feat(auth): harden Authentik and guest capability boundaries

backend/tests/test_request_target_security.py

@@ -1,3 +1,4 @@
+import pytest
 from fastapi.testclient import TestClient
 
 from app.main import app
@@ -6,8 +7,16 @@ from app.main import app
 client = TestClient(app)
 
 
-def test_invalid_host_request_target_is_rejected_canonically() -> None:
-    response = client.get("/health/live", headers={"host": "trusted.example/@admin"})
+@pytest.mark.parametrize(
+    "host",
+    [
+        "trusted.example/@admin",
+        "trusted.example?shadow=admin",
+        "trusted.example#shadow",
+    ],
+)
+def test_invalid_host_request_target_is_rejected_canonically(host: str) -> None:
+    response = client.get("/health/live", headers={"host": host})
 
     assert response.status_code == 400
     assert response.headers["x-request-id"]
@@ -15,6 +24,16 @@ def test_invalid_host_request_target_is_rejected_canonically() -> None:
     assert response.json()["request_id"] == response.headers["x-request-id"]
 
 
+@pytest.mark.parametrize(
+    "host",
+    ["localhost:1202", "127.0.0.1:8000", "[::1]:8000", "testserver"],
+)
+def test_normal_host_forms_remain_available(host: str) -> None:
+    response = client.get("/health/live", headers={"host": host})
+
+    assert response.status_code == 200
+
+
 def test_urlencoded_form_body_is_rejected_before_starlette_form_parsing() -> None:
     response = client.post(
         "/api/v1/datasets/upload",