From 52130347fc1f49d4a43d995b1ffa5455157c65ec Mon Sep 17 00:00:00 2001
From: Cursor Agent <cursoragent@cursor.com>
Date: Tue, 13 Oct 2026 15:34:39 +0000
Subject: [PATCH] Test check_body_limit Content-Length branches

Pin the Python body-size guard for a missing, non-numeric, negative,
equal, and over-limit Content-Length without changing the responses.

Co-authored-by: herklos.dev <herklos.dev@protonmail.com>
---
 CHANGELOG.md                                  |  3 ++
 .../server/tests/router/test_body_limit.py    | 33 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 packages/python/server/tests/router/test_body_limit.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1bb39b4a..efd2ea63 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@
 ### Changed
 - **README**: package count corrected to 33 (lockstep TS + Python families, including TypeScript-only `webhook` and `events`).
 
+### Added
+- **Python server**: direct unit tests for `check_body_limit` Content-Length branches (missing, non-numeric, negative, equal to the cap, and over the cap).
+
 Adds a third storage tier, `"isolated"`, to `starfish-replica`'s space-mirror
 channel: a collection whose node is sealed under its OWN per-node keyring
 rather than the space-wide one, so access can be granted and revoked one node
diff --git a/packages/python/server/tests/router/test_body_limit.py b/packages/python/server/tests/router/test_body_limit.py
new file mode 100644
index 00000000..f6705330
--- /dev/null
+++ b/packages/python/server/tests/router/test_body_limit.py
@@ -0,0 +1,33 @@
+"""Direct unit tests for check_body_limit Content-Length branches."""
+
+import json
+
+import pytest
+from fastapi.responses import JSONResponse
+
+from starfish_server.router.middleware import check_body_limit
+
+
+@pytest.mark.parametrize(
+    ("content_length", "status_code", "error"),
+    [
+        (None, None, None),
+        ("abc", 400, "Invalid Content-Length"),
+        ("1.5", 400, "Invalid Content-Length"),
+        ("-1", 400, "Invalid Content-Length"),
+        ("100", None, None),
+        ("101", 413, "Payload too large"),
+    ],
+)
+def test_check_body_limit_content_length(
+    content_length: str | None,
+    status_code: int | None,
+    error: str | None,
+) -> None:
+    result = check_body_limit(content_length, 100)
+    if status_code is None:
+        assert result is None
+        return
+    assert isinstance(result, JSONResponse)
+    assert result.status_code == status_code
+    assert json.loads(result.body) == {"error": error}