refactor: consolidate the ~65-field webserver config into one struct

The full builder configuration previously existed as ~65 parallel data
members duplicated across three places: the create_webserver builder's
_x fields, an identical const-member block on webserver, and a ~77-line
member-initialiser copy in webserver.cpp. Adding one option meant editing
4+ sites.

Introduce `struct webserver_config` (in create_webserver.hpp) holding
every builder input. The builder owns one and its setters mutate it; the
webserver constructor copies it wholesale (`config(params._config)`).
Adding an option is now one struct field + one builder setter.

Mechanical consequences:
  - create_webserver setters: _field -> _config.field.
  - webserver: ~65 const members -> `const webserver_config config;`
    plus the one derived member (auth_skip_paths_normalized), which is
    computed at construction and so stays separate.
  - webserver.cpp ctor: 77-line init list -> config copy + derived field.
  - all read sites: parent->field / ws->field / dws->field ->
    ...->config.field; webserver's own methods: bare field -> config.field.
  - create_webserver::basic_auth_default / digest_auth_default statics ->
    detail::default_basic_auth_enabled / default_digest_auth_enabled free
    functions (needed before create_webserver is defined).

Net -115 lines. No behavior change: build green, full suite 109/109.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: etr

src/create_webserver.cpp

@@ -43,19 +43,19 @@ namespace httpserver {
 // initializer in the header) so the public header carries no
 // #ifdef HAVE_BAUTH. The library was compiled with the right
 // HAVE_BAUTH state; the consumer TU's HAVE_BAUTH is irrelevant.
-bool create_webserver::basic_auth_default() noexcept {
+bool detail::default_basic_auth_enabled() noexcept {
 #ifdef HAVE_BAUTH
     return true;
 #else
     return false;
 #endif
 }
 
-// Same pattern as basic_auth_default(). Returns true
+// Same pattern as default_basic_auth_enabled(). Returns true
 // on HAVE_DAUTH-on builds (preserving historical behaviour) and false
 // on HAVE_DAUTH-off builds so an unmodified builder doesn't trip the
 // feature_unavailable guard in webserver::webserver().
-bool create_webserver::digest_auth_default() noexcept {
+bool detail::default_digest_auth_enabled() noexcept {
 #ifdef HAVE_DAUTH
     return true;
 #else
@@ -64,25 +64,25 @@ bool create_webserver::digest_auth_default() noexcept {
 }
 
 create_webserver& create_webserver::bind_address(const std::string& ip) {
-    _bind_address_storage = std::make_shared<struct sockaddr_storage>();
-    std::memset(_bind_address_storage.get(), 0, sizeof(struct sockaddr_storage));
+    _config.bind_address_storage = std::make_shared<struct sockaddr_storage>();
+    std::memset(_config.bind_address_storage.get(), 0, sizeof(struct sockaddr_storage));
 
     // Try IPv4 first
-    auto* addr4 = reinterpret_cast<struct sockaddr_in*>(_bind_address_storage.get());
+    auto* addr4 = reinterpret_cast<struct sockaddr_in*>(_config.bind_address_storage.get());
     if (inet_pton(AF_INET, ip.c_str(), &(addr4->sin_addr)) == 1) {
         addr4->sin_family = AF_INET;
-        addr4->sin_port = htons(_port);
-        _bind_address = reinterpret_cast<const struct sockaddr*>(_bind_address_storage.get());
+        addr4->sin_port = htons(_config.port);
+        _config.bind_address = reinterpret_cast<const struct sockaddr*>(_config.bind_address_storage.get());
         return *this;
     }
 
     // Try IPv6
-    auto* addr6 = reinterpret_cast<struct sockaddr_in6*>(_bind_address_storage.get());
+    auto* addr6 = reinterpret_cast<struct sockaddr_in6*>(_config.bind_address_storage.get());
     if (inet_pton(AF_INET6, ip.c_str(), &(addr6->sin6_addr)) == 1) {
         addr6->sin6_family = AF_INET6;
-        addr6->sin6_port = htons(_port);
-        _bind_address = reinterpret_cast<const struct sockaddr*>(_bind_address_storage.get());
-        _use_ipv6 = true;
+        addr6->sin6_port = htons(_config.port);
+        _config.bind_address = reinterpret_cast<const struct sockaddr*>(_config.bind_address_storage.get());
+        _config.use_ipv6 = true;
         return *this;
     }
 

src/detail/webserver_aliases.cpp

@@ -198,7 +198,7 @@ void install_log_access_alias(
 // 404s) should add a catch-all fallback route or register a
 // not_found_handler that applies equivalent auth logic.
 void webserver::install_auth_alias_() {
-    if (auth_handler == nullptr) return;
+    if (config.auth_handler == nullptr) return;
     // Capture both the webserver* (for auth_handler callable) and the
     // webserver_impl* (for should_skip_auth, which normalises the path
     // before comparing against auth_skip_paths).
@@ -244,7 +244,7 @@ void webserver::install_auth_alias_() {
                 std::optional<http_response> rejection;
                 bool auth_threw = false;
                 try {
-                    rejection = ws_ptr->auth_handler(*ctx.request);
+                    rejection = ws_ptr->config.auth_handler(*ctx.request);
                 } catch (const std::exception& e) {
                     impl_ptr->log_dispatch_error(
                         std::string("auth_handler threw: ").append(e.what())
@@ -285,7 +285,7 @@ void webserver::install_auth_alias_() {
 // synthesises a default 405 body), appends the Allow header, and
 // returns hook_action::respond_with(...) to short-circuit dispatch.
 void webserver::install_method_not_allowed_alias_() {
-    if (method_not_allowed_handler == nullptr) return;
+    if (config.method_not_allowed_handler == nullptr) return;
     webserver* ws_ptr = this;
     add_hook(hook_phase::before_handler,
         std::function<hook_action(before_handler_ctx&)>(
@@ -299,7 +299,7 @@ void webserver::install_method_not_allowed_alias_() {
                 }
                 // Method not allowed: build the response.
                 http_response resp =
-                    ws_ptr->method_not_allowed_handler(*ctx.request);
+                    ws_ptr->config.method_not_allowed_handler(*ctx.request);
                 // Append Allow header from the matched route descriptor.
                 if (ctx.matched) {
                     std::string allow_value =
@@ -337,7 +337,7 @@ void webserver::install_method_not_allowed_alias_() {
 // body shape is pinned by hooks_not_found_alias_test (default and
 // custom branches) and by basic.cpp:custom_not_found_handler.
 void webserver::install_not_found_alias_() {
-    if (not_found_handler == nullptr) return;
+    if (config.not_found_handler == nullptr) return;
     add_hook(hook_phase::route_resolved,
         std::function<void(const route_resolved_ctx&)>(
             [](const route_resolved_ctx&) {
@@ -390,7 +390,7 @@ void webserver::install_default_alias_hooks_() {
     // thereafter. Runtime extension of the
     // handler_exception phase is via add_hook(); the alias slot is not
     // user-mutable post-construction.
-    install_internal_error_alias(impl_.get(), internal_error_handler);
+    install_internal_error_alias(impl_.get(), config.internal_error_handler);
 
     // ----------------------------------------------------------------
     // log_access -> response_sent alias slot.
@@ -405,7 +405,7 @@ void webserver::install_default_alias_hooks_() {
     //
     // Format: '<path> METHOD: <method>' -- mirrors v1 access_log to keep
     // basic.cpp log_access_callback test passing without modification.
-    install_log_access_alias(impl_.get(), log_access);
+    install_log_access_alias(impl_.get(), config.log_access);
 }
 
 }  // namespace httpserver

src/detail/webserver_body_pipeline.cpp

@@ -199,11 +199,11 @@ MHD_Result webserver_impl::requests_answer_first_step(MHD_Connection* connection
     // MHD_CONNECTION_INFO_SOCKET_CONTEXT, then allocates the http_request_impl
     // from that arena. The arena plumbing is therefore implicit at this call
     // site but explicit within the constructor.
-    mr->request.reset(new http_request(connection, parent->unescaper));
-    mr->request->set_file_cleanup_callback(parent->file_cleanup_callback);
+    mr->request.reset(new http_request(connection, parent->config.unescaper));
+    mr->request->set_file_cleanup_callback(parent->config.file_cleanup_callback);
     // Propagate the redaction-bypass bit so operator<< honours
     // the builder opt-in for every request the webserver dispatches.
-    mr->request->set_expose_credentials_in_logs(parent->expose_credentials_in_logs);
+    mr->request->set_expose_credentials_in_logs(parent->config.expose_credentials_in_logs);
 
     // request_received hook. Fires after the http_request is
     // populated but before any body bytes are read (and before any
@@ -229,10 +229,10 @@ MHD_Result webserver_impl::requests_answer_first_step(MHD_Connection* connection
         return MHD_YES;
     }
 
-    mr->request->set_content_size_limit(parent->content_size_limit);
+    mr->request->set_content_size_limit(parent->config.content_size_limit);
     const char *encoding = MHD_lookup_connection_value(connection, MHD_HEADER_KIND, http_utils::http_header_content_type);
 
-    if (parent->post_process_enabled &&
+    if (parent->config.post_process_enabled &&
         (nullptr != encoding &&
             ((0 == strncasecmp(http_utils::http_post_encoding_form_urlencoded, encoding, strlen(http_utils::http_post_encoding_form_urlencoded))) ||
              (0 == strncasecmp(http_utils::http_post_encoding_multipart_formdata, encoding, strlen(http_utils::http_post_encoding_multipart_formdata)))))) {
@@ -293,7 +293,7 @@ MHD_Result webserver_impl::requests_answer_second_step(MHD_Connection* connectio
     // multipart/form-data and application/x-www-form-urlencoded
     // all other content (which is indicated by mr-pp == nullptr)
     // has to be put to the content even if put_processed_data_to_content is set to false
-    if (mr->pp == nullptr || parent->put_processed_data_to_content) {
+    if (mr->pp == nullptr || parent->config.put_processed_data_to_content) {
         mr->request->grow_content(upload_data, *upload_data_size);
     }
     run_post_processor_if_attached(mr, parent, upload_data, *upload_data_size);

src/detail/webserver_callbacks.cpp

@@ -181,11 +181,11 @@ int webserver_impl::psk_cred_handler_func(void* cls,
     *psk = nullptr;
     *psk_size = 0;
 
-    if (ws == nullptr || ws->psk_cred_handler == nullptr) {
+    if (ws == nullptr || ws->config.psk_cred_handler == nullptr) {
         return -1;
     }
 
-    std::string psk_hex = ws->psk_cred_handler(std::string(username));
+    std::string psk_hex = ws->config.psk_cred_handler(std::string(username));
     if (psk_hex.empty()) {
         return -1;
     }
@@ -225,7 +225,7 @@ int webserver_impl::sni_cert_callback_func(void* cls,
     std::ignore = connection;
 
     webserver* ws = static_cast<webserver*>(cls);
-    if (ws == nullptr || ws->sni_callback == nullptr || server_name == nullptr) {
+    if (ws == nullptr || ws->config.sni_callback == nullptr || server_name == nullptr) {
         return -1;
     }
 
@@ -244,7 +244,7 @@ int webserver_impl::sni_cert_callback_func(void* cls,
     }
 
     // Call user's callback to get cert/key pair
-    auto [cert_pem, key_pem] = ws->sni_callback(name);
+    auto [cert_pem, key_pem] = ws->config.sni_callback(name);
     if (cert_pem.empty() || key_pem.empty()) {
         return -1;  // Use default certificate
     }
@@ -324,7 +324,7 @@ void webserver_impl::error_log(void* cls, const char* fmt, va_list ap) {
     va_end(va);
     msg.resize(r);
 
-    if (dws->log_error != nullptr) dws->log_error(msg);
+    if (dws->config.log_error != nullptr) dws->config.log_error(msg);
 }
 
 size_t webserver_impl::unescaper_func(void * cls, struct MHD_Connection *c, char *s) {
@@ -395,13 +395,13 @@ bool webserver_impl::setup_new_upload_file_info(http::file_info& file,
     // otherwise sanitize the client-supplied filename) and prime the
     // file_info with content_type / transfer_encoding when MHD gave
     // them to us.
-    if (parent->generate_random_filename_on_upload) {
+    if (parent->config.generate_random_filename_on_upload) {
         file.set_file_system_file_name(
-            http_utils::generate_random_upload_filename(parent->file_upload_dir));
+            http_utils::generate_random_upload_filename(parent->config.file_upload_dir));
     } else {
         std::string safe_name = http_utils::sanitize_upload_filename(filename);
         if (safe_name.empty()) return false;
-        file.set_file_system_file_name(parent->file_upload_dir + "/" + safe_name);
+        file.set_file_system_file_name(parent->config.file_upload_dir + "/" + safe_name);
     }
     // Avoid appending to a leftover file from a previous request.
     unlink(file.get_file_system_file_name().c_str());
@@ -462,11 +462,11 @@ MHD_Result webserver_impl::post_iterator(void *cls, enum MHD_ValueKind kind,
     }
 
     try {
-        if (mr->ws->file_upload_target != FILE_UPLOAD_DISK_ONLY) {
+        if (mr->ws->config.file_upload_target != FILE_UPLOAD_DISK_ONLY) {
             mr->request->set_arg_flat(key,
                 std::string(mr->request->get_arg(key)) + std::string(data, size));
         }
-        if (*filename != '\0' && mr->ws->file_upload_target != FILE_UPLOAD_MEMORY_ONLY) {
+        if (*filename != '\0' && mr->ws->config.file_upload_target != FILE_UPLOAD_MEMORY_ONLY) {
             MHD_Result r = mr->ws->impl_->process_file_upload(
                 mr, key, filename, content_type, transfer_encoding, data, size);
             if (r != MHD_YES) return r;

src/detail/webserver_callbacks_lifecycle.cpp

@@ -175,8 +175,8 @@ void webserver_impl::connection_notify(void* cls, struct MHD_Connection* connect
             // arguments_accumulator from the socket_context. 0 means
             // "use the compile-time defaults" -- see connection_state.hpp.
             if (ws != nullptr) {
-                cs->max_args_count = ws->max_args_count;
-                cs->max_args_bytes = ws->max_args_bytes;
+                cs->max_args_count = ws->config.max_args_count;
+                cs->max_args_bytes = ws->config.max_args_bytes;
             }
             *socket_context = cs;
             // Fire connection_opened. Zero-cost when no hook is
@@ -224,7 +224,7 @@ MHD_Result webserver_impl::policy_callback(void *cls, const struct sockaddr* add
     bool accepted = true;
     std::optional<std::string_view> reason{};
 
-    if (ws->ip_access_control_enabled) {
+    if (ws->config.ip_access_control_enabled) {
         bool is_denied = false;
         bool is_allowed = false;
         {
@@ -234,7 +234,7 @@ MHD_Result webserver_impl::policy_callback(void *cls, const struct sockaddr* add
             is_allowed = impl->allow_list.count(ip_representation(addr));
         }  // release deny/allow locks before firing the user hook
         std::tie(accepted, reason) =
-            classify_decision(ws->default_policy, is_denied, is_allowed);
+            classify_decision(ws->config.default_policy, is_denied, is_allowed);
     }
 
     const MHD_Result decision = accepted ? MHD_YES : MHD_NO;

src/detail/webserver_dispatch.cpp

@@ -461,7 +461,7 @@ void webserver_impl::dispatch_resource_handler(detail::modded_request* mr,
         // Perf: only build the heap string
         // when a log_error callback is actually wired; log_dispatch_error
         // also checks this but the concatenation happens at the call site.
-        if (parent->log_error) {
+        if (parent->config.log_error) {
             log_dispatch_error(
                 std::string("dispatch: handler threw std::exception: ")
                     .append(e.what()));

src/detail/webserver_error_pages.cpp

@@ -50,16 +50,16 @@ using httpserver::http::http_utils;
 namespace detail {
 
 http_response webserver_impl::not_found_page(detail::modded_request* mr) const {
-    if (parent->not_found_handler != nullptr) {
-        return parent->not_found_handler(*mr->request);
+    if (parent->config.not_found_handler != nullptr) {
+        return parent->config.not_found_handler(*mr->request);
     }
     return http_response::string(std::string{constants::NOT_FOUND_ERROR})
         .with_status(http_utils::http_not_found);
 }
 
 http_response webserver_impl::method_not_allowed_page(detail::modded_request* mr) const {
-    if (parent->method_not_allowed_handler != nullptr) {
-        return parent->method_not_allowed_handler(*mr->request);
+    if (parent->config.method_not_allowed_handler != nullptr) {
+        return parent->config.method_not_allowed_handler(*mr->request);
     }
     return http_response::string(std::string{constants::METHOD_ERROR})
         .with_status(http_utils::http_method_not_allowed);
@@ -79,8 +79,8 @@ http_response webserver_impl::internal_error_page(
             .with_status(http_utils::http_internal_server_error);
     }
     // Invoke the user handler with the originating message.
-    if (parent->internal_error_handler != nullptr) {
-        return parent->internal_error_handler(*mr->request, msg);
+    if (parent->config.internal_error_handler != nullptr) {
+        return parent->config.internal_error_handler(*mr->request, msg);
     }
     // The default body is the fixed string
     // "Internal Server Error" to avoid CWE-209 information disclosure of
@@ -91,7 +91,7 @@ http_response webserver_impl::internal_error_page(
     // verbose body (for development) must opt in via
     // create_webserver::expose_exception_messages(true).
     const auto status = http_utils::http_internal_server_error;
-    if (parent->expose_exception_messages) {
+    if (parent->config.expose_exception_messages) {
         return http_response::string(std::string{msg}).with_status(status);
     }
     return http_response::string(
@@ -100,7 +100,7 @@ http_response webserver_impl::internal_error_page(
 }
 
 void webserver_impl::log_dispatch_error(std::string_view msg) const noexcept {
-    if (parent->log_error == nullptr) {
+    if (parent->config.log_error == nullptr) {
         return;
     }
     // msg is forwarded VERBATIM regardless
@@ -118,7 +118,7 @@ void webserver_impl::log_dispatch_error(std::string_view msg) const noexcept {
     // the catch. Swallow any exception it throws; we have no recovery
     // beyond dropping the log line.
     try {
-        parent->log_error(std::string(msg));
+        parent->config.log_error(std::string(msg));
     } catch (...) {
         // Intentionally suppressed.
     }