import pytest from fastapi.testclient import TestClient from app.main import app client = TestClient(app) @pytest.mark.parametrize( "host", [ "trusted.example/@admin", "trusted.example?shadow=admin", "trusted.example#shadow", ], ) def test_invalid_host_request_target_is_rejected_canonically(host: str) -> None: response = client.get("/health/live", headers={"host": host}) assert response.status_code == 400 assert response.headers["x-request-id"] assert response.json()["error"] == "INVALID_REQUEST_TARGET" assert response.json()["request_id"] == response.headers["x-request-id"] @pytest.mark.parametrize( "host", ["localhost:1202", "127.0.0.1:8000", "[::1]:8000", "testserver"], ) def test_normal_host_forms_remain_available(host: str) -> None: response = client.get("/health/live", headers={"host": host}) assert response.status_code == 200 def test_urlencoded_form_body_is_rejected_before_starlette_form_parsing() -> None: response = client.post( "/api/v1/datasets/upload", headers={"content-type": "application/x-www-form-urlencoded"}, content="dataset_type=vector&field=" + ("x" * 10_000), ) assert response.status_code == 415 assert response.json()["error"] == "UNSUPPORTED_CONTENT_TYPE" def test_multipart_upload_contract_remains_available() -> None: response = client.post( "/health/live", files={"file": ("empty.geojson", b"{}", "application/geo+json")}, data={"dataset_type": "vector"}, ) assert response.status_code == 405