fix: restore reliable authenticated live recognition

recognization/code/test_api.py

@@ -155,6 +155,47 @@ class RestContractTests(unittest.TestCase):
         self.assertEqual(response.status_code, 415)
         self.assertEqual(response.json()["error"]["code"], "UNSUPPORTED_MEDIA_TYPE")
 
+    def test_a_lying_content_length_is_rejected_while_streaming(self):
+        """The ASGI receive stops once the body passes the cap, before decode."""
+        import anyio
+
+        from transport import BodyLimit
+
+        cap = 32
+        seen = {"bytes": 0}
+
+        async def app(scope, receive, send):
+            while True:
+                message = await receive()
+                if message["type"] != "http.request":
+                    continue
+                seen["bytes"] += len(message.get("body") or b"")
+                if not message.get("more_body"):
+                    break
+            await send({"type": "http.response.start", "status": 200, "headers": []})
+            await send({"type": "http.response.body", "body": b"ok"})
+
+        chunks = [b"x" * 20, b"y" * 20, b"z" * 20]
+
+        async def receive():
+            body = chunks.pop(0) if chunks else b""
+            return {"type": "http.request", "body": body, "more_body": bool(chunks)}
+
+        sent = []
+
+        async def send(message):
+            sent.append(message)
+
+        async def run():
+            await BodyLimit(app, cap)(
+                {"type": "http"}, receive, send
+            )
+
+        anyio.run(run)
+        self.assertLessEqual(seen["bytes"], cap + 20)
+        self.assertEqual(sent[0]["status"], 413)
+        self.assertIn(b"PAYLOAD_TOO_LARGE", sent[1]["body"])
+
     def test_classify_and_inspect_roundtrip(self):
         recognized = self.client.post(
             "/v1/recognize?classify=false", content=jpeg_bytes(),
@@ -285,13 +326,26 @@ class WebSocketProtocolTests(unittest.TestCase):
             self.assertEqual(missing["code"], "TRACK_NOT_IN_VIEW")
 
     def test_token_is_enforced_on_the_socket(self):
+        """Header or the first post-hello auth frame. A query token is rejected."""
         client, engine = make_app(token="s3cret")
         try:
             with self.assertRaises(Exception):
                 with client.websocket_connect("/v1/stream") as socket:
+                    self.assertEqual(socket.receive_json()["type"], "hello")
+                    socket.send_json({"type": "ping", "t": 1})
                     socket.receive_json()
-            with client.websocket_connect("/v1/stream?token=s3cret") as socket:
+            with self.assertRaises(Exception):
+                with client.websocket_connect("/v1/stream?token=s3cret") as socket:
+                    socket.receive_json()
+            with client.websocket_connect(
+                "/v1/stream", headers={"Authorization": "Bearer s3cret"}
+            ) as socket:
                 self.assertEqual(socket.receive_json()["type"], "hello")
+            with client.websocket_connect("/v1/stream") as socket:
+                self.assertEqual(socket.receive_json()["type"], "hello")
+                socket.send_json({"type": "auth", "token": "s3cret"})
+                socket.send_json({"type": "ping", "t": 1})
+                self.assertEqual(socket.receive_json(), {"type": "pong", "t": 1})
         finally:
             engine.shutdown()