Body match-and-replace rules

Extends match-and-replace rules to request/response bodies, not just
headers. A body rule materializes the body into memory (bounded by
the same maxCaptureBytes cap as history capture) instead of streaming
it straight through - the opposite of the normal path, so it's only
paid when a body rule is actually configured. A body over the cap
passes through byte-exact and unmodified rather than being partially
rewritten.

Response Content-Length is recomputed explicitly when a rule changes
body length: unlike http.Request.Write, http.ResponseWriter doesn't
derive it from resp.ContentLength on its own, so a stale header would
otherwise corrupt response framing for the client.

The history audit trail still shows the original, pre-rule bytes on
both legs; only the wire traffic reflects the rewrite. Verified live
against a real daemon: origin receives the rewritten request body,
client receives the rewritten response body with correct
Content-Length, and history keeps the unmodified bytes.

Adds a Part selector (header/body) to the Rules add/edit form and
table in the TUI.

5 files changed, 330 insertions, 15 deletions

diff --git a/internal/proxy/bodyrules.go b/internal/proxy/bodyrules.go
new file mode 100644
index 0000000..128464c
--- /dev/null
+++ b/internal/proxy/bodyrules.go
@@ -0,0 +1,45 @@
+package proxy
+
+import (
+	"bytes"
+	"io"
+
+	"mitmux/internal/rules"
+)
+
+// applyBodyRules reads body fully (bounded by maxCaptureBytes - a body
+// rule is opted into deliberately by whoever wrote it, but an unbounded
+// read of a maliciously or just accidentally huge body would still be a
+// memory-exhaustion vector) and, if it fits, runs bodyRules over it via
+// rules.ApplyBody and returns a fresh reader over the result.
+//
+// If the body is larger than the cap, it's passed straight through
+// completely unmodified - reconstructed from the bytes already read
+// plus whatever's left on the original reader - rather than rewriting
+// only part of it or dropping data. A body a rule can't safely see in
+// full is better left alone than partially corrupted; applied=false
+// tells the caller not to touch Content-Length, since the original
+// length (whatever it was) is still exactly right.
+func applyBodyRules(body io.ReadCloser, bodyRules []rules.Rule) (newBody io.ReadCloser, newLength int64, applied bool, err error) {
+	if body == nil {
+		return body, 0, false, nil
+	}
+
+	limited := io.LimitReader(body, maxCaptureBytes+1)
+	data, err := io.ReadAll(limited)
+	if err != nil {
+		body.Close()
+		return nil, 0, false, err
+	}
+
+	if int64(len(data)) > maxCaptureBytes {
+		return struct {
+			io.Reader
+			io.Closer
+		}{io.MultiReader(bytes.NewReader(data), body), body}, 0, false, nil
+	}
+
+	body.Close()
+	rewritten := rules.ApplyBody(data, bodyRules)
+	return io.NopCloser(bytes.NewReader(rewritten)), int64(len(rewritten)), true, nil
+}
diff --git a/internal/proxy/bodyrules_test.go b/internal/proxy/bodyrules_test.go
new file mode 100644
index 0000000..2a62855
--- /dev/null
+++ b/internal/proxy/bodyrules_test.go
@@ -0,0 +1,86 @@
+package proxy
+
+import (
+	"bytes"
+	"io"
+	"strings"
+	"testing"
+
+	"mitmux/internal/rules"
+)
+
+func TestApplyBodyRulesRewrites(t *testing.T) {
+	body := io.NopCloser(strings.NewReader(`{"admin":false}`))
+	rs := []rules.Rule{{Enabled: true, Part: "body", Match: "false", Replace: "true"}}
+
+	newBody, newLen, applied, err := applyBodyRules(body, rs)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !applied {
+		t.Fatal("expected applied=true")
+	}
+	got, _ := io.ReadAll(newBody)
+	want := `{"admin":true}`
+	if string(got) != want {
+		t.Errorf("body = %q, want %q", got, want)
+	}
+	if newLen != int64(len(want)) {
+		t.Errorf("newLength = %d, want %d", newLen, len(want))
+	}
+}
+
+func TestApplyBodyRulesNilBody(t *testing.T) {
+	newBody, newLen, applied, err := applyBodyRules(nil, []rules.Rule{{Enabled: true, Part: "body"}})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if applied || newBody != nil || newLen != 0 {
+		t.Errorf("expected no-op for nil body, got body=%v len=%d applied=%v", newBody, newLen, applied)
+	}
+}
+
+func TestApplyBodyRulesOversizedPassesThroughUnmodified(t *testing.T) {
+	// One byte over the cap: exercises the "too large to safely
+	// rewrite" path, which must reconstruct the ORIGINAL bytes exactly
+	// (not the rule applied, not truncated, not corrupted) since the
+	// whole point is refusing to guess at a partial rewrite.
+	big := bytes.Repeat([]byte("a"), maxCaptureBytes+1)
+	body := io.NopCloser(bytes.NewReader(big))
+	rs := []rules.Rule{{Enabled: true, Part: "body", Match: "a", Replace: "b"}}
+
+	newBody, newLen, applied, err := applyBodyRules(body, rs)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if applied {
+		t.Fatal("expected applied=false for an oversized body")
+	}
+	if newLen != 0 {
+		t.Errorf("expected newLength=0 (caller must not touch Content-Length) for an unapplied rewrite, got %d", newLen)
+	}
+	got, err := io.ReadAll(newBody)
+	if err != nil {
+		t.Fatalf("reading reconstructed body: %v", err)
+	}
+	if !bytes.Equal(got, big) {
+		t.Errorf("reconstructed body does not match original: got %d bytes, want %d bytes, equal=%v",
+			len(got), len(big), bytes.Equal(got, big))
+	}
+}
+
+func TestApplyBodyRulesExactlyAtCapStillApplies(t *testing.T) {
+	// Exactly at the cap (not over it) should still be treated as
+	// "fits" and get the rule applied - the +1 in the LimitReader is
+	// what distinguishes "at the limit" from "over the limit".
+	body := io.NopCloser(strings.NewReader(strings.Repeat("a", maxCaptureBytes)))
+	rs := []rules.Rule{{Enabled: true, Part: "body", Match: "a", Replace: "b"}}
+
+	_, _, applied, err := applyBodyRules(body, rs)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !applied {
+		t.Error("expected applied=true for a body exactly at the cap")
+	}
+}
diff --git a/internal/proxy/proxy.go b/internal/proxy/proxy.go
index 523ca01..aec724a 100644
--- a/internal/proxy/proxy.go
+++ b/internal/proxy/proxy.go
@@ -31,6 +31,7 @@ import (
 	"net"
 	"net/http"
 	"net/url"
+	"strconv"
 	"strings"
 	"sync"
 	"time"
@@ -400,17 +401,49 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 	// outReq), while what actually reaches the upstream server reflects
 	// the rules. That split is deliberate: match-and-replace is a wire
 	// transform, not a rewrite of the audit trail.
-	if reqRules, err := s.enabledRules("request"); err != nil {
+	reqRules, err := s.enabledRules("request")
+	if err != nil {
 		log.Printf("load request rules: %v", err)
-	} else if len(reqRules) > 0 {
+		reqRules = nil
+	}
+	if len(reqRules) > 0 {
 		outReq.Header = rules.ApplyHeaders(outReq.Header, reqRules)
 	}
 
-	// Only needed when the client leg isn't tee-captured (HTTP/2): tee
-	// the body as it streams through so the reconstructed capture isn't
-	// missing it.
+	// A body rule needs the body materialized in memory to rewrite it -
+	// the exact opposite of the normal streamed-straight-through path,
+	// which is what makes exact capture of an arbitrarily large body
+	// possible without ever buffering it. Only paid when a body rule is
+	// actually configured and enabled; everyone else keeps streaming.
 	var reqBodyCap *cappedTee
-	if clientTee == nil && outReq.Body != nil {
+	if rules.HasBodyRules(reqRules) && outReq.Body != nil {
+		if clientTee == nil {
+			// H2: nothing has captured this body's original bytes yet -
+			// wrap it first so draining it below (to apply the rule)
+			// captures them as a side effect, same as the unconditional
+			// wrap further down does when no body rule is in play.
+			reqBodyCap = newCappedTee(outReq.Body)
+			outReq.Body = io.NopCloser(reqBodyCap)
+		}
+		// H1: clientTee already captures every byte read off the client
+		// connection regardless of who's doing the reading, so draining
+		// outReq.Body here (which for H1 is the same underlying reader
+		// r.Body was, per Clone's documented behavior of not deep-
+		// copying Body) is captured exactly as if roundTripH1 had read
+		// it directly during the actual upstream write.
+		newBody, newLen, applied, bodyErr := applyBodyRules(outReq.Body, reqRules)
+		if bodyErr != nil {
+			log.Printf("apply request body rules: %v", bodyErr)
+		} else {
+			outReq.Body = newBody
+			if applied {
+				outReq.ContentLength = newLen
+			}
+		}
+	}
+	// Only needed when the client leg isn't tee-captured (HTTP/2) and a
+	// body rule hasn't already wrapped/captured it above.
+	if clientTee == nil && outReq.Body != nil && reqBodyCap == nil {
 		reqBodyCap = newCappedTee(outReq.Body)
 		outReq.Body = io.NopCloser(reqBodyCap)
 	}
@@ -435,7 +468,6 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 
 	var resp *http.Response
 	var upstreamTee *teeConn
-	var err error
 	if negotiated == http2.NextProtoTLS {
 		resp, err = roundTripH2(conn, outReq)
 	} else {
@@ -456,6 +488,12 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 	}
 	defer resp.Body.Close()
 
+	respRules, err := s.enabledRules("response")
+	if err != nil {
+		log.Printf("load response rules: %v", err)
+		respRules = nil
+	}
+
 	var respBodyCap *cappedTee
 	if upstreamTee == nil {
 		respBodyCap = newCappedTee(resp.Body)
@@ -466,13 +504,31 @@ func (s *Server) forward(dial dialer, scheme, hostname string, w http.ResponseWr
 	// the origin server actually sent (captured below, from upstreamTee
 	// or respBodyCap, both already wired to resp.Body independent of
 	// resp.Header), while the client actually receives the rule-modified
-	// headers.
-	if respRules, err := s.enabledRules("response"); err != nil {
-		log.Printf("load response rules: %v", err)
-	} else if len(respRules) > 0 {
+	// headers/body.
+	if len(respRules) > 0 {
 		resp.Header = rules.ApplyHeaders(resp.Header, respRules)
 	}
 
+	if rules.HasBodyRules(respRules) && resp.Body != nil {
+		newBody, newLen, applied, bodyErr := applyBodyRules(resp.Body, respRules)
+		if bodyErr != nil {
+			log.Printf("apply response body rules: %v", bodyErr)
+		} else {
+			resp.Body = newBody
+			if applied {
+				// Unlike http.Request.Write (which derives the wire
+				// Content-Length from req.ContentLength regardless of any
+				// stale header), http.ResponseWriter does not: the loop
+				// below just forwards whatever's in resp.Header verbatim.
+				// A body rule that changes length would otherwise leave a
+				// stale Content-Length on the wire and corrupt response
+				// framing for the client.
+				resp.ContentLength = newLen
+				resp.Header.Set("Content-Length", strconv.FormatInt(newLen, 10))
+			}
+		}
+	}
+
 	stripHopByHop(resp.Header)
 	for k, vv := range resp.Header {
 		for _, v := range vv {
diff --git a/internal/rules/rules.go b/internal/rules/rules.go
index 1f50ec4..e0547db 100644
--- a/internal/rules/rules.go
+++ b/internal/rules/rules.go
@@ -1,7 +1,6 @@
 // Package rules implements match-and-replace: user-defined rules that
-// rewrite request/response headers as they pass through the proxy.
-// Deliberately headers-only for now - see ApplyHeaders for why bodies
-// are a separate, harder problem (noted as a follow-up in PLAN.md).
+// rewrite request/response headers or bodies as they pass through the
+// proxy. See ApplyHeaders and ApplyBody for how each part is handled.
 package rules
 
 import (
@@ -19,7 +18,7 @@ type Rule struct {
 	Enabled bool
 	Name    string
 	Scope   string // "request" or "response"
-	Part    string // "header" (only part supported so far)
+	Part    string // "header" or "body"
 	Match   string
 	Replace string
 	IsRegex bool
@@ -75,6 +74,42 @@ func ApplyHeaders(h http.Header, rs []Rule) http.Header {
 	return http.Header(mh)
 }
 
+// HasBodyRules reports whether any of rs (already filtered to enabled
+// rules for one scope, as returned by store.EnabledRules) is a body
+// rule - used to decide whether materializing a request/response body
+// at all is worth it. Most traffic has no body rule configured and
+// should keep streaming through unbuffered, which is what makes exact
+// capture of arbitrarily large bodies possible in the first place.
+func HasBodyRules(rs []Rule) bool {
+	for _, r := range rs {
+		if r.Enabled && r.Part == "body" {
+			return true
+		}
+	}
+	return false
+}
+
+// ApplyBody rewrites body by running every enabled rule with
+// Part=="body" over it, in Position order - literal substring replace
+// by default, or regex if the rule's Regex toggle is on. Unlike
+// ApplyHeaders, this operates directly on raw bytes with no reparse/
+// validation step: body content isn't a fixed format the way a header
+// block is, so there's nothing to parse back and confirm is still
+// well-formed. A rule that doesn't match anything is simply a no-op,
+// same as ApplyHeaders.
+func ApplyBody(body []byte, rs []Rule) []byte {
+	text := string(body)
+	for _, r := range sortedByPosition(rs) {
+		if !r.Enabled || r.Part != "body" {
+			continue
+		}
+		if next, ok := apply(text, r); ok {
+			text = next
+		}
+	}
+	return []byte(text)
+}
+
 func sortedByPosition(rs []Rule) []Rule {
 	out := make([]Rule, len(rs))
 	copy(out, rs)
diff --git a/internal/rules/rules_test.go b/internal/rules/rules_test.go
new file mode 100644
index 0000000..3368607
--- /dev/null
+++ b/internal/rules/rules_test.go
@@ -0,0 +1,93 @@
+package rules
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestHasBodyRules(t *testing.T) {
+	tests := []struct {
+		name string
+		rs   []Rule
+		want bool
+	}{
+		{"empty", nil, false},
+		{"header rule only", []Rule{{Enabled: true, Part: "header"}}, false},
+		{"body rule enabled", []Rule{{Enabled: true, Part: "body"}}, true},
+		{"body rule disabled", []Rule{{Enabled: false, Part: "body"}}, false},
+		{"mixed, one enabled body rule", []Rule{
+			{Enabled: true, Part: "header"},
+			{Enabled: true, Part: "body"},
+		}, true},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := HasBodyRules(tt.rs); got != tt.want {
+				t.Errorf("HasBodyRules(%+v) = %v, want %v", tt.rs, got, tt.want)
+			}
+		})
+	}
+}
+
+func TestApplyBodyLiteral(t *testing.T) {
+	body := []byte(`{"admin":false,"user":"bob"}`)
+	rs := []Rule{{Enabled: true, Part: "body", Match: `"admin":false`, Replace: `"admin":true`}}
+	got := ApplyBody(body, rs)
+	want := `{"admin":true,"user":"bob"}`
+	if string(got) != want {
+		t.Errorf("ApplyBody = %q, want %q", got, want)
+	}
+}
+
+func TestApplyBodyRegex(t *testing.T) {
+	body := []byte(`user_id=12345&session=abc`)
+	rs := []Rule{{Enabled: true, Part: "body", Match: `user_id=\d+`, Replace: "user_id=1", IsRegex: true}}
+	got := ApplyBody(body, rs)
+	want := `user_id=1&session=abc`
+	if string(got) != want {
+		t.Errorf("ApplyBody = %q, want %q", got, want)
+	}
+}
+
+func TestApplyBodySkipsDisabledAndHeaderRules(t *testing.T) {
+	body := []byte("hello world")
+	rs := []Rule{
+		{Enabled: false, Part: "body", Match: "hello", Replace: "bye"},
+		{Enabled: true, Part: "header", Match: "world", Replace: "planet"},
+	}
+	got := ApplyBody(body, rs)
+	if string(got) != "hello world" {
+		t.Errorf("ApplyBody = %q, want unchanged %q", got, "hello world")
+	}
+}
+
+func TestApplyBodyRespectsPositionOrder(t *testing.T) {
+	body := []byte("aaa")
+	rs := []Rule{
+		{Enabled: true, Part: "body", Match: "a", Replace: "b", Position: 1},
+		{Enabled: true, Part: "body", Match: "b", Replace: "c", Position: 0},
+	}
+	// Position 0 runs first: "aaa" -[b->c, no match]-> "aaa" -[a->b]-> "bbb"
+	got := ApplyBody(body, rs)
+	if string(got) != "bbb" {
+		t.Errorf("ApplyBody = %q, want %q", got, "bbb")
+	}
+}
+
+func TestApplyHeadersAddsRemovesHeader(t *testing.T) {
+	h := http.Header{"Host": []string{"example.com"}}
+	rs := []Rule{{Enabled: true, Part: "header", Match: "Host: example.com", Replace: "Host: example.com\r\nX-Injected: 1"}}
+	got := ApplyHeaders(h, rs)
+	if got.Get("X-Injected") != "1" {
+		t.Errorf("expected X-Injected header to be added, got %+v", got)
+	}
+}
+
+func TestApplyHeadersInvalidRegexLeavesUnchanged(t *testing.T) {
+	h := http.Header{"Host": []string{"example.com"}}
+	rs := []Rule{{Enabled: true, Part: "header", Match: "(unclosed", Replace: "x", IsRegex: true}}
+	got := ApplyHeaders(h, rs)
+	if got.Get("Host") != "example.com" {
+		t.Errorf("expected headers unchanged on invalid regex, got %+v", got)
+	}
+}