fix(ghost): use well-known redirect port when scheme is unchanged - #80

Problem

build_location in ghost/src/redirect_backend.rs only substituted the redirect scheme's well-known port when the filter scheme differed from the request scheme:

} else if config.filter.scheme.is_some()
    && config.filter.scheme.as_deref() != Some(&config.original_scheme)
{

The Gateway API spec for HTTPRequestRedirectFilter.port has no such condition:

• If redirect scheme is not-empty, the redirect port MUST be the well-known port associated with the redirect scheme. Specifically "http" to port 80 and "https" to port 443. If the redirect scheme does not have a well-known port, the listener port of the Gateway SHOULD be used.
• If redirect scheme is empty, the redirect port MUST be the Gateway Listener port.

So on a listener bound to a non-standard port, requestRedirect: {scheme: http} with no port emitted http://example.org:8080/ where the spec wants http://example.org/.

Fix

Port resolution is now a direct reading of the spec — explicit port wins, otherwise the redirect scheme's well-known port, otherwise the listener port:

let port = if let Some(explicit_port) = config.filter.port {
    explicit_port
} else {
    match config.filter.scheme.as_deref() {
        Some("http") => 80,
        Some("https") => 443,
        _ => config.original_port,
    }
};

Two behaviour changes:

1. Same-scheme with nil port now resolves to the well-known port (the reported bug).
2. A redirect scheme with no well-known port falls back to the listener port. The old else { 80 } branch assigned port 80 to any non-https scheme; the spec says the listener port SHOULD be used. Not reachable today since the operator only accepts http/https, but the match arms make the rule explicit rather than incidental.

No change when the scheme genuinely differs — that path was already correct.

Why conformance did not catch this

HTTPRouteRedirectPortAndScheme never exercises the buggy branch:

• The same-namespace-with-http-listener-on-8080 block has only scheme-nil-and-port-nil, scheme-nil-and-port-80, and scheme-https-and-port-nil.
• scheme-http-and-port-nil appears only in the 443 block, where the scheme does change.
• On the 80 listener the same-scheme case passed by accident, because the original port was already 80.

Added test_build_location_same_scheme_uses_well_known_port covering http-on-8080, https-on-8443, and the scheme: nil control case that must keep 8080. Its comment records why the test exists, since conformance won't flag a regression.

Testing

cargo test --lib — 78 passed. cargo clippy --lib clean.

Note: cargo fmt wants to reformat build.rs, config.rs, director.rs, and external_backend.rs — pre-existing churn on main, deliberately left out of this PR.

🤖 Generated with Claude Code