fix: validate HTTPS binding limits and response ordering

crates/wip-https/tests/codecs.rs

@@ -367,6 +367,27 @@ fn caller_limits_bound_bytes_and_nesting() {
     let nested = br#"{"path":[[["/"]]]}"#;
     let nesting_limited = Limits::new(1024, 1024, 2, 1).unwrap();
     assert!(decode_fetch_request(nested, nesting_limited).is_err());
+
+    let outbound_limited = Limits::new(1_000_000, 1_000_000, 1, 10).unwrap();
+    assert!(
+        encode_call_operation_request(
+            &endpoint(),
+            &call_request(),
+            &descriptor(),
+            outbound_limited,
+        )
+        .is_err()
+    );
+    assert!(
+        encode_fetch_response(
+            &FetchRequest {
+                path: "/item".into(),
+            },
+            &object("item", b"validator"),
+            outbound_limited,
+        )
+        .is_err()
+    );
 }
 
 #[test]
@@ -400,6 +421,25 @@ fn unsupported_descriptor_format_is_client_local() {
         ClientResponseError::UnsupportedDescriptorFormat { format }
             if format == "wip-interface/2"
     ));
+
+    for malformed in [
+        br#"{"interface":"wrong","descriptor":{"format":"wip-interface/2"}}"#.as_slice(),
+        br#"{"interface":"interface-v1","descriptor":{"format":"wip-interface/2"},"validator":null}"#
+            .as_slice(),
+    ] {
+        let response = wip_https::http::Response::builder()
+            .status(StatusCode::OK)
+            .header("content-type", "application/json; charset=utf-8")
+            .body(malformed.to_vec())
+            .unwrap();
+        assert!(matches!(
+            decode_fetch_interface_response(&request, &response, limits()).unwrap_err(),
+            ClientResponseError::InvalidResponse {
+                kind: InvalidResponseKind::InvalidSuccessBody,
+                ..
+            }
+        ));
+    }
 }
 
 #[test]