Harden host deletion and test stability

internal/app/app_test.go

@@ -5,12 +5,10 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"fmt"
 	"io"
 	"net"
 	"net/http"
 	"net/http/httptest"
-	"path/filepath"
 	"strings"
 	"testing"
 	"time"
@@ -20,6 +18,7 @@ import (
 	"sub2api-cn-relay-manager/internal/provision"
 	"sub2api-cn-relay-manager/internal/reconcile"
 	"sub2api-cn-relay-manager/internal/store/sqlite"
+	"sub2api-cn-relay-manager/internal/testutil"
 )
 
 func TestServeExposesHealthz(t *testing.T) {
@@ -497,6 +496,19 @@ func TestDecodeJSON(t *testing.T) {
 			t.Fatalf("Message = %q, want single object error", err.Message)
 		}
 	})
+
+	t.Run("rejects oversized request body", func(t *testing.T) {
+		payload := `{"host_base_url":"https://example.com","pack_path":"` + strings.Repeat("x", int(maxJSONBodyBytes)) + `"}`
+		request := httptest.NewRequest(http.MethodPost, "/", strings.NewReader(payload))
+		var got InstallPackRequest
+		err := decodeJSON(request, &got)
+		if err == nil {
+			t.Fatal("decodeJSON() error = nil, want oversized error")
+		}
+		if err.StatusCode != http.StatusRequestEntityTooLarge || err.Code != "request_too_large" {
+			t.Fatalf("decodeJSON() = %#v, want request_too_large", err)
+		}
+	})
 }
 
 func TestWriteJSON(t *testing.T) {
@@ -975,20 +987,12 @@ func TestHostSupportStatusRequiresPlansCapability(t *testing.T) {
 
 func openAppTestStore(t *testing.T) *sqlite.DB {
 	t.Helper()
-	dbPath := filepath.Join(t.TempDir(), "state.db")
-	dsn := fmt.Sprintf("file:%s?_busy_timeout=5000&_pragma=foreign_keys(0)", filepath.ToSlash(dbPath))
-	store, err := sqlite.Open(context.Background(), dsn)
-	if err != nil {
-		t.Fatalf("sqlite.Open() error = %v", err)
-	}
-	return store
+	return testutil.OpenSQLiteStore(t, testutil.SQLiteTestDSN(t, "state.db", true))
 }
 
 func closeAppTestStore(t *testing.T, store *sqlite.DB) {
 	t.Helper()
-	if err := store.Close(); err != nil {
-		t.Fatalf("store.Close() error = %v", err)
-	}
+	testutil.CloseSQLiteStore(t, store)
 }
 
 func assertJSONContains(t *testing.T, payload []byte, key string, want any) {