Add HTTP_POST_TIMEOUT to TimeoutMiddleware config (#5941) (#6150)

## Summary

Adds `HTTP_POST_TIMEOUT` to the `methods_timeout` dict in
`backend/main.py`, enabling per-method timeout control for POST
requests.

Fixes #5941 — `sync-local-files` 504 timeouts on large payloads. POST
was the only HTTP method missing from the timeout config (omitted since
the original `ac328e5b` commit in Jan 2025).

## Changes

- `backend/main.py`: Add `"POST": os.environ.get('HTTP_POST_TIMEOUT')`
to `methods_timeout`
- `backend/tests/unit/test_timeout_middleware.py`: 3 new tests covering
POST timeout override, None fallback with `{"POST": None}`, and AST
verification of both key and env var name

## Deployment

After merge, set on **backend-sync** Cloud Run:
```
HTTP_POST_TIMEOUT=600
```

This matches `backend` (main) which already has
`HTTP_DEFAULT_TIMEOUT=600` — POST there already gets 600s via fallback.
The fix is specifically for `backend-sync` (and any other service) where
the default is 120s.

**Current env var state** (from mon's audit):
| Service | HTTP_DEFAULT_TIMEOUT | HTTP_POST_TIMEOUT (after this PR) |
|---------|---------------------|----------------------------------|
| backend (main) | 600s | set to 600s |
| backend-sync | 120s (hardcoded) | **set to 600s** ← fixes #5941 |
| All others | 120s (hardcoded) | unset (120s fallback) |

## WebSocket impact: None

HTTP_POST_TIMEOUT does NOT affect WebSocket connections (`/v4/listen`):
1. WebSocket upgrade requests are GET, not POST
2. Starlette `BaseHTTPMiddleware` only handles HTTP requests — WebSocket
connections go through a different ASGI path
3. `NO_SOCKET_TIMEOUT` in helm values is for a separate layer

## Risks

- **Scope**: `HTTP_POST_TIMEOUT` applies to ALL POST routes, not just
`/v1/sync-local-files`. Consistent with GET/PUT/PATCH/DELETE.
- **No behavior change without env var**: `None` is filtered by
`_parse_methods_timeout` → POST falls back to `HTTP_DEFAULT_TIMEOUT`.

## Tests

16/16 pass (`pytest backend/tests/unit/test_timeout_middleware.py`):
- 13 existing tests unchanged
- `test_post_timeout_override`: POST with explicit timeout → 504 on slow
handler
- `test_post_timeout_none_falls_back_to_default`: `{"POST": None}` →
skipped → default timeout
- `test_main_methods_timeout_includes_post`: AST-parses main.py, asserts
POST key + HTTP_POST_TIMEOUT env var

## Live Test Evidence

### L1 (standalone backend)
```
Parsed methods_timeout: {'POST': 2.0}
Default timeout: 120.0
POST resolved: 2.0
Without env var, parsed: {}
POST falls back to default: 120.0

Fast POST: 200 (expect 200) ✓
Slow POST: 504 (expect 504) ✓
```

### L2 (backend + client integrated)
```
GET /health: 200 {'status': 'ok'} ✓
POST /upload-fast: 200 {'received': 1500} ✓
POST /upload-slow: 504 ✓
```

### Changed-path coverage

| Path ID | Changed path | Happy-path | Non-happy-path | L1 | L2 |
|---|---|---|---|---|---|
| P1 | `main.py:121` POST in methods_timeout | POST completes within
timeout → 200 | POST exceeds timeout → 504 | PASS | PASS |
| P2 | `test_timeout_middleware.py` tests | 16/16 pass | N/A (test code)
| PASS | N/A |

_by AI for @beastoin_

Author: beastoin

backend/main.py

@@ -118,6 +118,7 @@
 
 methods_timeout = {
     "GET": os.environ.get('HTTP_GET_TIMEOUT'),
+    "POST": os.environ.get('HTTP_POST_TIMEOUT'),
     "PUT": os.environ.get('HTTP_PUT_TIMEOUT'),
     "PATCH": os.environ.get('HTTP_PATCH_TIMEOUT'),
     "DELETE": os.environ.get('HTTP_DELETE_TIMEOUT'),

backend/tests/unit/test_timeout_middleware.py

@@ -182,3 +182,78 @@ def test_timeout_returns_504():
     client = TestClient(app)
     response = client.get("/slow")
     assert response.status_code == 504
+
+
+def test_post_timeout_override():
+    """POST requests use HTTP_POST_TIMEOUT when set (#5941)."""
+
+    async def slow_post(request):
+        await asyncio.sleep(10)
+        return PlainTextResponse("slow post")
+
+    app = Starlette(
+        routes=[
+            Route("/upload", slow_post, methods=["POST"]),
+        ],
+    )
+    app.add_middleware(TimeoutMiddleware, methods_timeout={"POST": 0.1})
+    client = TestClient(app)
+    response = client.post("/upload")
+    assert response.status_code == 504
+
+
+def test_post_timeout_none_falls_back_to_default(monkeypatch):
+    """POST with None timeout falls back to HTTP_DEFAULT_TIMEOUT (#5941)."""
+    monkeypatch.setenv("HTTP_DEFAULT_TIMEOUT", "0.1")
+
+    async def slow_post(request):
+        await asyncio.sleep(10)
+        return PlainTextResponse("slow post")
+
+    app = Starlette(
+        routes=[
+            Route("/upload", slow_post, methods=["POST"]),
+        ],
+    )
+    # POST: None mirrors main.py when HTTP_POST_TIMEOUT env var is unset.
+    # _parse_methods_timeout skips None → falls back to default (0.1s)
+    app.add_middleware(TimeoutMiddleware, methods_timeout={"POST": None})
+    client = TestClient(app)
+    response = client.post("/upload")
+    assert response.status_code == 504
+
+
+def test_main_methods_timeout_includes_post():
+    """backend/main.py methods_timeout dict includes POST wired to HTTP_POST_TIMEOUT (#5941).
+
+    AST-parses main.py to verify the POST entry exists in the methods_timeout
+    assignment and is wired to os.environ.get('HTTP_POST_TIMEOUT'), without
+    importing the full app (avoids startup side effects).
+    """
+    import ast
+    from pathlib import Path
+
+    main_py = Path(__file__).resolve().parents[2] / "main.py"
+    tree = ast.parse(main_py.read_text())
+    for node in ast.walk(tree):
+        if isinstance(node, ast.Assign):
+            for target in node.targets:
+                if isinstance(target, ast.Name) and target.id == "methods_timeout":
+                    assert isinstance(node.value, ast.Dict)
+                    key_value_pairs = dict(zip(node.value.keys, node.value.values))
+                    post_key = None
+                    post_value = None
+                    for k, v in zip(node.value.keys, node.value.values):
+                        if isinstance(k, ast.Constant) and k.value == "POST":
+                            post_key = k
+                            post_value = v
+                            break
+                    assert post_key is not None, "POST missing from methods_timeout keys"
+                    # Verify value is os.environ.get('HTTP_POST_TIMEOUT')
+                    assert isinstance(post_value, ast.Call), "POST value should be a function call"
+                    assert isinstance(post_value.args[0], ast.Constant), "First arg should be a string constant"
+                    assert (
+                        post_value.args[0].value == "HTTP_POST_TIMEOUT"
+                    ), f"POST env var should be HTTP_POST_TIMEOUT, got {post_value.args[0].value}"
+                    return
+    raise AssertionError("methods_timeout assignment not found in main.py")