model-generator-kit 0.1.1__tar.gz → 0.1.3__tar.gz

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: model-generator-kit
-Version: 0.1.1
+Version: 0.1.3
 Summary: One-shot bootstrap generator for database models, API models, routes, and tests
 Author-email: nuncaeslupus <imarcos@gmail.com>
 License: MIT
@@ -140,4 +140,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.1
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.3

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/README.md

@@ -104,4 +104,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.1
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.3

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "model-generator-kit"
-version = "0.1.1"
+version = "0.1.3"
 description = "One-shot bootstrap generator for database models, API models, routes, and tests"
 readme = "README.md"
 license = {text = "MIT"}

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/__init__.py

@@ -3,4 +3,4 @@
 # Single source of truth is pyproject.toml's [project].version. `make
 # version-sync` propagates that value here; `make check-version-sync` (run in
 # CI) fails the build if they drift. Do not edit by hand.
-__version__ = "0.1.1"
+__version__ = "0.1.3"

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/stacks/python-fastapi/templates/api/request.py.j2

@@ -57,11 +57,13 @@ This module contains:
 {% endif %}
 {#- Check for financial/counter fields with constraints needing validators -#}
 {% if not field.api_exclude_create | default(false) or not field.api_exclude_update | default(false) %}
-{% if field.type == 'financial' and field.constraints is defined %}
-{% for c in field.constraints %}
-{% if c.type in ['non_negative', 'non_negative_or_null'] and 'validate_non_negative_decimal' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_non_negative_decimal') %}{% endif %}
-{% if c.type in ['positive', 'positive_or_null'] and 'validate_positive_decimal' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_positive_decimal') %}{% endif %}
-{% endfor %}
+{% if field.type == 'financial' %}
+{#- Choose validator by declared constraint: non-negative when constrained, signed otherwise -#}
+{% set ctypes = (field.constraints | map(attribute='type') | list) if (field.constraints is defined and field.constraints) else [] %}
+{% if 'non_negative' in ctypes or 'non_negative_or_null' in ctypes %}{% set fin_validator = 'validate_non_negative_decimal' %}
+{% elif 'positive' in ctypes or 'positive_or_null' in ctypes %}{% set fin_validator = 'validate_positive_decimal' %}
+{% else %}{% set fin_validator = 'validate_decimal' %}{% endif %}
+{% if fin_validator not in ns.needs_validators %}{% set _ = ns.needs_validators.append(fin_validator) %}{% endif %}
 {% elif field.type == 'percentage' %}
 {% if 'validate_percentage' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_percentage') %}{% endif %}
 {% elif field.type == 'counter' and field.constraints is defined %}
@@ -271,14 +273,13 @@ class Create{{ entity_name }}Request(BaseModel):
 {#- Collect constraint-driven validators (financial, percentage, counter) -#}
 {% for item in create_fields %}
 {% set field = item.field %}
-{% if field.type == 'financial' and field.constraints is defined %}
-{% for c in field.constraints %}
-{% if c.type in ['non_negative', 'non_negative_or_null'] %}
-{% set _ = field_validators.append({'name': item.name, 'validator': 'validate_non_negative_decimal'}) %}
-{% elif c.type in ['positive', 'positive_or_null'] %}
-{% set _ = field_validators.append({'name': item.name, 'validator': 'validate_positive_decimal'}) %}
-{% endif %}
-{% endfor %}
+{% if field.type == 'financial' %}
+{#- Choose validator by declared constraint: non-negative when constrained, signed otherwise -#}
+{% set ctypes = (field.constraints | map(attribute='type') | list) if (field.constraints is defined and field.constraints) else [] %}
+{% if 'non_negative' in ctypes or 'non_negative_or_null' in ctypes %}{% set fin_validator = 'validate_non_negative_decimal' %}
+{% elif 'positive' in ctypes or 'positive_or_null' in ctypes %}{% set fin_validator = 'validate_positive_decimal' %}
+{% else %}{% set fin_validator = 'validate_decimal' %}{% endif %}
+{% set _ = field_validators.append({'name': item.name, 'validator': fin_validator}) %}
 {% elif field.type == 'percentage' %}
 {% set _ = field_validators.append({'name': item.name, 'validator': 'validate_percentage'}) %}
 {% elif field.type == 'counter' and field.constraints is defined %}
@@ -416,14 +417,13 @@ class Update{{ entity_name }}Request(BaseModel):
 {% set update_validators = [] %}
 {% for item in update_fields %}
 {% set field = item.field %}
-{% if field.type == 'financial' and field.constraints is defined %}
-{% for c in field.constraints %}
-{% if c.type in ['non_negative', 'non_negative_or_null'] %}
-{% set _ = update_validators.append({'name': item.name, 'validator': 'validate_non_negative_decimal'}) %}
-{% elif c.type in ['positive', 'positive_or_null'] %}
-{% set _ = update_validators.append({'name': item.name, 'validator': 'validate_positive_decimal'}) %}
-{% endif %}
-{% endfor %}
+{% if field.type == 'financial' %}
+{#- Choose validator by declared constraint: non-negative when constrained, signed otherwise -#}
+{% set ctypes = (field.constraints | map(attribute='type') | list) if (field.constraints is defined and field.constraints) else [] %}
+{% if 'non_negative' in ctypes or 'non_negative_or_null' in ctypes %}{% set fin_validator = 'validate_non_negative_decimal' %}
+{% elif 'positive' in ctypes or 'positive_or_null' in ctypes %}{% set fin_validator = 'validate_positive_decimal' %}
+{% else %}{% set fin_validator = 'validate_decimal' %}{% endif %}
+{% set _ = update_validators.append({'name': item.name, 'validator': fin_validator}) %}
 {% elif field.type == 'percentage' %}
 {% set _ = update_validators.append({'name': item.name, 'validator': 'validate_percentage'}) %}
 {% elif field.type == 'counter' and field.constraints is defined %}

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/stacks/python-fastapi/templates/api/response.py.j2

@@ -26,7 +26,14 @@ This module contains:
 {% if not field.api_exclude_response | default(false) %}
 {% if field.type in ['json_object', 'json_array'] %}{% set ns.has_any = true %}{% endif %}
 {% if field.type == 'enum' and field.enum_name not in ns.enum_imports %}{% set _ = ns.enum_imports.append(field.enum_name) %}{% endif %}
-{% if field.type == 'financial' and 'validate_non_negative_decimal' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_non_negative_decimal') %}{% endif %}
+{% if field.type == 'financial' %}
+{#- Choose validator by declared constraint: non-negative when constrained, signed otherwise -#}
+{% set ctypes = (field.constraints | map(attribute='type') | list) if (field.constraints is defined and field.constraints) else [] %}
+{% if 'non_negative' in ctypes or 'non_negative_or_null' in ctypes %}{% set fin_validator = 'validate_non_negative_decimal' %}
+{% elif 'positive' in ctypes or 'positive_or_null' in ctypes %}{% set fin_validator = 'validate_positive_decimal' %}
+{% else %}{% set fin_validator = 'validate_decimal' %}{% endif %}
+{% if fin_validator not in ns.needs_validators %}{% set _ = ns.needs_validators.append(fin_validator) %}{% endif %}
+{% endif %}
 {% if field.type == 'percentage' and 'validate_percentage' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_percentage') %}{% endif %}
 {% if field.type == 'counter' and 'validate_non_negative_int' not in ns.needs_validators %}{% set _ = ns.needs_validators.append('validate_non_negative_int') %}{% endif %}
 {% endif %}
@@ -173,7 +180,12 @@ class {{ entity_name }}Response(BaseModel):
 {% for field_name, field in entity.fields.items() %}
 {% if not field.api_exclude_response | default(false) %}
 {% if field.type == 'financial' %}
-{% set _ = validated_fields.append({'name': field_name, 'validator': 'validate_non_negative_decimal'}) %}
+{#- Choose validator by declared constraint: non-negative when constrained, signed otherwise -#}
+{% set ctypes = (field.constraints | map(attribute='type') | list) if (field.constraints is defined and field.constraints) else [] %}
+{% if 'non_negative' in ctypes or 'non_negative_or_null' in ctypes %}{% set fin_validator = 'validate_non_negative_decimal' %}
+{% elif 'positive' in ctypes or 'positive_or_null' in ctypes %}{% set fin_validator = 'validate_positive_decimal' %}
+{% else %}{% set fin_validator = 'validate_decimal' %}{% endif %}
+{% set _ = validated_fields.append({'name': field_name, 'validator': fin_validator}) %}
 {% elif field.type == 'percentage' %}
 {% set _ = validated_fields.append({'name': field_name, 'validator': 'validate_percentage'}) %}
 {% elif field.type == 'counter' %}

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/stacks/python-fastapi/templates/api/route.py.j2

@@ -75,7 +75,7 @@ All endpoints follow RESTful conventions and return standardized error responses
 import bcrypt
 {% endif %}
 {% if ns.has_datetime %}
-from datetime import datetime
+from datetime import datetime, timezone
 {% endif %}
 {% if ns.has_financial or ns.has_percentage %}
 from decimal import Decimal
@@ -225,9 +225,15 @@ async def list_{{ entity_plural }}(
         count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} == {{ field_name }})
 {% elif field.type == 'datetime' %}
     if {{ field_name }}_after is not None:
+        # Localize a naive value to UTC: the column is tz-aware, and comparing
+        # it against a naive datetime raises on strict drivers (asyncpg/psycopg2).
+        if {{ field_name }}_after.tzinfo is None:
+            {{ field_name }}_after = {{ field_name }}_after.replace(tzinfo=timezone.utc)
         stmt = stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_after)
         count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} >= {{ field_name }}_after)
     if {{ field_name }}_before is not None:
+        if {{ field_name }}_before.tzinfo is None:
+            {{ field_name }}_before = {{ field_name }}_before.replace(tzinfo=timezone.utc)
         stmt = stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_before)
         count_stmt = count_stmt.where({{ entity_name }}.{{ field_name }} <= {{ field_name }}_before)
 {% elif field.type in ['financial', 'percentage'] %}

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/stacks/python-fastapi/templates/infrastructure/request_limit.py.j2

@@ -97,11 +97,28 @@ class RequestBodySizeLimitMiddleware:
 
 
 def _content_length(scope: Scope) -> int | None:
-    """Return the request's Content-Length as an int, or None if absent/invalid."""
+    """Return the request's Content-Length as an int, or None if absent/invalid.
+
+    A declared length is treated as invalid (returns None) — forcing the caller
+    onto the chunked byte-counting path, which is safe regardless of any header
+    — when it is negative or when *more than one* Content-Length header is
+    present. Multiple Content-Length headers are a request-smuggling signal: a
+    downstream server or proxy might honor a different one than this middleware,
+    so an oversized request could slip past a guard keyed on the first value.
+    Compliant servers reject both cases at the protocol layer, but the
+    middleware must not rely on that pre-filtering — defense-in-depth.
+    """
+    found: int | None = None
     for name, value in scope.get("headers", []):
         if name == b"content-length":
+            if found is not None:
+                # Duplicate Content-Length headers: force the chunked path.
+                return None
             try:
-                return int(value)
+                n = int(value)
             except ValueError:
                 return None
-    return None
+            if n < 0:
+                return None
+            found = n
+    return found

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator/stacks/python-fastapi/templates/infrastructure/validators.py.j2

@@ -23,6 +23,23 @@ from typing import Any
 {{ section_divider('DECIMAL VALIDATORS') }}
 
 
+def validate_decimal(value: Any) -> str | None:
+    """Validate that a value is a well-formed decimal (sign-agnostic).
+
+    Accepts negative, zero, and positive values. Use this for signed
+    financial fields (e.g. PnL, returns) that may legitimately be negative.
+    """
+    if value is None:
+        return value
+    try:
+        decimal_value = Decimal(str(value))
+    except InvalidOperation:
+        raise ValueError("Invalid decimal value") from None
+    if not decimal_value.is_finite():
+        raise ValueError("Value must be a finite decimal")
+    return str(value)
+
+
 def validate_non_negative_decimal(value: Any) -> str | None:
     """Validate that a decimal value is non-negative (>= 0)."""
     if value is None:

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/src/model_generator_kit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: model-generator-kit
-Version: 0.1.1
+Version: 0.1.3
 Summary: One-shot bootstrap generator for database models, API models, routes, and tests
 Author-email: nuncaeslupus <imarcos@gmail.com>
 License: MIT
@@ -140,4 +140,4 @@ Define specifications once in JSON. Generate production-ready scaffolds. Then ma
 
 ---
 
-**Model Generator** | Bootstrap Tool for API Backends | v0.1.1
+**Model Generator** | Bootstrap Tool for API Backends | v0.1.3

{model_generator_kit-0.1.1 → model_generator_kit-0.1.3}/tests/test_generators.py

@@ -1106,6 +1106,193 @@ class TestApiModelsGeneratorPerEntity:
         assert "CreatePostRequest" not in author_req
 
 
+@pytest.fixture
+def financial_model() -> dict[str, Any]:
+    """Single entity exercising signed vs constrained financial fields.
+
+    - unrealized_pnl: no constraint  -> signed -> validate_decimal
+    - balance:        non_negative   -> validate_non_negative_decimal
+    - deposit:        positive       -> validate_positive_decimal
+    """
+    return {
+        "domain": "ledger",
+        "description": "Ledger domain with signed and constrained money",
+        "entities": {
+            "Account": {
+                "table": "accounts",
+                "description": "Trading account",
+                "fields": {
+                    "id": {
+                        "type": "uuid",
+                        "primary_key": True,
+                        "auto_generate": True,
+                    },
+                    "unrealized_pnl": {
+                        "type": "financial",
+                        "required": True,
+                    },
+                    "balance": {
+                        "type": "financial",
+                        "required": True,
+                        "constraints": [{"type": "non_negative"}],
+                    },
+                    "deposit": {
+                        "type": "financial",
+                        "required": True,
+                        "constraints": [{"type": "positive"}],
+                    },
+                },
+                "timestamps": {"created": True, "updated": True},
+            },
+        },
+    }
+
+
+class TestFinancialValidatorSelection:
+    """Signed financial fields must not be forced non-negative.
+
+    Regression: the response/request templates hardcoded
+    validate_non_negative_decimal for every financial field, so any
+    legitimately negative value (PnL, returns) failed validation.
+    """
+
+    def _content(self, model: dict[str, Any], env_fixture: Any, suffix: str) -> str:
+        project_root, config, env = env_fixture
+        result = generate_api_models(model, config, env, project_root)
+        assert isinstance(result, list)
+        content = next(r["content"] for r in result if r["path"].name.endswith(suffix))
+        assert isinstance(content, str)
+        return content
+
+    def test_response_signed_financial_uses_validate_decimal(
+        self, financial_model: dict[str, Any], project_env_per_entity: Any
+    ) -> None:
+        content = self._content(
+            financial_model, project_env_per_entity, "account_response.py"
+        )
+        # Unconstrained financial -> signed validator
+        assert (
+            '_validate_unrealized_pnl = field_validator("unrealized_pnl")'
+            "(validate_decimal)" in content
+        )
+        # Constrained financial -> stays non-negative / positive
+        assert (
+            '_validate_balance = field_validator("balance")'
+            "(validate_non_negative_decimal)" in content
+        )
+        assert (
+            '_validate_deposit = field_validator("deposit")'
+            "(validate_positive_decimal)" in content
+        )
+
+    def test_response_imports_match_validators_used(
+        self, financial_model: dict[str, Any], project_env_per_entity: Any
+    ) -> None:
+        content = self._content(
+            financial_model, project_env_per_entity, "account_response.py"
+        )
+        import_line = next(
+            line
+            for line in content.splitlines()
+            if line.startswith("from") and "validators import" in line
+        )
+        assert "validate_decimal" in import_line
+        assert "validate_non_negative_decimal" in import_line
+        assert "validate_positive_decimal" in import_line
+
+    def test_request_signed_financial_uses_validate_decimal(
+        self, financial_model: dict[str, Any], project_env_per_entity: Any
+    ) -> None:
+        content = self._content(
+            financial_model, project_env_per_entity, "account_requests.py"
+        )
+        assert (
+            '_validate_unrealized_pnl = field_validator("unrealized_pnl")'
+            "(validate_decimal)" in content
+        )
+        assert (
+            '_validate_balance = field_validator("balance")'
+            "(validate_non_negative_decimal)" in content
+        )
+        assert (
+            '_validate_deposit = field_validator("deposit")'
+            "(validate_positive_decimal)" in content
+        )
+
+    def test_request_imports_match_validators_used(
+        self, financial_model: dict[str, Any], project_env_per_entity: Any
+    ) -> None:
+        content = self._content(
+            financial_model, project_env_per_entity, "account_requests.py"
+        )
+        import_line = next(
+            line
+            for line in content.splitlines()
+            if line.startswith("from") and "validators import" in line
+        )
+        assert "validate_decimal" in import_line
+        assert "validate_non_negative_decimal" in import_line
+        assert "validate_positive_decimal" in import_line
+
+    def test_validators_module_defines_validate_decimal(
+        self, project_env_per_entity: Any
+    ) -> None:
+        project_root, config, env = project_env_per_entity
+        result = generate_validators(config, env, project_root)
+        assert result is not None
+        assert "def validate_decimal(value: Any) -> str | None:" in result["content"]
+
+    def test_validate_decimal_rejects_non_finite(
+        self, project_env_per_entity: Any
+    ) -> None:
+        """The emitted validate_decimal must reject NaN/Infinity, not just
+        malformed strings (financial fields cannot store non-finite values)."""
+        project_root, config, env = project_env_per_entity
+        result = generate_validators(config, env, project_root)
+        assert result is not None
+        ns: dict[str, Any] = {}
+        exec(result["content"], ns)
+        validate_decimal = ns["validate_decimal"]
+        # Signed finite values pass.
+        assert validate_decimal("-12.5") == "-12.5"
+        assert validate_decimal(None) is None
+        # Non-finite values are rejected.
+        for bad in ("NaN", "Infinity", "-Infinity", "sNaN"):
+            with pytest.raises(ValueError):
+                validate_decimal(bad)
+        with pytest.raises(ValueError):
+            validate_decimal("not-a-number")
+
+    def test_empty_constraints_fall_back_to_signed(
+        self, project_env_per_entity: Any
+    ) -> None:
+        """A financial field with an empty (falsy) `constraints` list falls
+        back to the signed default rather than crashing on the `map` filter."""
+        model = {
+            "domain": "ledger",
+            "entities": {
+                "Account": {
+                    "table": "accounts",
+                    "fields": {
+                        "id": {
+                            "type": "uuid",
+                            "primary_key": True,
+                            "auto_generate": True,
+                        },
+                        "pnl": {
+                            "type": "financial",
+                            "required": True,
+                            "constraints": [],
+                        },
+                    },
+                }
+            },
+        }
+        for suffix in ("account_response.py", "account_requests.py"):
+            content = self._content(model, project_env_per_entity, suffix)
+            assert '_validate_pnl = field_validator("pnl")(validate_decimal)' in content
+
+
 class TestGenerateApiInitPerEntity:
     """Per-entity api __init__.py emission."""
 
@@ -1652,6 +1839,58 @@ class TestApiRoutesFilterCoercion:
         assert "from datetime import datetime" in content
 
 
+class TestApiRoutesDatetimeFilterTzAware:
+    """Naive datetime filter values are localized to UTC before comparison.
+
+    A ``datetime | None`` filter parses input without a tz offset (e.g.
+    ``2026-06-11T12:00:00``) as a naive datetime; compared against a tz-aware
+    ``DateTime(timezone=True)`` column it raises ``TypeError``/``DataError`` on
+    strict drivers (asyncpg/psycopg2). The handler localizes a naive value to
+    UTC first. Latent (SQLite suites don't enforce tz-awareness), not a
+    regression — fixed uniformly for both ``_after`` and ``_before``.
+    """
+
+    def _render(self, model: dict[str, Any], project_env: Any) -> str:
+        project_root, config, env = project_env
+        result = generate_api_routes(
+            model, config, env, project_root, enums={}, constraints={}
+        )
+        assert isinstance(result, dict)
+        return str(result["content"])
+
+    def test_imports_timezone(
+        self, filter_model: dict[str, Any], project_env: Any
+    ) -> None:
+        content = self._render(filter_model, project_env)
+        assert "from datetime import datetime, timezone" in content
+
+    def test_naive_after_localized_to_utc(
+        self, filter_model: dict[str, Any], project_env: Any
+    ) -> None:
+        content = self._render(filter_model, project_env)
+        assert "if observed_at_after.tzinfo is None:" in content
+        assert (
+            "observed_at_after = observed_at_after.replace(tzinfo=timezone.utc)"
+            in content
+        )
+
+    def test_naive_before_localized_to_utc(
+        self, filter_model: dict[str, Any], project_env: Any
+    ) -> None:
+        content = self._render(filter_model, project_env)
+        assert "if observed_at_before.tzinfo is None:" in content
+        assert (
+            "observed_at_before = observed_at_before.replace(tzinfo=timezone.utc)"
+            in content
+        )
+
+    def test_route_still_compiles(
+        self, filter_model: dict[str, Any], project_env: Any
+    ) -> None:
+        content = self._render(filter_model, project_env)
+        compile(content, "<metric_route>", "exec")
+
+
 class TestValidateAuthConfig:
     """Test the _validate_auth_config helper."""
 
@@ -3738,6 +3977,120 @@ class TestRequestLimitGenerator:
         # Default cap (>0) still applies -> middleware still emitted, no crash.
         assert isinstance(generate_request_limit(config, env, project_root), dict)
 
+    def test_negative_content_length_treated_as_invalid(
+        self, project_env: Any, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """Defense-in-depth: a negative Content-Length must not bypass the cap.
+
+        ``int(b"-100")`` used to be returned verbatim, so ``-100 > max`` was
+        False and the request streamed through uncounted. Now a negative length
+        is invalid (``None``), so the request falls through to the chunked
+        byte-counting path and is still rejected on overflow.
+        """
+        import asyncio
+        import sys
+        import types as types_module
+
+        project_root, config, env = project_env
+        result = generate_request_limit(config, env, project_root)
+        assert isinstance(result, dict)
+        content = result["content"]
+        # Template-level guard: a negative declared length is invalid.
+        assert "if n < 0:" in content
+
+        # Runtime probe: drive the middleware with a lying Content-Length: -100
+        # and an oversized body; the cap must still produce a 413. starlette is
+        # not a generator dependency, so stub its type-only import (auto-undone
+        # by the monkeypatch fixture).
+        starlette = types_module.ModuleType("starlette")
+        starlette_types = types_module.ModuleType("starlette.types")
+        for name in ("ASGIApp", "Message", "Receive", "Scope", "Send"):
+            setattr(starlette_types, name, Any)
+        starlette.types = starlette_types  # type: ignore[attr-defined]
+        monkeypatch.setitem(sys.modules, "starlette", starlette)
+        monkeypatch.setitem(sys.modules, "starlette.types", starlette_types)
+
+        ns: dict[str, Any] = {}
+        exec(content, ns)
+        middleware_cls = ns["RequestBodySizeLimitMiddleware"]
+
+        async def app(scope: Any, receive: Any, send: Any) -> None:
+            raise AssertionError("oversized body reached the app")
+
+        mw = middleware_cls(app, max_body_bytes=10)
+        scope = {"type": "http", "headers": [(b"content-length", b"-100")]}
+
+        async def receive() -> dict[str, Any]:
+            return {"type": "http.request", "body": b"x" * 100, "more_body": False}
+
+        sent: list[dict[str, Any]] = []
+
+        async def send(message: dict[str, Any]) -> None:
+            sent.append(message)
+
+        asyncio.run(mw(scope, receive, send))
+
+        start = next(m for m in sent if m["type"] == "http.response.start")
+        assert start["status"] == 413
+
+    def test_duplicate_content_length_treated_as_invalid(
+        self, project_env: Any, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        """Defense-in-depth: duplicate Content-Length headers must not bypass the cap.
+
+        Returning the first header's value lets a smuggling pair (small + large)
+        slip an oversized body past a guard keyed on the small one if a
+        downstream server honors the other. Two Content-Length headers are now
+        treated as invalid, forcing the chunked byte-counting path → 413.
+        """
+        import asyncio
+        import sys
+        import types as types_module
+
+        project_root, config, env = project_env
+        result = generate_request_limit(config, env, project_root)
+        assert isinstance(result, dict)
+        content = result["content"]
+
+        starlette = types_module.ModuleType("starlette")
+        starlette_types = types_module.ModuleType("starlette.types")
+        for name in ("ASGIApp", "Message", "Receive", "Scope", "Send"):
+            setattr(starlette_types, name, Any)
+        starlette.types = starlette_types  # type: ignore[attr-defined]
+        monkeypatch.setitem(sys.modules, "starlette", starlette)
+        monkeypatch.setitem(sys.modules, "starlette.types", starlette_types)
+
+        ns: dict[str, Any] = {}
+        exec(content, ns)
+        middleware_cls = ns["RequestBodySizeLimitMiddleware"]
+
+        async def app(scope: Any, receive: Any, send: Any) -> None:
+            raise AssertionError("oversized body reached the app")
+
+        mw = middleware_cls(app, max_body_bytes=10)
+        # Smuggling pair: a small declared length the guard would accept, plus a
+        # second header. The middleware must distrust both and count bytes.
+        scope = {
+            "type": "http",
+            "headers": [
+                (b"content-length", b"5"),
+                (b"content-length", b"100"),
+            ],
+        }
+
+        async def receive() -> dict[str, Any]:
+            return {"type": "http.request", "body": b"x" * 100, "more_body": False}
+
+        sent: list[dict[str, Any]] = []
+
+        async def send(message: dict[str, Any]) -> None:
+            sent.append(message)
+
+        asyncio.run(mw(scope, receive, send))
+
+        start = next(m for m in sent if m["type"] == "http.response.start")
+        assert start["status"] == 413
+
 
 class TestImmutableEntityGeneration:
     """Test generation for immutable entities (no update endpoint)."""