test: assert auth on each redirect hop; docs: state the exact Authorization rule

Author: lesnik512

docs/errors.md

@@ -186,7 +186,7 @@ Unlike `DecodeError`, this error is raised before the request is sent.
 
 ## `ResponseTooLargeError`
 
-Both clients accept `max_response_body_bytes: int | None = None`. By default there is no limit. When it is set, a response body larger than the cap raises `ResponseTooLargeError` instead of being returned, whatever the status: a `200` trips it as easily as a `500`. The cap counts decoded bytes, after decompression. It applies to `send()` and the verb methods, and to the error body that `stream()` reads before raising a `StatusError`. Bytes you read yourself while iterating a `stream()` are never capped. With a cap set and `follow_redirects=True`, httpware follows the redirects itself and caps only the final response. It closes each intermediate redirect response without reading its body, so the responses in `response.history` have no content. Client `auth` is sent to the first URL and on redirects within the same origin, never to another origin.
+Both clients accept `max_response_body_bytes: int | None = None`. By default there is no limit. When it is set, a response body larger than the cap raises `ResponseTooLargeError` instead of being returned, whatever the status: a `200` trips it as easily as a `500`. The cap counts decoded bytes, after decompression. It applies to `send()` and the verb methods, and to the error body that `stream()` reads before raising a `StatusError`. Bytes you read yourself while iterating a `stream()` are never capped. With a cap set and `follow_redirects=True`, httpware follows the redirects itself and caps only the final response. It closes each intermediate redirect response without reading its body, so the responses in `response.history` have no content. Client `auth` is sent to the first URL only. `httpx2` keeps its `Authorization` header on a redirect within the same origin or from `http` to `https` on the same host, and drops it otherwise.
 
 `ResponseTooLargeError` carries:
 

tests/test_client_body_cap_redirects.py

@@ -14,9 +14,9 @@ def _looping(request: httpx2.Request) -> httpx2.Response:
     return httpx2.Response(HTTPStatus.FOUND, headers={"location": request.url.path + "x"})
 
 
-def _authorization_seen(seen: dict[str, str | None], location: str) -> httpx2.MockTransport:
+def _authorization_seen(seen: dict[tuple[str, str], str | None], location: str) -> httpx2.MockTransport:
     def handler(request: httpx2.Request) -> httpx2.Response:
-        seen[request.url.host] = request.headers.get("authorization")
+        seen[request.url.host, request.url.path] = request.headers.get("authorization")
         if request.url.path == "/start":
             return httpx2.Response(HTTPStatus.FOUND, headers={"location": location})
         return httpx2.Response(HTTPStatus.OK)
@@ -30,18 +30,6 @@ def _redirecting(request: httpx2.Request) -> httpx2.Response:
     return httpx2.Response(HTTPStatus.OK, content=b"done")
 
 
-async def test_async_follows_redirects_under_a_body_cap() -> None:
-    async with AsyncClient(
-        transport=httpx2.MockTransport(_redirecting),
-        follow_redirects=True,
-        max_response_body_bytes=1024,
-    ) as client:
-        response = await client.get("https://example.test/start")
-    assert response.status_code == HTTPStatus.OK
-    assert response.content == b"done"
-    assert str(response.url) == "https://example.test/final"
-
-
 def _huge_intermediate_body(pulled: list[bytes]) -> httpx2.MockTransport:
     async def huge_body() -> AsyncIterator[bytes]:
         for _ in range(100):
@@ -69,6 +57,18 @@ def handler(request: httpx2.Request) -> httpx2.Response:
     return httpx2.MockTransport(handler)
 
 
+async def test_async_follows_redirects_under_a_body_cap() -> None:
+    async with AsyncClient(
+        transport=httpx2.MockTransport(_redirecting),
+        follow_redirects=True,
+        max_response_body_bytes=1024,
+    ) as client:
+        response = await client.get("https://example.test/start")
+    assert response.status_code == HTTPStatus.OK
+    assert response.content == b"done"
+    assert str(response.url) == "https://example.test/final"
+
+
 async def test_async_never_reads_an_intermediate_redirect_body() -> None:
     pulled: list[bytes] = []
     async with AsyncClient(
@@ -139,15 +139,21 @@ async def test_async_too_many_redirects_is_the_same_error_with_or_without_a_cap(
 @pytest.mark.parametrize(
     ("location", "expected"),
     [
-        ("/final", {"example.test": "Basic dTpw"}),
-        ("https://other.test/final", {"example.test": "Basic dTpw", "other.test": None}),
+        (
+            "/final",
+            {("example.test", "/start"): "Basic dTpw", ("example.test", "/final"): "Basic dTpw"},
+        ),
+        (
+            "https://other.test/final",
+            {("example.test", "/start"): "Basic dTpw", ("other.test", "/final"): None},
+        ),
     ],
 )
 async def test_async_client_auth_does_not_follow_a_redirect_to_another_origin(
     location: str,
-    expected: dict[str, str | None],
+    expected: dict[tuple[str, str], str | None],
 ) -> None:
-    seen: dict[str, str | None] = {}
+    seen: dict[tuple[str, str], str | None] = {}
     async with AsyncClient(
         transport=_authorization_seen(seen, location),
         auth=httpx2.BasicAuth("u", "p"),
@@ -252,15 +258,21 @@ def test_sync_too_many_redirects_is_the_same_error_with_or_without_a_cap(cap: in
 @pytest.mark.parametrize(
     ("location", "expected"),
     [
-        ("/final", {"example.test": "Basic dTpw"}),
-        ("https://other.test/final", {"example.test": "Basic dTpw", "other.test": None}),
+        (
+            "/final",
+            {("example.test", "/start"): "Basic dTpw", ("example.test", "/final"): "Basic dTpw"},
+        ),
+        (
+            "https://other.test/final",
+            {("example.test", "/start"): "Basic dTpw", ("other.test", "/final"): None},
+        ),
     ],
 )
 def test_sync_client_auth_does_not_follow_a_redirect_to_another_origin(
     location: str,
-    expected: dict[str, str | None],
+    expected: dict[tuple[str, str], str | None],
 ) -> None:
-    seen: dict[str, str | None] = {}
+    seen: dict[tuple[str, str], str | None] = {}
     with Client(
         transport=_authorization_seen(seen, location),
         auth=httpx2.BasicAuth("u", "p"),