Scope portable import body limit

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/body-limits.test.ts

@@ -1,11 +1,16 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  DEFAULT_JSON_BODY_LIMIT,
   PORTABLE_JSON_BODY_LIMIT,
   PORTABLE_JSON_BODY_LIMIT_BYTES,
 } from "../http/body-limits.js";
 
 describe("HTTP body limits", () => {
+  it("keeps the global JSON parser at the established ceiling", () => {
+    expect(DEFAULT_JSON_BODY_LIMIT).toBe("10mb");
+  });
+
   it("allows PAP-scale portable import JSON payloads", () => {
     expect(PORTABLE_JSON_BODY_LIMIT).toBe("64mb");
     expect(PORTABLE_JSON_BODY_LIMIT_BYTES).toBe(64 * 1024 * 1024);

server/src/app.ts

@@ -59,7 +59,8 @@ import { pluginRegistryService } from "./services/plugin-registry.js";
 import { createHostClientHandlers } from "@paperclipai/plugin-sdk";
 import type { BetterAuthSessionResult } from "./auth/better-auth.js";
 import { createCachedViteHtmlRenderer } from "./vite-html-renderer.js";
-import { PORTABLE_JSON_BODY_LIMIT } from "./http/body-limits.js";
+import { DEFAULT_JSON_BODY_LIMIT, PORTABLE_JSON_BODY_LIMIT } from "./http/body-limits.js";
+import { COMPANY_IMPORT_API_PATH } from "./routes/company-import-paths.js";
 
 type UiMode = "none" | "static" | "vite-dev";
 const FEEDBACK_EXPORT_FLUSH_INTERVAL_MS = 5_000;
@@ -145,13 +146,17 @@ export async function createApp(
   },
 ) {
   const app = express();
+  const captureRawBody = (req: express.Request, _res: express.Response, buf: Buffer) => {
+    (req as unknown as { rawBody: Buffer }).rawBody = buf;
+  };
 
-  app.use(express.json({
-    // Company import/export payloads can inline full portable packages.
+  app.use(COMPANY_IMPORT_API_PATH, express.json({
     limit: PORTABLE_JSON_BODY_LIMIT,
-    verify: (req, _res, buf) => {
-      (req as unknown as { rawBody: Buffer }).rawBody = buf;
-    },
+    verify: captureRawBody,
+  }));
+  app.use(express.json({
+    limit: DEFAULT_JSON_BODY_LIMIT,
+    verify: captureRawBody,
   }));
   app.use(httpLogger);
   const privateHostnameGateEnabled = shouldEnablePrivateHostnameGuard({

server/src/http/body-limits.ts

@@ -1,2 +1,3 @@
+export const DEFAULT_JSON_BODY_LIMIT = "10mb";
 export const PORTABLE_JSON_BODY_LIMIT = "64mb";
 export const PORTABLE_JSON_BODY_LIMIT_BYTES = 64 * 1024 * 1024;