Release Core v0.1.32 with bounded HTTP request bodies

tests/test_http_fetch.py

@@ -2,9 +2,14 @@ from __future__ import annotations
 
 import io
 import unittest
-from unittest.mock import patch
+from unittest.mock import Mock, patch
 
-from govoplan_core.security.http_fetch import _PolicyRedirectHandler, is_http_url, validate_http_url
+from govoplan_core.security.http_fetch import (
+    _PolicyRedirectHandler,
+    fetch_http,
+    is_http_url,
+    validate_http_url,
+)
 from govoplan_core.security.outbound_http import (
     DEFAULT_FILE_TRANSFER_BYTES,
     DEFAULT_STRUCTURED_RESPONSE_BYTES,
@@ -21,6 +26,51 @@ from govoplan_core.security.outbound_http import (
 
 
 class HttpFetchTests(unittest.TestCase):
+    def test_fetch_http_forwards_a_bounded_request_body(self) -> None:
+        class Response(io.BytesIO):
+            status = 200
+            headers = {"Content-Type": "application/json"}
+
+            def __enter__(self):
+                return self
+
+            def __exit__(self, *_args):
+                return False
+
+        opener = Mock()
+        opener.open.return_value = Response(b"{}")
+        with patch(
+            "govoplan_core.security.http_fetch.validate_outbound_http_url",
+            return_value="https://wiki.example.test/api.php",
+        ), patch(
+            "govoplan_core.security.http_fetch.build_outbound_http_opener",
+            return_value=opener,
+        ):
+            response = fetch_http(
+                "https://wiki.example.test/api.php",
+                method="POST",
+                headers={"Content-Type": "application/x-www-form-urlencoded"},
+                body=b"action=edit",
+                max_bytes=1024,
+            )
+
+        request = opener.open.call_args.args[0]
+        self.assertEqual("POST", request.get_method())
+        self.assertEqual(b"action=edit", request.data)
+        self.assertEqual(b"{}", response.body)
+
+    def test_fetch_http_rejects_an_oversized_request_body_before_transport(self) -> None:
+        with patch(
+            "govoplan_core.security.http_fetch.validate_outbound_http_url"
+        ) as validate:
+            with self.assertRaisesRegex(ValueError, "request body exceeds"):
+                fetch_http(
+                    "https://wiki.example.test/api.php",
+                    method="POST",
+                    body=b"x" * 1_000_001,
+                )
+        validate.assert_not_called()
+
     def test_validate_http_url_accepts_absolute_http_urls_without_credentials(self) -> None:
         self.assertEqual("https://example.test/catalog.json", validate_http_url("https://example.test/catalog.json"))
         self.assertTrue(is_http_url("http://example.test/catalog.json"))