feat: 1MB body limit on /generate routes with structured 413 errors #359

Open
pook wants to merge 50 commits from feat/generate-1mb-body-limit into main
Owner

Summary

  • Raises body size limit from 100KB to 1MB specifically for /generate/* routes; non-generate routes keep 100KB
  • Adds requestId middleware (crypto.randomUUID()) to all requests
  • 413 errors on generate routes return structured JSON: { error: "Request body exceeds 1MB limit", requestId }
  • Global error handler now includes requestId in all error responses
  • Updated existing body-limit tests to target non-generate routes (which still enforce 100KB)
  • Added integration tests: 500KB payload passes, 1.1MB payload returns 413 with correct structure

Closes #308

Test plan

  • bun test packages/api/tests/e2e/body-limit.test.ts — all 6 tests pass
  • Verify 500KB payload to /generate/privacy-policy does NOT return 413
  • Verify 1.1MB payload to /generate/privacy-policy returns 413 with { error, requestId }
  • Verify 101KB payload to /questionnaire still returns 413

🤖 Generated with Claude Code

## Summary - Raises body size limit from 100KB to **1MB** specifically for `/generate/*` routes; non-generate routes keep 100KB - Adds `requestId` middleware (`crypto.randomUUID()`) to all requests - 413 errors on generate routes return structured JSON: `{ error: "Request body exceeds 1MB limit", requestId }` - Global error handler now includes `requestId` in all error responses - Updated existing body-limit tests to target non-generate routes (which still enforce 100KB) - Added integration tests: 500KB payload passes, 1.1MB payload returns 413 with correct structure Closes #308 ## Test plan - [ ] `bun test packages/api/tests/e2e/body-limit.test.ts` — all 6 tests pass - [ ] Verify 500KB payload to `/generate/privacy-policy` does NOT return 413 - [ ] Verify 1.1MB payload to `/generate/privacy-policy` returns 413 with `{ error, requestId }` - [ ] Verify 101KB payload to `/questionnaire` still returns 413 🤖 Generated with [Claude Code](https://claude.com/claude-code)
feat: raise body limit to 1MB on /generate routes with requestId in 413 errors
Some checks are pending
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run
e4452c262f
Generate routes now accept payloads up to 1MB (was 100KB globally). Non-generate
routes retain the 100KB limit. All requests get a unique requestId via middleware,
included in structured 413 error responses and the global error handler.

Closes #308

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
feat: issue #355 add-expressjson-limit-1mb-applied-to-the (agent task agent-ta)
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
0f1f59f832
Some checks failed
CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled
This pull request has changes conflicting with the target branch.
  • .forgejo/workflows/ci.yml
  • bun.lock
  • package.json
  • packages/api/src/db/schema.ts
  • packages/api/src/index.ts
  • packages/api/src/middleware/rate-limit.ts
  • packages/api/src/middleware/security-headers.ts
  • packages/api/src/routes/generate-tos.ts
  • packages/api/src/routes/generate.ts
  • packages/api/src/routes/health.ts
  • packages/api/src/routes/questionnaire.ts
  • packages/api/src/services/document-generator.ts
  • packages/api/src/services/llm.ts
  • packages/api/src/templates/index.ts
  • packages/api/tsconfig.json
  • packages/shared/src/types.ts
  • packages/web/src/app/questionnaire/page.tsx
  • packages/web/src/components/documents/DocumentList.tsx
  • packages/web/src/components/questionnaire/ReviewStep.tsx
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin feat/generate-1mb-body-limit:feat/generate-1mb-body-limit
git switch feat/generate-1mb-body-limit
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!359
No description provided.