fix: handle Content-Type with charset parameter for JSON payload (#32)

* fix: handle Content-Type with charset parameter for JSON payload

The JSON payload case used exact string match against "application/json",
so requests with parameters like "application/json; charset=utf-8" fell
through to the default branch and the body was rendered as a single raw
line, breaking the table layout. Switched to strings.HasPrefix to match
the same approach already used for x-www-form-urlencoded and
multipart/form-data, and added tests for charset-suffixed JSON.

Also addressed pre-existing lint issues touched along the way:
sort.Strings → slices.Sort, WriteString(fmt.Sprintf) → fmt.Fprintf,
and a nolint on the text/plain response Fprintf flagged by gosec G705.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: render JSON and raw payload outside the table

Long lines inside an AutoMerge'd payload row (e.g. an Azure DevOps
webhook with a long URL inside detailedMessage.html) were inflating
column 1's max width, pushing the value column past the terminal width
and making 2-column rows wrap so values like "0.6.2" appeared empty
on narrow terminals.

The table now renders only metadata, headers, secret/HMAC validation
and the incoming Content-Type. The pretty-printed JSON body and any
default raw body are written below the table, framed by separator
lines, so the table stays compact at any terminal width and the body
follows the terminal's natural flow.

Form-urlencoded and multipart key=value rows are unchanged — they are
short and fit naturally inside the table.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: parse media type and unmarshal arbitrary JSON for payload classification

Address review feedback from Codex and Copilot on PR #32:

- Parse Content-Type with mime.ParseMediaType once and dispatch on the
  parsed media type with a tagged switch. application/json-patch+json,
  application/jsonp and other types whose subtype merely starts with
  "json" no longer fall into the JSON branch and incorrectly emit
  json.Unmarshal errors; they go through the raw-body path instead.
- Hoist the multipart media-type parsing out of its case (it is now
  done once at the top) and reuse the parsed boundary parameter.
- Switch the JSON unmarshal target from map[string]any to any, so
  arrays and primitives (e.g. JSON Patch, [1,2,3], "hello") are
  pretty-printed instead of erroring with "cannot unmarshal array
  into Go value of type map[string]any".
- Upgrade the JSON-charset tests to write through WithOutputWriter
  to a temp file and assert observable handler output: pretty-printed
  multi-line JSON for valid input, json.Unmarshal error for invalid
  input. Add tests for JSON arrays and application/json-patch+json
  to lock in the new behaviour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(webui): add copy-to-clipboard for body and individual header values

Adds a copy button next to the Body section heading that copies the
displayed body text (raw text or pretty-printed JSON) to the clipboard.
Each row in the Headers table also gets an inline copy button that
appears on row hover and copies the raw header value.

Both buttons flash a "Copied!" confirmation for 1.5s on success and
fall back to a hidden-textarea + execCommand path when
navigator.clipboard is unavailable (older browsers / non-secure
contexts).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* add copy

* fix: surface mime.ParseMediaType errors instead of swallowing them

Previously the parse error was discarded with `_`, so a malformed
non-empty Content-Type would silently fall through to the raw-body
default branch — losing the explicit error feedback the old multipart
branch used to provide.

Now any parse failure on a non-empty Content-Type renders an error
row and short-circuits to RENDER. An absent Content-Type still falls
through to raw body as before, since "no media type" is not a parse
failure worth surfacing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address Copilot review feedback

- Show the request body under the "Payload" section even when
  mime.ParseMediaType fails. Previously the parse-error short-circuit
  jumped to RENDER without rendering the body, leaving the malformed
  payload visible only in the Raw HTTP dump. Set payloadAfterTable
  before goto RENDER so it still appears below the table.
- Replace the hard-coded white background on .headers-table tr:hover
  with var(--highlight-bg) so the dark theme keeps usable contrast.
- Make the per-header copy button discoverable for keyboard users by
  also revealing it on tr:focus-within / .copy-btn:focus-visible, and
  give every copy button a visible focus outline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address Copilot review feedback (round 2)

- Close server.OutputWriter before reading the temp output file in
  WithOutputWriter-based subtests. Avoids potential file-locking
  failures on Windows and guarantees writes are flushed before the
  assertions run.
- Keep the per-header copy button visible on touch devices via a
  @media (hover: none) rule, so the affordance is discoverable when
  no hover state is available.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address Copilot review feedback (round 3)

- Set payloadAfterTable = bodyAsString on json.Unmarshal and
  json.MarshalIndent failures so the raw request body still appears
  under the table when JSON parsing fails, matching the
  mime.ParseMediaType error path.
- Drop the .trim() on the body copy handler so the clipboard receives
  the body's exact textContent (no leading/trailing whitespace lost).
- Extend the invalid-JSON subtest to assert the raw body is rendered
  below the table on the unmarshal-error path.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vigo

internal/httpserver/httpserver.go

@@ -18,7 +18,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"sort"
+	"slices"
 	"strings"
 	"time"
 
@@ -292,14 +292,15 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 		for key := range r.Header {
 			headerKeys = append(headerKeys, key)
 		}
-		sort.Strings(headerKeys)
+		slices.Sort(headerKeys)
 
 		for _, key := range headerKeys {
 			t.AppendRow(table.Row{key, strings.Join(r.Header[key], ",")})
 		}
 
 		var bodyAsString string
 		var storeFiles []requeststore.FileAttachment
+		var payloadAfterTable string
 
 		switch r.Method {
 		case http.MethodPost, http.MethodPut, http.MethodPatch:
@@ -365,9 +366,23 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 
 			bodyAsString = string(body)
 
-			switch {
-			case requestContentType == "application/json":
-				var jsonBody map[string]any
+			mediaType, mediaParams, mediaErr := mime.ParseMediaType(requestContentType)
+			if mediaErr != nil && requestContentType != "" {
+				txtErrorMedia := colorError.Sprintf("mime.ParseMediaType error: %s", mediaErr.Error())
+				t.AppendRow(table.Row{txtErrorMedia, txtErrorMedia}, table.RowConfig{
+					AutoMerge:      true,
+					AutoMergeAlign: text.AlignLeft,
+				})
+				t.AppendSeparator()
+
+				payloadAfterTable = bodyAsString
+
+				goto RENDER
+			}
+
+			switch mediaType {
+			case "application/json":
+				var jsonBody any
 				if err = json.Unmarshal(body, &jsonBody); err != nil {
 					txtErrorUnmarshal := colorError.Sprintf("json.Unmarshal error: %s", err.Error())
 					t.AppendRow(table.Row{txtErrorUnmarshal, txtErrorUnmarshal}, table.RowConfig{
@@ -376,6 +391,8 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 					})
 					t.AppendSeparator()
 
+					payloadAfterTable = bodyAsString
+
 					goto RENDER
 				}
 
@@ -388,16 +405,13 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 					})
 					t.AppendSeparator()
 
+					payloadAfterTable = bodyAsString
+
 					goto RENDER
 				}
 
-				t.AppendSeparator()
-				payloadJSON := colorPayload.Sprintf("%s", prettyJSON)
-				t.AppendRow(table.Row{payloadJSON, payloadJSON}, table.RowConfig{
-					AutoMerge:      true,
-					AutoMergeAlign: text.AlignLeft,
-				})
-			case strings.HasPrefix(requestContentType, "application/x-www-form-urlencoded"):
+				payloadAfterTable = string(prettyJSON)
+			case "application/x-www-form-urlencoded":
 				formData, errForm := url.ParseQuery(bodyAsString)
 				if errForm != nil {
 					txtErrorForm := colorError.Sprintf("url.ParseQuery error: %s", errForm.Error())
@@ -421,27 +435,15 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 				for key := range formData {
 					formKeys = append(formKeys, key)
 				}
-				sort.Strings(formKeys)
+				slices.Sort(formKeys)
 
 				for _, key := range formKeys {
 					values := formData[key]
 					valueStr := colorPayload.Sprint(strings.Join(values, ", "))
 					t.AppendRow(table.Row{key, valueStr})
 				}
-			case strings.HasPrefix(requestContentType, "multipart/form-data"):
-				_, params, errMedia := mime.ParseMediaType(requestContentType)
-				if errMedia != nil {
-					txtErrorMedia := colorError.Sprintf("mime.ParseMediaType error: %s", errMedia.Error())
-					t.AppendRow(table.Row{txtErrorMedia, txtErrorMedia}, table.RowConfig{
-						AutoMerge:      true,
-						AutoMergeAlign: text.AlignLeft,
-					})
-					t.AppendSeparator()
-
-					goto RENDER
-				}
-
-				boundary := params["boundary"]
+			case "multipart/form-data":
+				boundary := mediaParams["boundary"]
 				if boundary == "" {
 					txtErrorBoundary := colorError.Sprint("multipart boundary not found")
 					t.AppendRow(table.Row{txtErrorBoundary, txtErrorBoundary}, table.RowConfig{
@@ -549,7 +551,7 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 					for key := range formFields {
 						fieldKeys = append(fieldKeys, key)
 					}
-					sort.Strings(fieldKeys)
+					slices.Sort(fieldKeys)
 
 					for _, key := range fieldKeys {
 						values := formFields[key]
@@ -600,20 +602,18 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 					storeFiles = append(storeFiles, sf)
 				}
 			default:
-				payloadText := colorPayload.Sprintf("%s", body)
-				t.AppendSeparator()
-				t.AppendRow(
-					table.Row{payloadText, payloadText},
-					table.RowConfig{
-						AutoMerge:      true,
-						AutoMergeAlign: text.AlignLeft,
-					},
-				)
+				payloadAfterTable = bodyAsString
 			}
 		}
 	RENDER:
 		t.Render()
 
+		if payloadAfterTable != "" {
+			options.drawLine()
+			fmt.Fprintln(options.writer, colorPayload.Sprintf("%s", payloadAfterTable))
+			options.drawLine()
+		}
+
 		mwr := io.MultiWriter(options.writer)
 		var rawHRw *os.File
 		var rawErr error
@@ -628,7 +628,8 @@ func debugHandlerFunc(options *debugHandlerOptions) http.HandlerFunc {
 			}
 
 			mwr = io.MultiWriter(options.writer, rawHRw)
-			fmt.Fprintf(w, "Raw HTTP Request is saved to: %s\n", formattedFilename)
+			// response is text/plain and filename is sanitized in stringutils.GetFormattedFilename
+			fmt.Fprintf(w, "Raw HTTP Request is saved to: %s\n", formattedFilename) //nolint:gosec
 		}
 
 	WRITERHR:
@@ -855,7 +856,7 @@ func sanitizeBodyForDisplay(body, contentType string) string {
 			// Remove trailing boundary markers for size calculation
 			cleanContent := strings.TrimSuffix(content, "\r\n")
 			cleanContent = strings.TrimSuffix(cleanContent, "\n")
-			result.WriteString(fmt.Sprintf("[binary data: %s]", formatFileSize(len(cleanContent))))
+			fmt.Fprintf(&result, "[binary data: %s]", formatFileSize(len(cleanContent)))
 			// Preserve the trailing newlines
 			if strings.HasSuffix(content, "\r\n") {
 				result.WriteString("\r\n")

internal/httpserver/httpserver_test.go

@@ -11,6 +11,7 @@ import (
 	"net/http/httptest"
 	"net/textproto"
 	"os"
+	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -176,6 +177,138 @@ func TestDebugHandler(t *testing.T) {
 		assert.Contains(t, rec.Body.String(), "OK")
 	})
 
+	t.Run("POST request with JSON body and charset pretty-prints below the table", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `{"name":"test","value":123}`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json; charset=utf-8")
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+
+		assert.Contains(t, s, "application/json; charset=utf-8")
+		assert.Contains(t, s, "\"name\": \"test\"")
+		assert.Contains(t, s, "\"value\": 123")
+		assert.NotContains(t, s, "json.Unmarshal error")
+	})
+
+	t.Run("POST request with JSON array body pretty-prints", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `[1,2,3]`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json")
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+
+		assert.NotContains(t, s, "json.Unmarshal error")
+		assert.Contains(t, s, "[\n    1,\n    2,\n    3\n]")
+	})
+
+	t.Run("POST request with json-patch+json is not parsed as JSON", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `[{"op":"add","path":"/foo","value":"bar"}]`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json-patch+json")
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+
+		assert.NotContains(t, s, "json.Unmarshal error")
+		assert.Contains(t, s, body)
+	})
+
+	t.Run("POST request with malformed Content-Type reports parse error", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `whatever`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json; charset=") // missing param value
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+		assert.Contains(t, s, "mime.ParseMediaType error")
+		assert.Contains(t, s, body) // body still rendered below the table
+	})
+
+	t.Run("POST request with empty Content-Type does not report parse error", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `raw payload without content type`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Del("Content-Type")
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+		assert.NotContains(t, s, "mime.ParseMediaType error")
+		assert.Contains(t, s, body)
+	})
+
+	t.Run("POST request with invalid JSON and charset reports unmarshal error", func(t *testing.T) {
+		out := filepath.Join(t.TempDir(), "out.log")
+		server, err := httpserver.New(httpserver.WithOutputWriter(out))
+		require.NoError(t, err)
+
+		body := `not-valid-json`
+		req := httptest.NewRequest(http.MethodPost, "/webhook", strings.NewReader(body))
+		req.Header.Set("Content-Type", "application/json; charset=utf-8")
+		rec := httptest.NewRecorder()
+
+		server.HTTPServer.Handler.ServeHTTP(rec, req)
+		require.Equal(t, http.StatusOK, rec.Code)
+		require.NoError(t, server.OutputWriter.Close())
+
+		got, errR := os.ReadFile(out)
+		require.NoError(t, errR)
+		s := string(got)
+
+		assert.Contains(t, s, "json.Unmarshal error")
+		assert.Contains(t, s, body) // raw body still rendered below the table
+	})
+
 	t.Run("POST request with plain text body", func(t *testing.T) {
 		server, err := httpserver.New()
 		require.NoError(t, err)