fix: reject malformed activity feed payloads (#107)

tests/test_event_stream.py

@@ -164,6 +164,25 @@ async def test_activity_events_normalizes_null_feed_payload(monkeypatch):
     assert await gitea_proxy.activity_events() == []
 
 
+@pytest.mark.anyio
+async def test_event_stream_rejects_malformed_activity_feed_payload(monkeypatch):
+    async def fake_current_user():
+        return {"login": "timmy"}
+
+    async def fake_fetch(path):
+        return {"message": "unexpected upstream shape"}
+
+    monkeypatch.setattr(gitea_proxy, "current_user", fake_current_user)
+    monkeypatch.setattr(gitea_proxy, "fetch", fake_fetch)
+
+    response = await main.event_stream()
+
+    assert getattr(response, "status_code", None) == 503
+    assert json.loads(response.body) == {
+        "error": "Gitea event stream is temporarily unavailable"
+    }
+
+
 @pytest.mark.anyio
 async def test_activity_events_normalizes_malformed_nested_metadata(monkeypatch):
     async def fake_current_user():