fix(http): enforce body size limits for streamed requests

[github-actions]

Related Links

• Closes Enforce request body size when Content-Length is absent #27

Summary

Implemented request body enforcement against actual streamed bytes, so oversized POST/PATCH bodies are rejected even when Content-Length is absent. Accepted bodies are cached back onto the request so FastAPI can still parse them normally.

Files changed

• app/request_limits.py: Added streamed body size enforcement and shared 413 response builder.
• app/main.py: Runs streamed body enforcement before rate limiting.
• tests/contract/test_http_contract.py: Added no-Content-Length regression coverage and replay validation.
• tests/contract/test_mcp_http_transport.py: Updated MCP oversized-body coverage.
• README.md: Updated request body limit documentation.

Validation

Ran successfully:

ruff format --check app/request_limits.py app/main.py tests/contract/test_http_contract.py tests/contract/test_mcp_http_transport.py
ruff check app/request_limits.py app/main.py tests/contract/test_http_contract.py tests/contract/test_mcp_http_transport.py
pytest tests/contract/test_http_contract.py -k 'body or content_length' tests/contract/test_mcp_http_transport.py::test_mcp_http_rejects_oversized_body_before_transport_parsing -vv
git diff --check

pytest full suite was attempted but was inconclusive: it hung in this runner. I also verified a minimal no-middleware FastAPI TestClient call hangs in the same environment, so this appears unrelated to the change.

Risks

The streamed enforcement buffers valid request bodies up to the configured limit so downstream handlers can parse them. That is bounded by MEMORIES_REQUEST_BODY_MAX_BYTES.

Follow-up

Maintainers should run the normal CI validation in the project’s standard environment, especially full pytest.

Test Steps

• Agent validation passed: ruff format --check ., ruff check ., and pytest
• Agent code review workflow run
• Human reviewed the implementation
• Human checked relevant edge cases
• Human confirmed issue requirements are fully satisfied

Other Notes

This draft PR was created automatically. Human review is required before marking it ready for review or merging.

[github-actions]

Agent PR review

Validation

Validation passed: ruff format --check ., ruff check ., and pytest all completed successfully.

Summary

This PR adds streamed request-body size enforcement for POST/PATCH /memories* and /mcp* requests, so oversized bodies without Content-Length are rejected with 413. It also caches accepted bodies back onto the request for downstream FastAPI parsing, updates contract tests, and adjusts README wording.

Issues and risks

• severity: medium
• file or area: app/main.py:163 to app/main.py:180
• why it matters: the new streamed body check runs before MCP origin allowlist rejection and before rate limiting. That means disallowed browser-origin /mcp requests and already-rate-limited write/MCP requests can still force the server to read and buffer up to MEMORIES_REQUEST_BODY_MAX_BYTES before being rejected. The cap bounds memory per request, but it weakens the cost-saving behavior of the origin/rate-limit gates.
• suggested fix: run the MCP origin rejection before streamed body consumption, and consider whether rate-limited requests should be rejected before body streaming when the declared Content-Length is absent or under the limit. Add a regression test for disallowed-origin /mcp requests with a streamed body.

No other blocking correctness issues stood out from the diff. The Starlette version here uses _CachedRequest.wrapped_receive, and the PR’s _body replay approach appears compatible with that implementation.

Test coverage

The PR adds useful contract coverage for oversized streamed REST bodies without Content-Length, body replay after streaming, and MCP oversized-body rejection. It also keeps coverage for declared Content-Length rejection and body-limit-before-rate-limit behavior.

Important missing coverage: disallowed MCP browser origins with streamed bodies, exact-at-limit bodies, and streamed oversized MCP bodies without Content-Length.

Provided review context reports validation passed for ruff format --check ., ruff check ., and pytest. I could not independently run pytest in this sandbox because Python could not find any writable temporary directory.

Recommendation

Needs changes before merge.

---

This is an automated review. Please treat it as advisory; human review is still required.