omicslab 2.2.0__tar.gz → 2.5.1__tar.gz

{omicslab-2.2.0 → omicslab-2.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: omicslab
-Version: 2.2.0
+Version: 2.5.1
 Summary: Python SDK and CLI for the OmicsLab Platform
 Project-URL: Homepage, https://platform.omicslab.io
 Project-URL: Repository, https://github.com/vieomics/omicslab-platform
@@ -14,6 +14,7 @@ Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
 Classifier: Programming Language :: Python :: 3.12
 Requires-Python: >=3.12
 Requires-Dist: aiohttp>=3.10
+Requires-Dist: botocore<2,>=1.35
 Requires-Dist: httpx>=0.27
 Requires-Dist: psutil>=6
 Requires-Dist: pydantic>=2
@@ -93,7 +94,7 @@ omicslab upload -y ./data.csv s3://my-bucket/data/
 
 ### Download
 
-Download files or directories from workspace storage. Recursive downloads preserve subdirectory structure and use parallel threads.
+Download files or directories from workspace storage. A folder is detected automatically, so a trailing slash and `-r` are optional; recursive downloads preserve subdirectory structure and use parallel threads.
 
 ```bash
 # Single file (defaults to filename in current directory)
@@ -105,7 +106,13 @@ omicslab download results/run1/data.csv ./local_copy.csv
 # Download from s3:// path (auto-resolves workspace)
 omicslab download s3://my-bucket/data/results/report.html
 
-# Recursive directory download (preserves subdirectory structure)
+# Folder download (auto-detected; defaults to ./run1)
+omicslab download results/run1
+
+# Folder download with explicit destination
+omicslab download results/run1 ./local_results/
+
+# Same thing, explicit recursive (preserves subdirectory structure)
 omicslab download -r s3://my-bucket/data/results/ ./local_results/
 
 # Recursive download with custom thread count
@@ -119,12 +126,13 @@ omicslab download -y -r s3://my-bucket/data/results/ ./local_results/
 
 | Flag | Description |
 |------|-------------|
-| `--recursive`, `-r` | Download all files under an s3:// directory prefix |
+| `--recursive`, `-r` | Force recursive download (folders are detected automatically) |
+| `--zip` | Download a folder as a server-built zip archive |
 | `--threads` | Concurrent download threads (default: 4) |
 | `--workspace-id`, `-w` | Workspace ID (inferred from s3:// path if provided) |
 | `--yes`, `-y` | Skip confirmation prompt for s3:// path resolution |
 
-**Recursive download** lists all objects under the prefix, then downloads them in parallel while preserving the original subdirectory structure under the destination directory.
+**Recursive download** lists all objects under the prefix, then downloads them in parallel while preserving the original subdirectory structure under the destination directory. A folder key without a destination downloads into a local directory named after its last segment (`omicslab download snapshots` → `./snapshots/`). An exact object always wins over a same-named folder prefix, and a key that matches neither reports "File or folder not found" instead of a provider 403/404.
 
 ## Environment Variables
 
@@ -132,6 +140,7 @@ omicslab download -y -r s3://my-bucket/data/results/ ./local_results/
 |---|---|
 | `OMICSLAB_TOKEN` | API token (overrides config file) |
 | `OMICSLAB_BASE_URL` | API base URL (default: `https://platform.omicslab.io/api`) |
+| `OMICSLAB_CONFIG_DIR` | Directory holding `config.json` (default: `~/.omicslab`); used by studio sessions to read a container-private config without changing `$HOME` |
 
 ## Jobs API
 

{omicslab-2.2.0 → omicslab-2.5.1}/README.developer.md

@@ -463,6 +463,49 @@ Studio jobs are unchanged: they run as background sandbox services via
 `executor.submit(...)` (spec/bash path), as do jobs dispatched to a runner
 daemon over WebSocket. Only `job run --work-dir` analysis is native/synchronous.
 
+Studio session mounts (no token exposure, snapshot-safe):
+
+- The SDK environment is bind-mounted **read-only at its own absolute path**
+  (pixi/conda envs are path-sensitive), and `omicslab`/`omx` are exposed on
+  `PATH` via a dedicated `/opt/omicslab/bin` directory.
+- `pixi` itself is mounted there too, together with the SDK project's
+  `pixi.toml`/`pixi.lock`, so `pixi run ...` works inside the session. A
+  writable copy of the env's small `conda-meta` directory is mounted over the
+  read-only one because pixi takes its install lock there and appends to
+  `history`; the copy lives in the job dir and is never snapshotted.
+- Users can create their own project envs in the writable workspace
+  (`pixi init` + `pixi add`); those envs are in the writable layer and **are**
+  included in snapshots. The pixi package cache goes to a RAM-backed tmpfs
+  (`PIXI_CACHE_DIR=/run/omicslab-cache`) so downloads never bloat snapshots.
+- The staged CLI config is mounted from the host into
+  `OMICSLAB_CONFIG_DIR=/run/omicslab` before the container starts. The token
+  is replaced with a placeholder first; the SDK talks to a host-side
+  credential broker over `OMICSLAB_BROKER_SOCKET`, and the broker injects the
+  real `Authorization` header upstream. The mount is writable so context
+  commands such as `omx cd` can persist, but it contains only the placeholder
+  token — the real token never appears in the container env, `docker inspect`,
+  the writable layer, or a snapshot.
+  Presigned S3 URLs are still fetched directly by the container. Commands
+  that bypass `Client` (for example the websocket log stream) are not proxied
+  yet.
+- A selected **personal** GitHub credential is injected by a host-side Git
+  HTTPS proxy. Git inside the session rewrites `https://github.com/` to the
+  proxy URL, so no token or credential helper is present in the container.
+  Studio launches reject organization and marketplace credentials. The token
+  stays in the agent process and is never logged or returned to the session.
+- When `STUDIO_EXPORT_AWS_CREDENTIALS` is enabled (Settings → Studio), the
+  backend mints short-lived STS credentials for the workspace storage and the
+  agent starts a host-side S3 signing proxy. The session receives only
+  `AWS_ACCESS_KEY_ID=proxy`, `AWS_SECRET_ACCESS_KEY=proxy`, and
+  `AWS_ENDPOINT_URL=<host proxy>`; the real STS never enters the container.
+  Only credentials carrying a session token are proxied; long-lived provider
+  keys are never exported by this path.
+- The old implicit `/home/omicslab` bind is gone (opt-in via
+  `runtime.home_mount` only): user files stay in the container's writable layer
+  and are therefore included in `docker commit` snapshots.
+- Bind mounts and tmpfs are never committed, so neither the SDK nor the token
+  can leak into a snapshot.
+
 The SDK bootstrap URL is configurable:
 
 - Env var `SDK_TOOLS_BASE` (backend `settings.py`), default

{omicslab-2.2.0 → omicslab-2.5.1}/README.md

@@ -66,7 +66,7 @@ omicslab upload -y ./data.csv s3://my-bucket/data/
 
 ### Download
 
-Download files or directories from workspace storage. Recursive downloads preserve subdirectory structure and use parallel threads.
+Download files or directories from workspace storage. A folder is detected automatically, so a trailing slash and `-r` are optional; recursive downloads preserve subdirectory structure and use parallel threads.
 
 ```bash
 # Single file (defaults to filename in current directory)
@@ -78,7 +78,13 @@ omicslab download results/run1/data.csv ./local_copy.csv
 # Download from s3:// path (auto-resolves workspace)
 omicslab download s3://my-bucket/data/results/report.html
 
-# Recursive directory download (preserves subdirectory structure)
+# Folder download (auto-detected; defaults to ./run1)
+omicslab download results/run1
+
+# Folder download with explicit destination
+omicslab download results/run1 ./local_results/
+
+# Same thing, explicit recursive (preserves subdirectory structure)
 omicslab download -r s3://my-bucket/data/results/ ./local_results/
 
 # Recursive download with custom thread count
@@ -92,12 +98,13 @@ omicslab download -y -r s3://my-bucket/data/results/ ./local_results/
 
 | Flag | Description |
 |------|-------------|
-| `--recursive`, `-r` | Download all files under an s3:// directory prefix |
+| `--recursive`, `-r` | Force recursive download (folders are detected automatically) |
+| `--zip` | Download a folder as a server-built zip archive |
 | `--threads` | Concurrent download threads (default: 4) |
 | `--workspace-id`, `-w` | Workspace ID (inferred from s3:// path if provided) |
 | `--yes`, `-y` | Skip confirmation prompt for s3:// path resolution |
 
-**Recursive download** lists all objects under the prefix, then downloads them in parallel while preserving the original subdirectory structure under the destination directory.
+**Recursive download** lists all objects under the prefix, then downloads them in parallel while preserving the original subdirectory structure under the destination directory. A folder key without a destination downloads into a local directory named after its last segment (`omicslab download snapshots` → `./snapshots/`). An exact object always wins over a same-named folder prefix, and a key that matches neither reports "File or folder not found" instead of a provider 403/404.
 
 ## Environment Variables
 
@@ -105,6 +112,7 @@ omicslab download -y -r s3://my-bucket/data/results/ ./local_results/
 |---|---|
 | `OMICSLAB_TOKEN` | API token (overrides config file) |
 | `OMICSLAB_BASE_URL` | API base URL (default: `https://platform.omicslab.io/api`) |
+| `OMICSLAB_CONFIG_DIR` | Directory holding `config.json` (default: `~/.omicslab`); used by studio sessions to read a container-private config without changing `$HOME` |
 
 ## Jobs API
 

{omicslab-2.2.0 → omicslab-2.5.1}/pyproject.toml

@@ -32,6 +32,7 @@ dependencies = [
     "websockets>=13",
     "psutil>=6",
     "aiohttp>=3.10",
+    "botocore>=1.35,<2",
 ]
 
 [project.scripts]

omicslab-2.5.1/src/omicslab/_version.py

@@ -0,0 +1 @@
+__version__ = "2.5.1"

{omicslab-2.2.0 → omicslab-2.5.1}/src/omicslab/cli/main.py

@@ -563,6 +563,11 @@ def upload(
         error(f"Cannot use --recursive with a file: {source}")
         raise typer.Exit(1)
 
+    # Studio/sandbox sessions export the job id; use it when the caller did
+    # not pass --job-id so uploads are attributed to the running job.
+    if job_id is None:
+        job_id = os.environ.get("OMICSLAB_JOB_ID") or os.environ.get("JOB_ID") or None
+
     config = Config()
     client = get_client()
 
@@ -819,19 +824,31 @@ def upload(
     _BATCH_SIZE = 500
 
     def _get_upload_urls_batch(batch: list[tuple[str, str]]) -> dict[str, str]:
-        """Get presigned URLs for a batch of files."""
+        """Get presigned URLs for a batch of files.
+
+        Keys are sent relative to the folder ``prefix`` so the upload is
+        audited against the folder, with the files listed as affected keys.
+        Presigned responses echo those relative keys, so map them back to the
+        full remote key used by the uploader.
+        """
         files_payload = []
         for local_path, remote_key in batch:
             try:
                 sz = os.path.getsize(local_path)
             except OSError:
                 sz = 0
-            files_payload.append({"key": remote_key, "size": sz})
+            files_payload.append(
+                {"key": remote_key.removeprefix(remote_prefix), "size": sz}
+            )
         try:
-            result = client.storage.batch_upload(ws, "", files_payload)
+            result = client.storage.batch_upload(
+                ws, remote_prefix, files_payload, job_id=job_id
+            )
             url_list = result.get("urls", []) if isinstance(result, dict) else result
             return {
-                entry["key"]: entry["url"] for entry in url_list if entry.get("url")
+                f"{remote_prefix}{entry['key']}": entry["url"]
+                for entry in url_list
+                if entry.get("url")
             }
         except Exception:
             return {}
@@ -966,10 +983,15 @@ def _download_folder_as_zip(
 @app.command()
 def download(
     key: str = typer.Argument(
-        ..., help="Remote file key to download, or s3://bucket/key or s3://bucket/dir/"
+        ...,
+        help=(
+            "Remote file or folder key to download, "
+            "or s3://bucket/key or s3://bucket/dir/"
+        ),
     ),
     destination: str | None = typer.Argument(
-        None, help="Local path (defaults to filename)"
+        None,
+        help="Local path (defaults to the filename, or the folder name for a folder)",
     ),
     workspace_id: str | None = typer.Option(
         None,
@@ -981,7 +1003,7 @@ def download(
         False,
         "--recursive",
         "-r",
-        help="Download all files under an s3:// directory prefix",
+        help="Force recursive download (folders are detected automatically)",
     ),
     zip_archive: bool = typer.Option(
         False,
@@ -998,7 +1020,11 @@ def download(
     """Download a file or directory from workspace storage.
 
     Accepts an s3://bucket/key to resolve the workspace automatically.
-    Use --recursive (-r) to download all files under an s3:// directory prefix.
+
+    Folders are detected automatically: ``omicslab download snapshots`` and
+    ``omicslab download snapshots/ ./snapshots -r`` do the same thing. A
+    folder downloads into a local directory named after its last key segment
+    unless a destination is given.
     """
     config = Config()
     client = get_client()
@@ -1012,8 +1038,6 @@ def download(
     if s3_info:
         ws = s3_info["workspace_id"]
         full_key = s3_info["key_prefix"]
-        if recursive:
-            full_key = full_key.rstrip("/") + "/" if full_key else ""
         print_panel(
             "S3 Path Resolution",
             {
@@ -1029,6 +1053,45 @@ def download(
         if prefix:
             full_key = prefix + key
 
+    # A trailing slash always means a folder. Without one, ask the listing
+    # whether the key is an object or a folder instead of blindly presigning
+    # it: a folder key would fail with a provider 403/404 and look like a
+    # broken URL.
+    folder = bool(full_key) and full_key.endswith("/")
+    if full_key and not folder:
+        try:
+            listing = client.storage.list(ws, prefix=full_key)
+        except Exception as e:
+            error(f"Failed to inspect {full_key!r}: {e}")
+            raise typer.Exit(1)
+        objects = (
+            listing
+            if isinstance(listing, list)
+            else listing.get("objects", [])
+            if isinstance(listing, dict)
+            else None
+        )
+        # ``objects is None`` only happens with an unexpected client shape;
+        # fall back to the object download rather than guessing.
+        if objects is not None:
+            if any(obj.get("is_file") and not obj.get("name") for obj in objects):
+                folder = False
+            elif any(
+                not obj.get("is_file") and obj.get("name") == "/" for obj in objects
+            ):
+                folder = True
+            else:
+                error(f"File or folder not found: {full_key}")
+                raise typer.Exit(1)
+
+    if zip_archive and not folder:
+        error("--zip requires a folder key.")
+        raise typer.Exit(1)
+
+    if folder:
+        full_key = full_key.rstrip("/") + "/"
+        recursive = True
+
     # Recursive directory download
     if recursive and (full_key.endswith("/") or not full_key):
         if zip_archive:
@@ -1076,7 +1139,11 @@ def download(
             info("No files found in this path.")
             return
 
-        dest_dir = Path(destination or ".") if destination else Path(".")
+        # A folder downloads into a directory named after its last key
+        # segment, so `download snapshots` is equivalent to
+        # `download snapshots/ ./snapshots -r`.
+        folder_name = full_key.rstrip("/").rsplit("/", 1)[-1]
+        dest_dir = Path(destination) if destination else Path(folder_name or ".")
         dest_dir.mkdir(parents=True, exist_ok=True)
 
         from rich.progress import (

{omicslab-2.2.0 → omicslab-2.5.1}/src/omicslab/client.py

@@ -46,6 +46,16 @@ class Client:
         ).rstrip("/")
         self._base_url = resolved_base_url
 
+        # Inside a studio session the real token stays in the host-side
+        # credential broker. The session config contains a placeholder token
+        # and this socket; every API call goes through the broker, which
+        # injects the real Authorization header upstream.
+        broker_socket = os.environ.get("OMICSLAB_BROKER_SOCKET")
+        if broker_socket and transport is None:
+            resolved_base_url = "http://broker"
+            self._base_url = resolved_base_url
+            transport = httpx.HTTPTransport(uds=broker_socket)
+
         if token:
             self._config.set_token(token)
         if base_url:

{omicslab-2.2.0 → omicslab-2.5.1}/src/omicslab/config.py

@@ -9,11 +9,26 @@ class Config:
     DEFAULT_PROFILE = "default"
 
     def __init__(self, config_path: Path | None = None, profile: str | None = None):
-        self._config_path = config_path or self.DEFAULT_CONFIG_FILE
+        self._config_path = config_path or self._resolve_config_path()
         self._profile_name = profile or os.environ.get("OMICSLAB_PROFILE")
         self._data: dict = {}
         self._load()
 
+    @classmethod
+    def _resolve_config_path(cls) -> Path:
+        """Resolve the config file path for a new instance.
+
+        ``OMICSLAB_CONFIG_DIR`` lets a caller point the CLI at a dedicated
+        config directory (e.g. a container-private mount) without changing
+        ``$HOME`` — the token is then read from that directory while the
+        user's real profile stays untouched. ``DEFAULT_CONFIG_FILE`` is kept
+        as the fallback (and as the monkeypatch hook used by tests).
+        """
+        config_dir = os.environ.get("OMICSLAB_CONFIG_DIR")
+        if config_dir:
+            return Path(config_dir).expanduser() / "config.json"
+        return cls.DEFAULT_CONFIG_FILE
+
     def _load(self):
         if self._config_path.exists():
             try:

omicslab-2.5.1/src/omicslab/job/_run/_broker.py

@@ -0,0 +1,235 @@
+"""Host-side credential broker for studio sessions.
+
+The session container must be able to call the platform API (``omicslab
+download``/``upload`` and the SDK resources) without ever receiving the real
+job token. This module runs a tiny HTTP proxy on a Unix socket in the agent
+process, injects the real ``Authorization`` header, and forwards the request
+to the API. The container's config contains only a placeholder token.
+
+Security properties:
+
+- The real token never leaves the host process. It is not in the container's
+  environment, argv, files, tmpfs, or snapshot.
+- The upstream base URL is fixed at construction time; request paths are
+  appended to it, so the container cannot turn the broker into an open proxy
+  (absolute and scheme-relative URLs are rejected).
+- Redirects are not followed; the response is streamed back as-is.
+- The socket is only mounted into the session container. Its host directory
+  is private to the agent (``mkdtemp``).
+"""
+
+from __future__ import annotations
+
+import asyncio
+import os
+import threading
+from collections.abc import Callable
+
+from aiohttp import ClientError, ClientSession, ClientTimeout, web
+
+# Hop-by-hop headers must not be forwarded (RFC 7230 §6.1).
+_HOP_BY_HOP = frozenset(
+    {
+        "connection",
+        "keep-alive",
+        "proxy-authenticate",
+        "proxy-authorization",
+        "te",
+        "trailer",
+        "trailers",
+        "transfer-encoding",
+        "upgrade",
+    }
+)
+_SKIP_REQUEST = _HOP_BY_HOP | {
+    "host",
+    "authorization",
+    # The backend trusts forwarding headers from its private-network peers;
+    # the broker is such a peer, so a session must not be able to spoof its
+    # audit IP through them.
+    "forwarded",
+    "x-forwarded-for",
+    "x-forwarded-host",
+    "x-forwarded-proto",
+    "x-real-ip",
+}
+_SKIP_RESPONSE = _HOP_BY_HOP | {"content-length"}
+
+_CHUNK_SIZE = 64 * 1024
+
+
+class CredentialBroker:
+    """Inject the real API token into requests made by the session container.
+
+    ``start()`` binds a Unix socket and blocks until it is accepting requests;
+    ``stop()`` shuts the listener down and removes the socket. The broker is
+    designed to live for one studio session.
+    """
+
+    def __init__(
+        self,
+        upstream_base: str,
+        token: str,
+        socket_path: str,
+        log: Callable[[str], None] | None = None,
+    ):
+        self._upstream_base = upstream_base.rstrip("/")
+        self._token = token
+        self._socket_path = socket_path
+        self._log = log or (lambda _message: None)
+        self._ready = threading.Event()
+        self._error: BaseException | None = None
+        self._loop: asyncio.AbstractEventLoop | None = None
+        self._stopped: asyncio.Event | None = None
+        self._session: ClientSession | None = None
+        self._thread: threading.Thread | None = None
+        self._started = False
+
+    # ── lifecycle ──────────────────────────────────────────────────────
+
+    def start(self, timeout: float = 10.0) -> None:
+        """Start the broker and wait until the socket is accepting requests."""
+        if self._thread is not None:
+            return
+        parent = os.path.dirname(self._socket_path)
+        if parent:
+            os.makedirs(parent, exist_ok=True)
+        try:
+            os.unlink(self._socket_path)
+        except FileNotFoundError:
+            pass
+
+        self._thread = threading.Thread(
+            target=self._run,
+            name="omicslab-credential-broker",
+            daemon=True,
+        )
+        self._thread.start()
+        if not self._ready.wait(timeout):
+            self.stop()
+            raise RuntimeError("credential broker did not start in time")
+        if self._error is not None:
+            self.stop()
+            raise RuntimeError(f"credential broker failed to start: {self._error}")
+        self._started = True
+        self._log(f"[BROKER] in-session API broker listening on {self._socket_path}")
+
+    def stop(self, timeout: float = 5.0) -> None:
+        """Stop the listener and remove the Unix socket."""
+        if self._loop is not None and self._stopped is not None:
+            try:
+                self._loop.call_soon_threadsafe(self._stopped.set)
+            except RuntimeError:
+                # The loop already closed (e.g. startup failed).
+                pass
+        if self._thread is not None:
+            self._thread.join(timeout=timeout)
+            self._thread = None
+        try:
+            os.unlink(self._socket_path)
+        except FileNotFoundError:
+            pass
+        if self._started:
+            self._started = False
+            self._log("[BROKER] in-session API broker stopped")
+
+    def _run(self) -> None:
+        try:
+            asyncio.run(self._serve())
+        except BaseException as exc:  # noqa: BLE001 - reported by start()
+            self._error = exc
+            self._ready.set()
+
+    async def _serve(self) -> None:
+        self._loop = asyncio.get_running_loop()
+        self._stopped = asyncio.Event()
+        self._session = ClientSession(
+            auto_decompress=False,
+            trust_env=False,
+            timeout=ClientTimeout(total=None, connect=30, sock_read=600),
+        )
+        app = web.Application()
+        app.router.add_route("*", "/{tail:.*}", self._handle)
+        runner = web.AppRunner(app, access_log=None)
+        await runner.setup()
+        try:
+            site = web.UnixSite(runner, self._socket_path)
+            await site.start()
+            try:
+                os.chmod(self._socket_path, 0o666)
+            except OSError:
+                pass
+            self._ready.set()
+            await self._stopped.wait()
+        finally:
+            await self._session.close()
+            await runner.cleanup()
+
+    # ── proxy ──────────────────────────────────────────────────────────
+
+    def _upstream_url(self, path: str, query: str) -> str:
+        """Build the fixed-upstream URL for a request path.
+
+        Only relative paths are accepted. ``//host`` and absolute URLs would
+        let a session redirect the broker (and the token) elsewhere.
+        """
+        if not path.startswith("/") or path.startswith("//") or "://" in path:
+            raise ValueError("invalid request path")
+        url = f"{self._upstream_base}{path}"
+        return f"{url}?{query}" if query else url
+
+    async def _handle(self, request: web.Request) -> web.StreamResponse:
+        try:
+            url = self._upstream_url(request.path, request.query_string)
+        except ValueError:
+            return web.json_response({"message": "invalid request path"}, status=400)
+
+        headers = {
+            key: value
+            for key, value in request.headers.items()
+            if key.lower() not in _SKIP_REQUEST
+        }
+        # Always replace any client-supplied credential.
+        headers["Authorization"] = f"Bearer {self._token}"
+
+        data = self._body(request)
+        session = self._session
+        if session is None:
+            return web.json_response({"message": "broker not ready"}, status=503)
+
+        try:
+            async with session.request(
+                request.method,
+                url,
+                headers=headers,
+                data=data,
+                allow_redirects=False,
+            ) as upstream:
+                response = web.StreamResponse(status=upstream.status)
+                for key, value in upstream.headers.items():
+                    if key.lower() not in _SKIP_RESPONSE:
+                        response.headers.add(key, value)
+                if request.method == "HEAD" or upstream.status in (204, 304):
+                    await response.prepare(request)
+                    await response.write_eof()
+                    return response
+                await response.prepare(request)
+                async for chunk in upstream.content.iter_chunked(_CHUNK_SIZE):
+                    await response.write(chunk)
+                await response.write_eof()
+                return response
+        except asyncio.TimeoutError:
+            return web.json_response({"message": "upstream timeout"}, status=504)
+        except ClientError:
+            return web.json_response({"message": "upstream unavailable"}, status=502)
+
+    def _body(self, request: web.Request):
+        """Stream a request body without buffering it in memory."""
+        if not request.can_read_body:
+            return None
+
+        async def _iter():
+            async for chunk in request.content.iter_chunked(_CHUNK_SIZE):
+                yield chunk
+
+        return _iter()