From 7593fffb3074304e4a3cc22608f2e57cc2d2086b Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Tue, 19 May 2026 16:09:25 -0500
Subject: [PATCH] Scope portable import body limit

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 server/src/__tests__/body-limits.test.ts |  5 +++++
 server/src/app.ts                        | 17 +++++++++++------
 server/src/http/body-limits.ts           |  1 +
 3 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/server/src/__tests__/body-limits.test.ts b/server/src/__tests__/body-limits.test.ts
index bf51a167523..8164e32bd87 100644
--- a/server/src/__tests__/body-limits.test.ts
+++ b/server/src/__tests__/body-limits.test.ts
@@ -1,11 +1,16 @@
 import { describe, expect, it } from "vitest";
 
 import {
+  DEFAULT_JSON_BODY_LIMIT,
   PORTABLE_JSON_BODY_LIMIT,
   PORTABLE_JSON_BODY_LIMIT_BYTES,
 } from "../http/body-limits.js";
 
 describe("HTTP body limits", () => {
+  it("keeps the global JSON parser at the established ceiling", () => {
+    expect(DEFAULT_JSON_BODY_LIMIT).toBe("10mb");
+  });
+
   it("allows PAP-scale portable import JSON payloads", () => {
     expect(PORTABLE_JSON_BODY_LIMIT).toBe("64mb");
     expect(PORTABLE_JSON_BODY_LIMIT_BYTES).toBe(64 * 1024 * 1024);
diff --git a/server/src/app.ts b/server/src/app.ts
index 59390116d2f..15e94216bcc 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -59,7 +59,8 @@ import { pluginRegistryService } from "./services/plugin-registry.js";
 import { createHostClientHandlers } from "@paperclipai/plugin-sdk";
 import type { BetterAuthSessionResult } from "./auth/better-auth.js";
 import { createCachedViteHtmlRenderer } from "./vite-html-renderer.js";
-import { PORTABLE_JSON_BODY_LIMIT } from "./http/body-limits.js";
+import { DEFAULT_JSON_BODY_LIMIT, PORTABLE_JSON_BODY_LIMIT } from "./http/body-limits.js";
+import { COMPANY_IMPORT_API_PATH } from "./routes/company-import-paths.js";
 
 type UiMode = "none" | "static" | "vite-dev";
 const FEEDBACK_EXPORT_FLUSH_INTERVAL_MS = 5_000;
@@ -145,13 +146,17 @@ export async function createApp(
   },
 ) {
   const app = express();
+  const captureRawBody = (req: express.Request, _res: express.Response, buf: Buffer) => {
+    (req as unknown as { rawBody: Buffer }).rawBody = buf;
+  };
 
-  app.use(express.json({
-    // Company import/export payloads can inline full portable packages.
+  app.use(COMPANY_IMPORT_API_PATH, express.json({
     limit: PORTABLE_JSON_BODY_LIMIT,
-    verify: (req, _res, buf) => {
-      (req as unknown as { rawBody: Buffer }).rawBody = buf;
-    },
+    verify: captureRawBody,
+  }));
+  app.use(express.json({
+    limit: DEFAULT_JSON_BODY_LIMIT,
+    verify: captureRawBody,
   }));
   app.use(httpLogger);
   const privateHostnameGateEnabled = shouldEnablePrivateHostnameGuard({
diff --git a/server/src/http/body-limits.ts b/server/src/http/body-limits.ts
index c3b6c81bacc..12c45705b41 100644
--- a/server/src/http/body-limits.ts
+++ b/server/src/http/body-limits.ts
@@ -1,2 +1,3 @@
+export const DEFAULT_JSON_BODY_LIMIT = "10mb";
 export const PORTABLE_JSON_BODY_LIMIT = "64mb";
 export const PORTABLE_JSON_BODY_LIMIT_BYTES = 64 * 1024 * 1024;