
   /**
    * Whether a body of {@code length} bytes should be gzipped, marking the response as varying by
    * {@code Accept-Encoding} whenever it could have been. A negative length means unknown, which
@@ -120,7 +121,7 @@ private static long declaredLength(Headers headers) {
     }
     try {
       return Long.parseLong(declared.trim());
-    } catch (NumberFormatException e) {
+    } catch (NumberFormatException _) {
       return UNKNOWN_LENGTH;
     }
   }
@@ -137,9 +138,7 @@ private void renderBytes(
       effectiveContentType = contentType != null ? contentType : DEFAULT_JSON;
       bytes = serialize(body, effectiveContentType);
     }
-    if (!headers.containsKey(CONTENT_TYPE)) {
-      headers.add(CONTENT_TYPE, effectiveContentType);
-    }
+    defaultContentType(headers, effectiveContentType);
     byte[] payload = maybeCompress(exchange, headers, status, effectiveContentType, bytes);
     exchange.sendResponseHeaders(status, payload.length == 0 ? -1 : payload.length);
     if (payload.length > 0) {

src/test/java/com/retailsvc/http/internal/ResponseCompressionTest.java

@@ -4,9 +4,7 @@
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.OutputStream;
 import java.util.zip.GZIPInputStream;
 import org.junit.jupiter.api.Test;
 
@@ -74,18 +72,6 @@ void gzipRoundTripsBytes() throws IOException {
     assertThat(gunzip(compressed)).isEqualTo(plain);
   }
 
-  @Test
-  void gzipStreamRoundTripsBytes() throws IOException {
-    byte[] plain = "stream me".repeat(20).getBytes(UTF_8);
-    ByteArrayOutputStream sink = new ByteArrayOutputStream();
-
-    try (OutputStream out = ResponseCompression.gzipStream(sink)) {
-      out.write(plain);
-    }
-
-    assertThat(gunzip(sink.toByteArray())).isEqualTo(plain);
-  }
-
   private static byte[] gunzip(byte[] data) throws IOException {
     try (GZIPInputStream in = new GZIPInputStream(new ByteArrayInputStream(data))) {
       return in.readAllBytes();