Complete RC6 supply chain gates

backend/tests/test_request_target_security.py

@@ -0,0 +1,36 @@
+from fastapi.testclient import TestClient
+
+from app.main import app
+
+
+client = TestClient(app)
+
+
+def test_invalid_host_request_target_is_rejected_canonically() -> None:
+    response = client.get("/health/live", headers={"host": "trusted.example/@admin"})
+
+    assert response.status_code == 400
+    assert response.headers["x-request-id"]
+    assert response.json()["error"] == "INVALID_REQUEST_TARGET"
+    assert response.json()["request_id"] == response.headers["x-request-id"]
+
+
+def test_urlencoded_form_body_is_rejected_before_starlette_form_parsing() -> None:
+    response = client.post(
+        "/api/v1/datasets/upload",
+        headers={"content-type": "application/x-www-form-urlencoded"},
+        content="dataset_type=vector&field=" + ("x" * 10_000),
+    )
+
+    assert response.status_code == 415
+    assert response.json()["error"] == "UNSUPPORTED_CONTENT_TYPE"
+
+
+def test_multipart_upload_contract_remains_available() -> None:
+    response = client.post(
+        "/health/live",
+        files={"file": ("empty.geojson", b"{}", "application/geo+json")},
+        data={"dataset_type": "vector"},
+    )
+
+    assert response.status_code == 405