From eb3eae3fac0781fc3a6e1ca70c3032165366ff8a Mon Sep 17 00:00:00 2001
From: Nils Schneider <nils.schneider@posteo.de>
Date: Wed, 29 Oct 2025 22:49:48 +0100
Subject: [PATCH] upload limit

---
 backend/src/config.rs       | 7 +++++++
 backend/src/routes/mod.rs   | 6 +++++-
 backend/tests/common/mod.rs | 1 +
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/backend/src/config.rs b/backend/src/config.rs
index 39b6dc8..c79c3da 100644
--- a/backend/src/config.rs
+++ b/backend/src/config.rs
@@ -56,6 +56,8 @@ pub struct AppConfig {
     pub quickwit_index: Option<String>,
     #[serde(default = "default_worker_max_document_bytes")]
     pub worker_max_document_bytes: u64,
+    #[serde(default = "default_upload_body_limit_bytes")]
+    pub upload_body_limit_bytes: u64,
     #[serde(default)]
     pub webauthn_rp_id: Option<String>,
     #[serde(default)]
@@ -76,6 +78,7 @@ impl AppConfig {
             passkeys_enabled = config.webauthn_origin.is_some(),
             s3_bucket = %config.s3_bucket,
             worker_max_document_bytes = config.worker_max_document_bytes,
+            upload_body_limit_bytes = config.upload_body_limit_bytes,
             "loaded backend configuration"
         );
         Ok(config)
@@ -173,6 +176,10 @@ fn default_worker_max_document_bytes() -> u64 {
     200 * 1024 * 1024
 }
 
+fn default_upload_body_limit_bytes() -> u64 {
+    128 * 1024 * 1024
+}
+
 fn default_webauthn_rp_name() -> String {
     "Papercrate".to_string()
 }
diff --git a/backend/src/routes/mod.rs b/backend/src/routes/mod.rs
index e13bab0..47b76df 100644
--- a/backend/src/routes/mod.rs
+++ b/backend/src/routes/mod.rs
@@ -175,6 +175,8 @@ pub fn create_router(state: AppState) -> Router<()> {
         }),
     );
 
+    let upload_limit = state.config.upload_body_limit_bytes;
+
     Router::new()
         .merge(download_routes)
         .merge(protected_routes)
@@ -183,7 +185,9 @@ pub fn create_router(state: AppState) -> Router<()> {
         .route("/api/health", get(health::health_check))
         .with_state(state)
         .layer(cors)
-        .layer(DefaultBodyLimit::max(128 * 1024 * 1024))
+        .layer(DefaultBodyLimit::max(
+            usize::try_from(upload_limit).unwrap_or(usize::MAX),
+        ))
         .layer(
             TraceLayer::new_for_http()
                 .make_span_with(DefaultMakeSpan::new().level(tracing::Level::INFO))
diff --git a/backend/tests/common/mod.rs b/backend/tests/common/mod.rs
index 1f19efc..4514b7c 100644
--- a/backend/tests/common/mod.rs
+++ b/backend/tests/common/mod.rs
@@ -143,6 +143,7 @@ impl TestApp {
             quickwit_endpoint: None,
             quickwit_index: None,
             worker_max_document_bytes: 200 * 1024 * 1024,
+            upload_body_limit_bytes: 128 * 1024 * 1024,
             webauthn_rp_id: Some("localhost".to_string()),
             webauthn_origin: Some("http://localhost".to_string()),
             webauthn_rp_name: "Papercrate".to_string(),