From c8e4f9c0e7aa44798672f2167ff3bcfc6842c596 Mon Sep 17 00:00:00 2001
From: Chen Hongzhi <chz@chenhongzhi.com>
Date: Wed, 24 Dec 2025 14:56:22 +0800
Subject: [PATCH 1/2] feat(conn): support HTTP proxy basic authentication

---
 src/client/legacy/client.rs      |  7 ++++++-
 src/client/legacy/connect/mod.rs | 16 +++++++++++++++-
 2 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/client/legacy/client.rs b/src/client/legacy/client.rs
index 8265d4b7..898c7005 100644
--- a/src/client/legacy/client.rs
+++ b/src/client/legacy/client.rs
@@ -14,7 +14,7 @@ use std::time::Duration;
 use futures_util::future::{self, Either, FutureExt, TryFutureExt};
 use http::uri::Scheme;
 use hyper::client::conn::TrySendError as ConnTrySendError;
-use hyper::header::{HeaderValue, HOST};
+use hyper::header::{HeaderValue, HOST, PROXY_AUTHORIZATION};
 use hyper::rt::Timer;
 use hyper::{body::Body, Method, Request, Response, Uri, Version};
 use tracing::{debug, trace, warn};
@@ -315,6 +315,11 @@ where
                 authority_form(req.uri_mut());
             } else if pooled.conn_info.is_proxied {
                 absolute_form(req.uri_mut());
+                if let Some(proxy_auth) = &pooled.conn_info.proxy_basic_auth {
+                    req.headers_mut()
+                        .entry(PROXY_AUTHORIZATION)
+                        .or_insert_with(|| proxy_auth.clone());
+                }
             } else {
                 origin_form(req.uri_mut());
             }
diff --git a/src/client/legacy/connect/mod.rs b/src/client/legacy/connect/mod.rs
index 90a97679..9ed05bc3 100644
--- a/src/client/legacy/connect/mod.rs
+++ b/src/client/legacy/connect/mod.rs
@@ -70,7 +70,7 @@ use std::{
     },
 };
 
-use ::http::Extensions;
+use ::http::{Extensions, HeaderValue};
 
 #[cfg(feature = "tokio")]
 pub use self::http::{HttpConnector, HttpInfo};
@@ -101,6 +101,7 @@ pub trait Connection {
 pub struct Connected {
     pub(super) alpn: Alpn,
     pub(super) is_proxied: bool,
+    pub(crate) proxy_basic_auth: Option<HeaderValue>,
     pub(super) extra: Option<Extra>,
     pub(super) poisoned: PoisonPill,
 }
@@ -151,6 +152,7 @@ impl Connected {
         Connected {
             alpn: Alpn::None,
             is_proxied: false,
+            proxy_basic_auth: None,
             extra: None,
             poisoned: PoisonPill::healthy(),
         }
@@ -184,6 +186,17 @@ impl Connected {
         self.is_proxied
     }
 
+    /// Set the Proxy-Authorization header value for HTTP Proxy authentication.
+    pub fn proxy_basic_auth(mut self, auth: HeaderValue) -> Connected {
+        self.proxy_basic_auth = Some(auth);
+        self
+    }
+
+    /// Get the Proxy-Authorization header value for HTTP Proxy authentication.
+    pub fn get_proxy_basic_auth(&self) -> Option<&HeaderValue> {
+        self.proxy_basic_auth.as_ref()
+    }
+
     /// Set extra connection information to be set in the extensions of every `Response`.
     pub fn extra<T: Clone + Send + Sync + 'static>(mut self, extra: T) -> Connected {
         if let Some(prev) = self.extra {
@@ -228,6 +241,7 @@ impl Connected {
         Connected {
             alpn: self.alpn,
             is_proxied: self.is_proxied,
+            proxy_basic_auth: self.proxy_basic_auth.clone(),
             extra: self.extra.clone(),
             poisoned: self.poisoned.clone(),
         }

From 4b02cf9e1ecdb65d39494bc5e1197d3364ca1529 Mon Sep 17 00:00:00 2001
From: Chen Hongzhi <chz@chenhongzhi.com>
Date: Mon, 29 Dec 2025 12:18:53 +0800
Subject: [PATCH 2/2] refactor(conn): narrow proxy_basic_auth visibility to
 pub(super)

---
 src/client/legacy/connect/mod.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/client/legacy/connect/mod.rs b/src/client/legacy/connect/mod.rs
index 9ed05bc3..54bb8c51 100644
--- a/src/client/legacy/connect/mod.rs
+++ b/src/client/legacy/connect/mod.rs
@@ -101,7 +101,7 @@ pub trait Connection {
 pub struct Connected {
     pub(super) alpn: Alpn,
     pub(super) is_proxied: bool,
-    pub(crate) proxy_basic_auth: Option<HeaderValue>,
+    pub(super) proxy_basic_auth: Option<HeaderValue>,
     pub(super) extra: Option<Extra>,
     pub(super) poisoned: PoisonPill,
 }