fix(api): bound claim wire fields end to end

client/tests/core/test_models.py

@@ -100,15 +100,9 @@ class CoreModelsTests(unittest.TestCase):
                 changed["task"]["max_total_price"] = invalid
                 ClaimedTask.from_wire(changed)
 
-        wide = claim_wire()
-        wide_goods = "1" * 33
-        wide["task"].update(
-            goods_id=wide_goods,
-            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + wide_goods,
-            max_total_price="1" * 31 + ".00",
-            quantity=2_147_483_648,
-        )
-        self.assertEqual(ClaimedTask.from_wire(wide).task.quantity, 2_147_483_648)
+        wide_quantity = claim_wire()
+        wide_quantity["task"]["quantity"] = 2_147_483_648
+        self.assertEqual(ClaimedTask.from_wire(wide_quantity).task.quantity, 2_147_483_648)
         for invalid_goods in ("１２３", "1٢3"):
             changed = claim_wire()
             changed["task"]["goods_id"] = invalid_goods
@@ -120,6 +114,47 @@ class CoreModelsTests(unittest.TestCase):
         with self.assertRaises(ValidationError):
             ClaimedTask.from_wire(too_large)
 
+    def test_claim_fields_share_explicit_server_bounds(self) -> None:
+        legal = claim_wire()
+        legal_goods = "1" * 32
+        legal["task"].update(
+            title="😀" * 120,
+            goods_id=legal_goods,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + legal_goods,
+            sku_color="色" * 80,
+            sku_size="码" * 80,
+            max_total_price="1" * 29 + ".00",
+        )
+        claimed = ClaimedTask.from_wire(legal)
+        self.assertEqual(len(claimed.task.title), 120)
+        # Python's default ensure_ascii=True expands astral characters to surrogate
+        # escape pairs, so this is a conservative parser-budget proof as well.
+        self.assertLess(len(json.dumps(legal, separators=(",", ":")).encode()), 32 * 1024)
+
+        mutations = (
+            ("title", "😀" * 121),
+            ("title", " title"),
+            ("sku_color", "色" * 81),
+            ("sku_color", "black "),
+            ("sku_size", "码" * 81),
+            ("sku_size", " M"),
+            ("max_total_price", "1" * 30 + ".00"),
+        )
+        for field, invalid in mutations:
+            changed = claim_wire()
+            changed["task"][field] = invalid
+            with self.subTest(field=field, length=len(invalid)), self.assertRaises(ValidationError):
+                ClaimedTask.from_wire(changed)
+
+        overlong_goods = "1" * 33
+        changed = claim_wire()
+        changed["task"].update(
+            goods_id=overlong_goods,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + overlong_goods,
+        )
+        with self.assertRaises(ValidationError):
+            ClaimedTask.from_wire(changed)
+
     def test_wire_strings_reject_lone_surrogates_but_accept_valid_pair(self) -> None:
         for escaped in (r'"\ud800"', r'"\udc00"'):
             value = claim_wire()

client/tests/remote/test_task_source.py

@@ -75,6 +75,32 @@ class TaskSourceTests(unittest.TestCase):
             HttpTaskSource(redirect).claim_next(self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID))
         self.assertEqual(len(redirect.calls), 1)
 
+    def test_claim_rejects_service_field_bound_drift_as_ambiguous(self) -> None:
+        mutations = (
+            ("title", "😀" * 121),
+            ("sku_color", "色" * 81),
+            ("sku_size", "码" * 81),
+            ("max_total_price", "1" * 30 + ".00"),
+        )
+        for field, invalid in mutations:
+            value = claim_wire()
+            value["task"][field] = invalid
+            transport = FakeTransport(response(200, value))
+            with self.subTest(field=field), self.assertRaises(AmbiguousRemoteError):
+                HttpTaskSource(transport).claim_next(self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID))
+            self.assertEqual(len(transport.calls), 1)
+
+        goods_id = "1" * 33
+        value = claim_wire()
+        value["task"].update(
+            goods_id=goods_id,
+            product_url="https://mobile.yangkeduo.com/goods.html?goods_id=" + goods_id,
+        )
+        with self.assertRaises(AmbiguousRemoteError):
+            HttpTaskSource(FakeTransport(response(200, value))).claim_next(
+                self.credentials, ClaimRequest(SESSION_ID, REQUEST_ID)
+            )
+
     def test_fixed_conflict_and_renew_cas(self) -> None:
         conflict = FakeTransport(response(409, {"error": "claim_requires_manual"}))
         with self.assertRaises(ManualRemoteError):