test_content_size_middleware.py
python
sha256:a10adeeb7a0169cb9900f9806ed7a973047258abb6283724fe55e8eb68ff3f0a
init: musehub initial commit
Human
171 days ago
| 1 | """Tests for ContentSizeLimitMiddleware (checklist 2.3 — body size cap).""" |
| 2 | from __future__ import annotations |
| 3 | |
| 4 | import pytest |
| 5 | from httpx import AsyncClient |
| 6 | |
| 7 | from musehub.middleware.content_size import API_MAX_BYTES, PUSH_MAX_BYTES |
| 8 | |
| 9 | |
| 10 | @pytest.mark.anyio |
| 11 | async def test_api_request_within_limit_passes( |
| 12 | client: AsyncClient, |
| 13 | ) -> None: |
| 14 | """A body under 10 MB on an API route must not be rejected by the middleware.""" |
| 15 | small_body = b"x" * 1024 # 1 KB |
| 16 | resp = await client.post( |
| 17 | "/api/repos", |
| 18 | content=small_body, |
| 19 | headers={"Content-Type": "application/json", "Content-Length": str(len(small_body))}, |
| 20 | ) |
| 21 | # May be 422 (invalid JSON) or 401 (auth required) — not 413 |
| 22 | assert resp.status_code != 413 |
| 23 | |
| 24 | |
| 25 | @pytest.mark.anyio |
| 26 | async def test_api_request_over_limit_returns_413( |
| 27 | client: AsyncClient, |
| 28 | ) -> None: |
| 29 | """Content-Length over 10 MB on a non-push route must return 413.""" |
| 30 | over_limit = API_MAX_BYTES + 1 |
| 31 | resp = await client.post( |
| 32 | "/api/repos", |
| 33 | headers={"Content-Length": str(over_limit)}, |
| 34 | content=b"", # actual body irrelevant — Content-Length header drives the check |
| 35 | ) |
| 36 | assert resp.status_code == 413 |
| 37 | assert "too large" in resp.json()["detail"].lower() |
| 38 | |
| 39 | |
| 40 | @pytest.mark.anyio |
| 41 | async def test_push_request_under_push_limit_not_rejected( |
| 42 | client: AsyncClient, |
| 43 | db_session, |
| 44 | ) -> None: |
| 45 | """Content-Length under 500 MB on a push route must not be rejected by the middleware.""" |
| 46 | from tests.factories import create_repo |
| 47 | repo = await create_repo(db_session, slug="size-check-repo", owner="size-user") |
| 48 | import msgpack |
| 49 | body = msgpack.packb( |
| 50 | {"bundle": {"commits": [], "snapshots": [], "objects": []}, "branch": "main"}, |
| 51 | use_bin_type=True, |
| 52 | ) |
| 53 | # No auth → will get 401, but that's AFTER the size check — must not be 413 |
| 54 | resp = await client.post( |
| 55 | f"/{repo.owner}/{repo.slug}/push", |
| 56 | content=body, |
| 57 | headers={"Content-Type": "application/x-msgpack"}, |
| 58 | ) |
| 59 | assert resp.status_code != 413 |
| 60 | |
| 61 | |
| 62 | @pytest.mark.anyio |
| 63 | async def test_push_request_over_api_limit_but_under_push_limit_allowed( |
| 64 | client: AsyncClient, |
| 65 | ) -> None: |
| 66 | """A 20 MB Content-Length on the push path must NOT return 413 (push limit is 500 MB).""" |
| 67 | over_api_limit = API_MAX_BYTES * 2 # 20 MB — over API limit but under push limit |
| 68 | resp = await client.post( |
| 69 | "/gabriel/my-repo/push", |
| 70 | headers={"Content-Length": str(over_api_limit)}, |
| 71 | content=b"", |
| 72 | ) |
| 73 | # Should get 401 (no auth) or 422 (bad body) — not 413 |
| 74 | assert resp.status_code != 413 |
| 75 | |
| 76 | |
| 77 | @pytest.mark.anyio |
| 78 | async def test_push_objects_path_uses_push_limit( |
| 79 | client: AsyncClient, |
| 80 | ) -> None: |
| 81 | """/{owner}/{slug}/push/objects must also use the 500 MB limit, not 10 MB.""" |
| 82 | over_api_limit = API_MAX_BYTES + 1 |
| 83 | resp = await client.post( |
| 84 | "/gabriel/my-repo/push/objects", |
| 85 | headers={"Content-Length": str(over_api_limit)}, |
| 86 | content=b"", |
| 87 | ) |
| 88 | assert resp.status_code != 413 |
| 89 | |
| 90 | |
| 91 | def test_limits_are_correct_values() -> None: |
| 92 | assert API_MAX_BYTES == 10 * 1024 * 1024 |
| 93 | assert PUSH_MAX_BYTES == 500 * 1024 * 1024 |
File History
1 commit
sha256:a10adeeb7a0169cb9900f9806ed7a973047258abb6283724fe55e8eb68ff3f0a
init: musehub initial commit
Human
171 days ago