From 311e91d3ff00ccb027296115749635269f1a5f93 Mon Sep 17 00:00:00 2001
From: Jean-Luc Makiola <business@jeanlucmakiola.de>
Date: Mon, 23 Mar 2026 21:18:39 +0100
Subject: [PATCH] test(01-02): add failing tests for oversized body (413) - RED

- TestWebhookHandler_OversizedBody: POST /webhook with >1MB body expects 413
- TestTagsHandler_OversizedBody: POST /api/tags with >1MB body expects 413
- TestTagAssignmentHandler_OversizedBody: PUT /api/tag-assignments with >1MB body expects 413
---
 pkg/diunwebhook/diunwebhook_test.go | 40 +++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/pkg/diunwebhook/diunwebhook_test.go b/pkg/diunwebhook/diunwebhook_test.go
index 54e220e..3160aca 100644
--- a/pkg/diunwebhook/diunwebhook_test.go
+++ b/pkg/diunwebhook/diunwebhook_test.go
@@ -613,6 +613,46 @@ func TestGetUpdates_IncludesTag(t *testing.T) {
 	}
 }
 
+func TestWebhookHandler_OversizedBody(t *testing.T) {
+	// Generate a body that exceeds 1 MB (maxBodyBytes = 1<<20 = 1,048,576 bytes)
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPost, "/webhook", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.WebhookHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
+func TestTagsHandler_OversizedBody(t *testing.T) {
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/tags", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.TagsHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
+func TestTagAssignmentHandler_OversizedBody(t *testing.T) {
+	oversized := make([]byte, 1<<20+1)
+	for i := range oversized {
+		oversized[i] = 'x'
+	}
+	req := httptest.NewRequest(http.MethodPut, "/api/tag-assignments", bytes.NewReader(oversized))
+	rec := httptest.NewRecorder()
+	diun.TagAssignmentHandler(rec, req)
+	if rec.Code != http.StatusRequestEntityTooLarge {
+		t.Errorf("expected 413 for oversized body, got %d", rec.Code)
+	}
+}
+
 func TestUpdateEvent_PreservesTagOnUpsert(t *testing.T) {
 	diun.UpdatesReset()