fix(auth): bound asynchronous login handling

dashboard/auth_server.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import asyncio
 import secrets
 import time
 from urllib.parse import parse_qs, urlsplit
@@ -91,13 +92,15 @@ async def login(request: Request) -> Response:
     if content_type != "application/x-www-form-urlencoded":
         authentication.log_auth_event("login_request_rejected", correlation_id)
         return PlainTextResponse("Bad Request", status_code=400)
-    body = await request.body()
-    if len(body) > _MAX_LOGIN_BODY_BYTES:
-        authentication.log_auth_event("login_request_rejected", correlation_id)
-        return PlainTextResponse("Bad Request", status_code=400)
+    body = bytearray()
+    async for chunk in request.stream():
+        if len(body) + len(chunk) > _MAX_LOGIN_BODY_BYTES:
+            authentication.log_auth_event("login_request_rejected", correlation_id)
+            return PlainTextResponse("Bad Request", status_code=400)
+        body.extend(chunk)
     try:
         values = parse_qs(
-            body.decode("utf-8"),
+            bytes(body).decode("utf-8"),
             keep_blank_values=True,
             strict_parsing=True,
             max_num_fields=3,
@@ -121,7 +124,9 @@ async def login(request: Request) -> Response:
     if not authentication.verify_credentials(
         settings.credentials, submitted_id, submitted_password
     ):
-        authentication.enforce_failed_login_delay(started_at=started_at)
+        await asyncio.to_thread(
+            authentication.enforce_failed_login_delay, started_at=started_at
+        )
         authentication.log_auth_event("login_failed", correlation_id)
         return _redirect("/?auth_error=invalid")