upload limit

backend/src/config.rs

@@ -56,6 +56,8 @@ pub struct AppConfig {
     pub quickwit_index: Option<String>,
     #[serde(default = "default_worker_max_document_bytes")]
     pub worker_max_document_bytes: u64,
+    #[serde(default = "default_upload_body_limit_bytes")]
+    pub upload_body_limit_bytes: u64,
     #[serde(default)]
     pub webauthn_rp_id: Option<String>,
     #[serde(default)]
@@ -76,6 +78,7 @@ impl AppConfig {
             passkeys_enabled = config.webauthn_origin.is_some(),
             s3_bucket = %config.s3_bucket,
             worker_max_document_bytes = config.worker_max_document_bytes,
+            upload_body_limit_bytes = config.upload_body_limit_bytes,
             "loaded backend configuration"
         );
         Ok(config)
@@ -173,6 +176,10 @@ fn default_worker_max_document_bytes() -> u64 {
     200 * 1024 * 1024
 }
 
+fn default_upload_body_limit_bytes() -> u64 {
+    128 * 1024 * 1024
+}
+
 fn default_webauthn_rp_name() -> String {
     "Papercrate".to_string()
 }

backend/src/routes/mod.rs

@@ -175,6 +175,8 @@ pub fn create_router(state: AppState) -> Router<()> {
         }),
     );
 
+    let upload_limit = state.config.upload_body_limit_bytes;
+
     Router::new()
         .merge(download_routes)
         .merge(protected_routes)
@@ -183,7 +185,9 @@ pub fn create_router(state: AppState) -> Router<()> {
         .route("/api/health", get(health::health_check))
         .with_state(state)
         .layer(cors)
-        .layer(DefaultBodyLimit::max(128 * 1024 * 1024))
+        .layer(DefaultBodyLimit::max(
+            usize::try_from(upload_limit).unwrap_or(usize::MAX),
+        ))
         .layer(
             TraceLayer::new_for_http()
                 .make_span_with(DefaultMakeSpan::new().level(tracing::Level::INFO))

backend/tests/common/mod.rs

@@ -143,6 +143,7 @@ impl TestApp {
             quickwit_endpoint: None,
             quickwit_index: None,
             worker_max_document_bytes: 200 * 1024 * 1024,
+            upload_body_limit_bytes: 128 * 1024 * 1024,
             webauthn_rp_id: Some("localhost".to_string()),
             webauthn_origin: Some("http://localhost".to_string()),
             webauthn_rp_name: "Papercrate".to_string(),