Release Core v0.1.32 with bounded HTTP request bodies

src/govoplan_core/security/http_fetch.py

@@ -12,6 +12,9 @@ from govoplan_core.security.outbound_http import (
 )
 
 
+MAX_OUTBOUND_HTTP_REQUEST_BODY_BYTES = 1_000_000
+
+
 @dataclass(frozen=True, slots=True)
 class HttpFetchResponse:
     status: int
@@ -46,11 +49,17 @@ def fetch_http(
     label: str = "URL",
     method: str = "GET",
     headers: Mapping[str, str] | None = None,
+    body: bytes | None = None,
     max_bytes: int | None = None,
 ) -> HttpFetchResponse:
+    if body is not None and len(body) > MAX_OUTBOUND_HTTP_REQUEST_BODY_BYTES:
+        raise ValueError(
+            "Outbound HTTP request body exceeds the 1000000-byte safety limit."
+        )
     validated_url = validate_outbound_http_url(url, label=label)
     request = urllib.request.Request(  # noqa: S310 - URL is restricted to validated HTTP(S).
         validated_url,
+        data=body,
         headers=dict(headers or {}),
         method=method,
     )
@@ -76,10 +85,19 @@ def fetch_http_text(
     label: str = "URL",
     method: str = "GET",
     headers: Mapping[str, str] | None = None,
+    body: bytes | None = None,
     encoding: str = "utf-8",
     max_bytes: int | None = None,
 ) -> str:
-    return fetch_http(url, timeout=timeout, label=label, method=method, headers=headers, max_bytes=max_bytes).text(encoding)
+    return fetch_http(
+        url,
+        timeout=timeout,
+        label=label,
+        method=method,
+        headers=headers,
+        body=body,
+        max_bytes=max_bytes,
+    ).text(encoding)
 
 
 class _PolicyRedirectHandler(urllib.request.HTTPRedirectHandler):