Mateo Wang e34c779c67 fix(proxy): decode zstd and gzip request bodies before auth reads them (#47418) ... * test(proxy): cover gzip and zstd request bodies on /v1/systemone * fix(proxy): decode zstd and gzip request bodies before auth reads them * fix(proxy): bound request body decompression and keep it inside CORS Limit the decoded size by an expansion ratio and the operator's max_request_size_mb, pass bodies without the coding's magic number through, answer 415 when zstd is unavailable, and register the middleware innermost so errors carry CORS and security headers * fix(proxy): budget decoded request bodies per worker and forward plugin bodies as sent Each worker holds at most MAX_DECOMPRESSED_REQUEST_BODIES_IN_FLIGHT_MB of decoded bodies and answers 503 past it. /plugin-proxy/ bodies reach the plugin as sent, a zstd skippable frame counts as zstd, the decoded-size 413 names the decoded limit, and an integer max_request_size_mb stays an integer in the 413 text. * fix(proxy): read the magic number before size limits and reserve declared decoded sizes * test(proxy): pin gzip mtime so parametrized test ids match across xdist workers * fix(proxy): parse max_request_size_mb the same way in the auth size check * fix(proxy): pass Claude Code OTLP export bodies through undecoded and skip the size parse without premium * test(proxy): cover client disconnects, chunked bodies past the cap, and body-less request messages in the decompression middleware * test(proxy): name the decompression test cases so CI logs stay small		2026-10-20 05:11:30 +00:00
..
__init__.py	feat(decisions): add unified /v1/decisions endpoint for Jev-compatible providers (#44236)	2026-10-03 17:38:38 +00:00
test_endpoints.py	fix(proxy): decode zstd and gzip request bodies before auth reads them (#47418)	2026-10-20 05:11:30 +00:00