# Minimal reproducible example.
# Run: uvicorn main:app --port 8000

import email.message
from fastapi import FastAPI, Request
from fastapi.responses import JSONResponse
from pydantic import BaseModel

app = FastAPI()


class Item(BaseModel):
    username: str
    role: str = "user"


# ── Application-level middleware that routes auth by Content-Type ──
# A common pattern when an API serves both browser (form) and
# programmatic (JSON) clients with different auth requirements.
@app.middleware("http")
async def auth_middleware(request: Request, call_next):
    if request.url.path.startswith("/admin"):
        ct = request.headers.get("content-type", "")
        if ct.lower().startswith("application/json"):
            # JSON API call — require strong token
            token = request.headers.get("x-api-token", "")
            if token != "secret-admin-token":
                return JSONResponse(status_code=401, content={"error": "admin token required"})
        else:
            # Assumed to be a browser form — require session cookie
            session = request.cookies.get("session") or request.headers.get("x-session", "")
            if session != "valid-user-session":
                return JSONResponse(status_code=401, content={"error": "session required"})
            # NOTE: session path does not enforce role — assumes browser UI handles it
    return await call_next(request)


@app.post("/admin/update")
async def admin_update(item: Item):
    return {
        "status": "updated",
        "username": item.username,
        "role": item.role,
        "note": "PRIVILEGE ESCALATION" if item.role == "admin" else "ok",
    }


# Shows how FastAPI's internal parser classifies a given Content-Type
@app.get("/debug/parser")
async def debug_parser(ct: str):
    msg = email.message.Message()
    msg["content-type"] = ct
    subtype = msg.get_content_subtype()
    return {
        "content_type": ct,
        "maintype": msg.get_content_maintype(),
        "subtype": subtype,
        "fastapi_treats_as_json": (
            msg.get_content_maintype() == "application"
            and (subtype == "json" or subtype.endswith("+json"))
        ),
    }


```bash
# --- Expected behavior ---

# 1. JSON call without admin token → correctly rejected by middleware
curl -s -X POST http://localhost:8000/admin/update \
  -H "Content-Type: application/json" \
  -d '{"username": "bob", "role": "admin"}'
# → {"error": "admin token required"}

# 2. Form call with valid session → middleware accepts, but FastAPI receives
#    raw bytes for a JSON-body endpoint → Pydantic 422 (cannot parse form bytes as model)
curl -s -X POST http://localhost:8000/admin/update \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "X-Session: valid-user-session" \
  -d '{"username": "bob", "role": "admin"}'
# → {"detail": [{"type": "model_attributes_type", ...}]}  (422)

# --- The inconsistency ---

# 3. Send JSON payload with Content-Type: application/x-www-form-urlencoded+json
#    Middleware sees "form" → accepts session cookie → no token check
#    FastAPI sees "+json" suffix → calls request.json() → full JSON parsed
#    Result: admin endpoint called with only a session cookie
curl -s -X POST http://localhost:8000/admin/update \
  -H "Content-Type: application/x-www-form-urlencoded+json" \
  -H "X-Session: valid-user-session" \
  -d '{"username": "bob", "role": "admin"}'
# → {"status": "updated", "username": "bob", "role": "admin", "note": "PRIVILEGE ESCALATION"}

# 4. Debug: confirm parser classification
curl -s "http://localhost:8000/debug/parser?ct=application/x-www-form-urlencoded%2Bjson"
# → {
#     "content_type": "application/x-www-form-urlencoded+json",
#     "maintype": "application",
#     "subtype": "x-www-form-urlencoded+json",
#     "fastapi_treats_as_json": true    ← framework treats it as JSON
#   }

# Pattern 1 — different auth requirements
@app.middleware("http")
async def auth_middleware(request: Request, call_next):
    ct = request.headers.get("content-type", "")
    if ct.startswith("application/json"):
        require_api_token(request)      # strong auth for JSON API
    else:
        require_session_cookie(request) # weaker session auth for browser
    return await call_next(request)

# Pattern 2 — different input validation
@app.middleware("http")
async def validation_middleware(request: Request, call_next):
    ct = request.headers.get("content-type", "")
    if ct.startswith("application/json"):
        await validate_json_schema(request)   # schema checks for API
    # form submissions: trust Pydantic alone
    return await call_next(request)

# Pattern 3 — different rate limit tiers
@app.middleware("http")
async def rate_limit_middleware(request: Request, call_next):
    ct = request.headers.get("content-type", "")
    if ct.startswith("application/json"):
        apply_api_rate_limit(request)     # 100 req/min for API
    else:
        apply_browser_rate_limit(request) # 1000 req/min for forms
    return await call_next(request)

@app.middleware("http")
async def business_rules_middleware(request: Request, call_next):
    ct = request.headers.get("content-type", "")
    if ct.startswith("application/json"):
        body = await request.body()
        data = json.loads(body)
        if data.get("role") in ("admin", "superadmin"):
            return JSONResponse(status_code=403, content={"error": "role escalation not allowed"})
    return await call_next(request)

# Blocked:
# POST /users/  Content-Type: application/json  {"role": "admin"}
# → 403

# Bypassed:
# POST /users/  Content-Type: application/x-www-form-urlencoded+json  {"role": "admin"}
# → 200  (middleware skipped, FastAPI parses JSON, Pydantic accepts it)

# routing.py — replacement for lines 416-422

_NON_JSON_SUBTYPE_BASES: frozenset[str] = frozenset({
    "x-www-form-urlencoded",
    "octet-stream",
    "form-data",
    "pdf",
    "zip",
    "gzip",
    "msword",
})

def _is_json_content_type(content_type: str) -> bool:
    mime_type = content_type.split(";", 1)[0].strip().lower()
    if not mime_type.startswith("application/"):
        return False
    subtype = mime_type[len("application/"):]
    if subtype == "json":
        return True
    if subtype.endswith("+json"):
        base = subtype[: -len("+json")]
        if base in _NON_JSON_SUBTYPE_BASES:
            return False
        return True
    return False

# Replace lines 417-422 with:
if _is_json_content_type(content_type_value):
    json_body = await request.json()