diff --git a/server/src/__tests__/body-limits.test.ts b/server/src/__tests__/body-limits.test.ts new file mode 100644 index 00000000000..bf51a167523 --- /dev/null +++ b/server/src/__tests__/body-limits.test.ts @@ -0,0 +1,14 @@ +import { describe, expect, it } from "vitest"; + +import { + PORTABLE_JSON_BODY_LIMIT, + PORTABLE_JSON_BODY_LIMIT_BYTES, +} from "../http/body-limits.js"; + +describe("HTTP body limits", () => { + it("allows PAP-scale portable import JSON payloads", () => { + expect(PORTABLE_JSON_BODY_LIMIT).toBe("64mb"); + expect(PORTABLE_JSON_BODY_LIMIT_BYTES).toBe(64 * 1024 * 1024); + expect(PORTABLE_JSON_BODY_LIMIT_BYTES).toBeGreaterThan(10 * 1024 * 1024); + }); +}); diff --git a/server/src/app.ts b/server/src/app.ts index d037718420f..21ebb1497d3 100644 --- a/server/src/app.ts +++ b/server/src/app.ts @@ -59,6 +59,7 @@ import { pluginRegistryService } from "./services/plugin-registry.js"; import { createHostClientHandlers } from "@paperclipai/plugin-sdk"; import type { BetterAuthSessionResult } from "./auth/better-auth.js"; import { createCachedViteHtmlRenderer } from "./vite-html-renderer.js"; +import { PORTABLE_JSON_BODY_LIMIT } from "./http/body-limits.js"; type UiMode = "none" | "static" | "vite-dev"; const FEEDBACK_EXPORT_FLUSH_INTERVAL_MS = 5_000; @@ -139,7 +140,7 @@ export async function createApp( app.use(express.json({ // Company import/export payloads can inline full portable packages. - limit: "10mb", + limit: PORTABLE_JSON_BODY_LIMIT, verify: (req, _res, buf) => { (req as unknown as { rawBody: Buffer }).rawBody = buf; }, diff --git a/server/src/http/body-limits.ts b/server/src/http/body-limits.ts new file mode 100644 index 00000000000..c3b6c81bacc --- /dev/null +++ b/server/src/http/body-limits.ts @@ -0,0 +1,2 @@ +export const PORTABLE_JSON_BODY_LIMIT = "64mb"; +export const PORTABLE_JSON_BODY_LIMIT_BYTES = 64 * 1024 * 1024;