apache · zwoop · Apr 4, 2026
diff --git a/tests/gold_tests/pluginTest/header_rewrite/rules/complex_logics.conf b/tests/gold_tests/pluginTest/header_rewrite/rules/complex_logics.conf
@@ -14,11 +14,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 # All rules use SEND_RESPONSE_HDR_HOOK so set-header operates on the
 # response that the client sees.  CLIENT-HEADER and CLIENT-URL:PATH
 # conditions always refer to the original client request regardless of hook.
-
 # ---- Test: GROUP with [OR] on GROUP:END ----
 # hrw4u: if (inbound.req.X-Group-A) || inbound.req.X-Group-B
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
@@ -28,128 +26,128 @@ cond %{GROUP}
 cond %{GROUP:END} [OR]
 cond %{CLIENT-HEADER:X-Group-B} ="" [NOT]
     set-header X-Group-Or-Result "matched"
+    # ---- Test: GROUP with [AND] on GROUP:END (explicit) ----
+    # hrw4u: if (inbound.req.X-And-A) && inbound.req.X-And-B
 
-# ---- Test: GROUP with [AND] on GROUP:END (explicit) ----
-# hrw4u: if (inbound.req.X-And-A) && inbound.req.X-And-B
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/group-and$/ [AND]
 cond %{GROUP}
     cond %{CLIENT-HEADER:X-And-A} ="" [NOT]
 cond %{GROUP:END} [AND]
 cond %{CLIENT-HEADER:X-And-B} ="" [NOT]
     set-header X-Group-And-Result "matched"
+    # ---- Test: GROUP with [NOT] on GROUP:END ----
+    # hrw4u: if !(inbound.req.X-Not-A && inbound.req.X-Not-B)
 
-# ---- Test: GROUP with [NOT] on GROUP:END ----
-# hrw4u: if !(inbound.req.X-Not-A && inbound.req.X-Not-B)
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/group-not$/ [AND]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-Not-A} ="" [NOT]
+    cond %{CLIENT-HEADER:X-Not-A} ="" [AND,NOT]
     cond %{CLIENT-HEADER:X-Not-B} ="" [NOT]
 cond %{GROUP:END} [NOT]
     set-header X-Group-Not-Result "matched"
+    # ---- Test: Nested GROUPs with mixed OR/AND ----
+    # hrw4u: if inbound.req.X-Outer-A && (inbound.req.X-Inner-A || inbound.req.X-Inner-B)
 
-# ---- Test: Nested GROUPs with mixed OR/AND ----
-# hrw4u: if inbound.req.X-Outer-A && (inbound.req.X-Inner-A || inbound.req.X-Inner-B)
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/nested-group$/ [AND]
-cond %{CLIENT-HEADER:X-Outer-A} ="" [NOT]
+cond %{CLIENT-HEADER:X-Outer-A} ="" [AND,NOT]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-Inner-A} ="" [NOT,OR]
+    cond %{CLIENT-HEADER:X-Inner-A} ="" [OR,NOT]
     cond %{CLIENT-HEADER:X-Inner-B} ="" [NOT]
 cond %{GROUP:END}
     set-header X-Nested-Group-Result "matched"
+    # ---- Test: Two GROUPs with OR between them ----
+    # hrw4u: if (inbound.req.X-Left-A && inbound.req.X-Left-B) || (inbound.req.X-Right-A && inbound.req.X-Right-B)
 
-# ---- Test: Two GROUPs with OR between them ----
-# hrw4u: if (inbound.req.X-Left-A && inbound.req.X-Left-B) || (inbound.req.X-Right-A && inbound.req.X-Right-B)
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/two-groups$/ [AND]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-Left-A} ="" [NOT]
+    cond %{CLIENT-HEADER:X-Left-A} ="" [AND,NOT]
     cond %{CLIENT-HEADER:X-Left-B} ="" [NOT]
 cond %{GROUP:END} [OR]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-Right-A} ="" [NOT]
+    cond %{CLIENT-HEADER:X-Right-A} ="" [AND,NOT]
     cond %{CLIENT-HEADER:X-Right-B} ="" [NOT]
 cond %{GROUP:END}
     set-header X-Two-Groups-Result "matched"
+    # ---- Test: GROUP inside if/elif/else ----
+    # hrw4u:
+    #   if inbound.req.X-Branch == "alpha" && (inbound.req.X-Sub-A || inbound.req.X-Sub-B)
+    #     -> "alpha"
+    #   elif inbound.req.X-Branch == "beta"
+    #     -> "beta"
+    #   else
+    #     -> "other"
 
-# ---- Test: GROUP inside if/elif/else ----
-# hrw4u:
-#   if inbound.req.X-Branch == "alpha" && (inbound.req.X-Sub-A || inbound.req.X-Sub-B)
-#     -> "alpha"
-#   elif inbound.req.X-Branch == "beta"
-#     -> "beta"
-#   else
-#     -> "other"
-cond %{SEND_RESPONSE_HDR_HOOK} [AND]
-cond %{CLIENT-URL:PATH} /\/logic\/if-group$/ [AND]
-  if
-    cond %{CLIENT-HEADER:X-Branch} ="alpha"
-    cond %{GROUP}
-        cond %{CLIENT-HEADER:X-Sub-A} ="" [NOT,OR]
-        cond %{CLIENT-HEADER:X-Sub-B} ="" [NOT]
-    cond %{GROUP:END}
-      set-header X-If-Group-Result "alpha"
-  elif
-    cond %{CLIENT-HEADER:X-Branch} ="beta"
-      set-header X-If-Group-Result "beta"
-  else
-    set-header X-If-Group-Result "other"
-  endif
-
-# ---- Test: GROUP with OR inside nested if ----
-# hrw4u:
-#   if inbound.req.X-Outer == "yes"
-#     if (inbound.req.X-Case-A || inbound.req.X-Case-B)
-#       -> "inner-match"
-#     else
-#       -> "inner-miss"
-#   else
-#     -> "outer-miss"
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
-cond %{CLIENT-URL:PATH} /\/logic\/nested-if-group$/ [AND]
-  if
-    cond %{CLIENT-HEADER:X-Outer} ="yes"
-      if
+cond %{CLIENT-URL:PATH} /\/logic\/if-group$/
+    if
+        cond %{CLIENT-HEADER:X-Branch} ="alpha" [AND]
         cond %{GROUP}
-            cond %{CLIENT-HEADER:X-Case-A} ="" [NOT,OR]
-            cond %{CLIENT-HEADER:X-Case-B} ="" [NOT]
+            cond %{CLIENT-HEADER:X-Sub-A} ="" [OR,NOT]
+            cond %{CLIENT-HEADER:X-Sub-B} ="" [NOT]
         cond %{GROUP:END}
-          set-header X-Nested-If-Result "inner-match"
-      else
-        set-header X-Nested-If-Result "inner-miss"
-      endif
-  else
-    set-header X-Nested-If-Result "outer-miss"
-  endif
+            set-header X-If-Group-Result "alpha"
+        elif
+            cond %{CLIENT-HEADER:X-Branch} ="beta"
+                set-header X-If-Group-Result "beta"
+        else
+            set-header X-If-Group-Result "other"
+    endif
+    # ---- Test: GROUP with OR inside nested if ----
+    # hrw4u:
+    #   if inbound.req.X-Outer == "yes"
+    #     if (inbound.req.X-Case-A || inbound.req.X-Case-B)
+    #       -> "inner-match"
+    #     else
+    #       -> "inner-miss"
+    #   else
+    #     -> "outer-miss"
+
+cond %{SEND_RESPONSE_HDR_HOOK} [AND]
+cond %{CLIENT-URL:PATH} /\/logic\/nested-if-group$/
+    if
+        cond %{CLIENT-HEADER:X-Outer} ="yes"
+            if
+                cond %{GROUP}
+                    cond %{CLIENT-HEADER:X-Case-A} ="" [OR,NOT]
+                    cond %{CLIENT-HEADER:X-Case-B} ="" [NOT]
+                cond %{GROUP:END}
+                    set-header X-Nested-If-Result "inner-match"
+                else
+                    set-header X-Nested-If-Result "inner-miss"
+            endif
+        else
+            set-header X-Nested-If-Result "outer-miss"
+    endif
+    # ---- Test: Complex expression: (A OR B) AND (C OR D) ----
+    # hrw4u: if (inbound.req.X-P || inbound.req.X-Q) && (inbound.req.X-R || inbound.req.X-S)
 
-# ---- Test: Complex expression: (A OR B) AND (C OR D) ----
-# hrw4u: if (inbound.req.X-P || inbound.req.X-Q) && (inbound.req.X-R || inbound.req.X-S)
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/complex-and-or$/ [AND]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-P} ="" [NOT,OR]
+    cond %{CLIENT-HEADER:X-P} ="" [OR,NOT]
     cond %{CLIENT-HEADER:X-Q} ="" [NOT]
 cond %{GROUP:END} [AND]
 cond %{GROUP}
-    cond %{CLIENT-HEADER:X-R} ="" [NOT,OR]
+    cond %{CLIENT-HEADER:X-R} ="" [OR,NOT]
     cond %{CLIENT-HEADER:X-S} ="" [NOT]
 cond %{GROUP:END}
     set-header X-Complex-Result "matched"
+    # ---- Test: IP:CLIENT in GROUP with [OR]
+    # hrw4u: if (inbound.ip in {127.0.0.0/8}) || inbound.req.X-Outer == "true"
 
-# ---- Test: IP:CLIENT in GROUP with [OR]
-# hrw4u: if (inbound.ip in {127.0.0.0/8}) || inbound.req.X-Outer == "true"
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{CLIENT-URL:PATH} /\/logic\/ip-group-or$/ [AND]
 cond %{GROUP}
     cond %{IP:CLIENT} {127.0.0.0/8}
 cond %{GROUP:END} [OR]
 cond %{CLIENT-HEADER:X-Outer} ="true"
     set-header X-Ip-Group-Or-Result "matched"
+    # ---- Test: GROUP as first condition after hook ----
+    # hrw4u: if (inbound.url.path ~ /\/logic\/group-first$/) && inbound.req.X-First-A
 
-# ---- Test: GROUP as first condition after hook ----
-# hrw4u: if (inbound.url.path ~ /\/logic\/group-first$/) && inbound.req.X-First-A
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{GROUP}
     cond %{CLIENT-URL:PATH} /\/logic\/group-first$/

diff --git a/tests/gold_tests/pluginTest/header_rewrite/rules/complex_logics.hrw4u b/tests/gold_tests/pluginTest/header_rewrite/rules/complex_logics.hrw4u
@@ -0,0 +1,125 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# All rules use SEND_RESPONSE_HDR_HOOK so set-header operates on the
+# response that the client sees.  CLIENT-HEADER and CLIENT-URL:PATH
+# conditions always refer to the original client request regardless of hook.
+# ---- Test: GROUP with [OR] on GROUP:END ----
+# hrw4u: if (inbound.req.X-Group-A) || inbound.req.X-Group-B
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/group-or$/ && (inbound.req.X-Group-A) || inbound.req.X-Group-B {
+        inbound.resp.X-Group-Or-Result = "matched";
+        # ---- Test: GROUP with [AND] on GROUP:END (explicit) ----
+        # hrw4u: if (inbound.req.X-And-A) && inbound.req.X-And-B
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/group-and$/ && (inbound.req.X-And-A) && inbound.req.X-And-B {
+        inbound.resp.X-Group-And-Result = "matched";
+        # ---- Test: GROUP with [NOT] on GROUP:END ----
+        # hrw4u: if !(inbound.req.X-Not-A && inbound.req.X-Not-B)
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/group-not$/ && !(inbound.req.X-Not-A && inbound.req.X-Not-B) {
+        inbound.resp.X-Group-Not-Result = "matched";
+        # ---- Test: Nested GROUPs with mixed OR/AND ----
+        # hrw4u: if inbound.req.X-Outer-A && (inbound.req.X-Inner-A || inbound.req.X-Inner-B)
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/nested-group$/ && inbound.req.X-Outer-A && (inbound.req.X-Inner-A || inbound.req.X-Inner-B) {
+        inbound.resp.X-Nested-Group-Result = "matched";
+        # ---- Test: Two GROUPs with OR between them ----
+        # hrw4u: if (inbound.req.X-Left-A && inbound.req.X-Left-B) || (inbound.req.X-Right-A && inbound.req.X-Right-B)
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/two-groups$/ && (inbound.req.X-Left-A && inbound.req.X-Left-B) || (inbound.req.X-Right-A && inbound.req.X-Right-B) {
+        inbound.resp.X-Two-Groups-Result = "matched";
+        # ---- Test: GROUP inside if/elif/else ----
+        # hrw4u:
+        #   if inbound.req.X-Branch == "alpha" && (inbound.req.X-Sub-A || inbound.req.X-Sub-B)
+        #     -> "alpha"
+        #   elif inbound.req.X-Branch == "beta"
+        #     -> "beta"
+        #   else
+        #     -> "other"
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/if-group$/ {
+        if inbound.req.X-Branch == "alpha" && (inbound.req.X-Sub-A || inbound.req.X-Sub-B) {
+            inbound.resp.X-If-Group-Result = "alpha";
+        } elif inbound.req.X-Branch == "beta" {
+            inbound.resp.X-If-Group-Result = "beta";
+        } else {
+            inbound.resp.X-If-Group-Result = "other";
+        }
+        # ---- Test: GROUP with OR inside nested if ----
+        # hrw4u:
+        #   if inbound.req.X-Outer == "yes"
+        #     if (inbound.req.X-Case-A || inbound.req.X-Case-B)
+        #       -> "inner-match"
+        #     else
+        #       -> "inner-miss"
+        #   else
+        #     -> "outer-miss"
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/nested-if-group$/ {
+        if inbound.req.X-Outer == "yes" {
+            if (inbound.req.X-Case-A || inbound.req.X-Case-B) {
+                inbound.resp.X-Nested-If-Result = "inner-match";
+            } else {
+                inbound.resp.X-Nested-If-Result = "inner-miss";
+            }
+        } else {
+            inbound.resp.X-Nested-If-Result = "outer-miss";
+        }
+        # ---- Test: Complex expression: (A OR B) AND (C OR D) ----
+        # hrw4u: if (inbound.req.X-P || inbound.req.X-Q) && (inbound.req.X-R || inbound.req.X-S)
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/complex-and-or$/ && (inbound.req.X-P || inbound.req.X-Q) && (inbound.req.X-R || inbound.req.X-S) {
+        inbound.resp.X-Complex-Result = "matched";
+        # ---- Test: IP:CLIENT in GROUP with [OR]
+        # hrw4u: if (inbound.ip in {127.0.0.0/8}) || inbound.req.X-Outer == "true"
+    }
+}
+
+SEND_RESPONSE {
+    if inbound.url.path ~ /\/logic\/ip-group-or$/ && (inbound.ip in {127.0.0.0/8}) || inbound.req.X-Outer == "true" {
+        inbound.resp.X-Ip-Group-Or-Result = "matched";
+        # ---- Test: GROUP as first condition after hook ----
+        # hrw4u: if (inbound.url.path ~ /\/logic\/group-first$/) && inbound.req.X-First-A
+    }
+}
+
+SEND_RESPONSE {
+    if (inbound.url.path ~ /\/logic\/group-first$/) && inbound.req.X-First-A {
+        inbound.resp.X-Group-First-Result = "matched";
+    }
+}
diff --git a/tests/gold_tests/pluginTest/header_rewrite/rules/glob_set_redirect.conf b/tests/gold_tests/pluginTest/header_rewrite/rules/glob_set_redirect.conf
@@ -14,11 +14,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
 cond %{READ_RESPONSE_HDR_HOOK} [AND]
 cond %{ID:REQUEST} =0
-    set-redirect 301 http://redirect.com/here
+    set-redirect 301 "http://redirect.com/here"
 
 cond %{SEND_RESPONSE_HDR_HOOK} [AND]
 cond %{ID:REQUEST} =1
-    set-redirect 301 http://redirect.com/here
+    set-redirect 301 "http://redirect.com/here"
diff --git a/tests/gold_tests/pluginTest/header_rewrite/rules/glob_set_redirect.hrw4u b/tests/gold_tests/pluginTest/header_rewrite/rules/glob_set_redirect.hrw4u
@@ -0,0 +1,27 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+READ_RESPONSE {
+    if id.REQUEST == 0 {
+        set-redirect(301, "http://redirect.com/here");
+    }
+}
+
+SEND_RESPONSE {
+    if id.REQUEST == 1 {
+        set-redirect(301, "http://redirect.com/here");
+    }
+}