[release] Remove HxProxyConfig from lib-httpx in favour of lib-util-net ProxyConfig (2.7.0)

[pditommaso]

Summary

Follow-up to #122 (which adds io.seqera.util.net.ProxyConfig to lib-util-net). This removes the near-identical duplicate the reviewer flagged: lib-httpx now depends on lib-util-net and HxProxyConfig is deleted, so the proxy selector / authenticator / no-proxy semantics live in exactly one place, shared with Wave and Nextflow.

Stacked on #122 — review/merge that first. This PR's base retargets to master once #122 lands.

Changes (BREAKING (shipped as a minor - see changelog) → lib-httpx 2.7.0)

• Delete HxProxyConfig (and HxProxyConfigTest) — its parsing-free Endpoint/toProxySelector/toAuthenticator/isBypassed/credentialsFor were character-for-character identical to lib-util-net's ProxyConfig.
• HxClient.Builder.withProxyConfig now accepts an io.seqera.util.net.ProxyConfig. The body is unchanged — it already used getHttpProxy()/getHttpsProxy()/toProxySelector()/toAuthenticator(), which ProxyConfig exposes with the same shape.
• build.gradle: api project(':lib-util-net').
• Javadoc references and HxClientProxyAuthIntegrationTest migrated to ProxyConfig (the integration test now resolves via ProxyConfig.fromUri(...)).

Migration for callers

Anything that built an HxProxyConfig resolves a ProxyConfig instead:

// before
HxClient.newBuilder().withProxyConfig(HxProxyConfig.newBuilder().httpProxy(host, port, user, pass).build())
// after
HxClient.newBuilder().withProxyConfig(ProxyConfig.fromUri("http://user:pass@host:port"))

The only in-repo/-org caller is Nextflow (nextflow.util.ProxyConfig + TowerXAuth), migrated alongside this change; Platform and Wave don't use HxProxyConfig.

Tests

:lib-httpx:test green, incl. HxClientProxyAuthIntegrationTest (9/9) driving a real HxClient through an authenticating proxy via the migrated ProxyConfig.

🤖 Generated with Claude Code

[pditommaso]

This removes HxProxyConfig and points lib-httpx at io.seqera.util.net.ProxyConfig (from #122), so the proxy selector / authenticator / no-proxy semantics live in one place. Shipped as 2.7.0 — source-incompatible for any HxProxyConfig caller, but the only one (Nextflow) is migrated in lock-step; the changelog spells out why it's a minor rather than a major.

Stacked on #122 (already approved); its base retargets to master once #122 merges.

@claude review

[claude]

Claude finished @pditommaso's task in 2m 24s —— View job

---

Review: remove HxProxyConfig in favour of io.seqera.util.net.ProxyConfig

• Read the diff vs claude/lib-util-net-proxy-config
• Compare deleted HxProxyConfig against ProxyConfig for behavioural parity
• Check HxClient / HxConfig call sites and build wiring
• Check test migration + coverage loss
• Post review

---

Verdict: Comment — no defect found in the code, but I'm not approving

The diff itself is clean and I found no correctness, security or data-loss issue. I'm withholding approval purely on scope, not on a defect: this deletes a public type (HxProxyConfig) and changes the signature of a public method (HxClient.Builder.withProxyConfig). That's a backward-incompatible contract change, and the "ship it as a minor because the only consumer is migrated in lock-step" call is a human decision — the changelog argues it well, but it should be a maintainer's signature, not mine.

Everything below is either verification or a non-blocking fix.

---

Behavioural parity — verified

I diffed the deleted HxProxyConfig against lib-util-net's ProxyConfig method by method:

behaviour	parity
toProxySelector() — precomputed lists, scheme routing, connectFailed logging	identical
toAuthenticator() — RequestorType.PROXY guard, host+port match, empty-password fallback	identical
isBypassed() — loopback set, *, *.x / .x suffix-only, bare x = host + subdomains	identical, character for character
credentialsFor() — https endpoint preferred, case-insensitive host	identical
hasCredentials()	identical

The withProxyConfig body (HxClient.java:1247-1256) is unchanged and still typechecks: getHttpProxy()/getHttpsProxy() return ProxyConfig.Endpoint instead of the package-private ProxyEntry, and the body only null-checks them. api project(':lib-util-net') (not implementation) is the right scope, since ProxyConfig is in the public signature of withProxyConfig.

Test coverage is not lost: every scenario in the deleted HxProxyConfigTest (scheme selection, direct-connect fallback, NO_PROXY matching, wildcard, loopback, authenticator scoping, no-credentials → null authenticator) has an equivalent in lib-util-net's ProxyConfigTest, which additionally covers parsing, credential decoding, and the CONNECT-tunnel case. HxClientProxyAuthIntegrationTest still exercises a real HxClient end-to-end through the authenticating proxy.

---

Blocking-ish for the release: lib-httpx/README.md is stale

CLAUDE.md says "When releasing a new version, update the module's README.md to reflect the new version number" — and beyond the version, the README still documents the class this PR deletes. A user copy-pasting from it gets code that does not compile:

• lib-httpx/README.md:13 — implementation 'io.seqera:lib-httpx:2.6.0' → 2.7.0
• lib-httpx/README.md:28 — feature bullet still says "an HxProxyConfig value"
• lib-httpx/README.md:407-418 — the whole proxy example uses HxProxyConfig.newBuilder().httpsProxy(host, port, user, pass).noProxy(...), an API that no longer exists
• lib-httpx/README.md:472 — Key Classes still lists HxProxyConfig: "assembled from explicit values via its builder"

Worth also noting in the README that the type now comes from io.seqera:lib-util-net, since it is an api dependency callers will see on their compile classpath.

Fix this →

---

Non-blocking notes

1. Point the migration at the 4-arg fromUri for raw credentials. The PR body and changelog suggest:

ProxyConfig.fromUri("http://user:pass@host:port")

That embeds credentials in a URI, so a password containing @, : or % has to be percent-encoded by the caller or it mis-parses silently — a footgun the old httpProxy(host, port, user, pass) builder didn't have. ProxyConfig already has the safe overload:

ProxyConfig.fromUri("http://host:port", user, pass, noProxy);  // explicit creds win over user-info

Calling that out in changelog.txt (and the README) would spare migrating callers a subtle bug. The integration test's "http://alice:s3cret@127.0.0.1:${proxyPort}" is fine as-is since those credentials are literal-safe.

2. Small semantic shift worth a changelog line. HxProxyConfig could carry an http proxy without an https one (and vice versa); ProxyConfig.fromUri always applies one endpoint to both. Asymmetric per-protocol config is now only reachable via fromEnvironment. Not a bug for any current caller — just no longer expressible from explicit values.

3. Publish ordering (informational). .github/workflows/build.yml publishes lib-httpx (line 88) before lib-util-net (line 97). Harmless here — #122 lands first, and even in a shared run both artifacts appear before the job ends — but if the two ever released together, lib-httpx's POM would briefly reference a coordinate not yet in S3.

---

What I could not verify

I couldn't run ./gradlew :lib-httpx:test — the build command needed approval in this sandbox, so the green test run reported in the PR body is unverified by me. The compile-level reasoning above is from reading the sources.
· branch claude/lib-httpx-drop-hxproxyconfig

[pditommaso]

Addressed the doc/changelog items:

• Stale lib-httpx/README.md — bumped the dependency snippet to 2.7.0, and the proxy bullet, the proxy example, and the Key Classes entry now reference io.seqera.util.net.ProxyConfig (noting it comes from the api dependency io.seqera:lib-util-net); the deleted HxProxyConfig.newBuilder() example is gone.
• Migration footgun (non-blocking 1) — the README example and changelog now steer callers to ProxyConfig.fromUri(uri, user, pass, noProxy) for raw credentials, rather than embedding them in the URI.
• Semantic shift (non-blocking 2) — changelog now notes that asymmetric per-protocol config from explicit values is only expressible via fromEnvironment.
• Publish ordering (non-blocking 3) — build.yml now publishes lib-util-net before lib-httpx, since lib-httpx now depends on it.

On the verdict: agreed the breaking-change-as-a-minor is a maintainer call, not the bot's — leaving the approval/merge decision to @pditommaso.