Add body size limit tests for >1MB payloads on generate endpoints #446

Open

pook wants to merge 50 commits from fix/body-limit-1mb-test into main

pook commented

2026-04-10 16:07:43 -04:00

Owner

Summary

The global bodyLimit middleware (100KB, in packages/api/src/index.ts:34-45) already rejects payloads exceeding 1MB with 413
Added explicit >1MB payload tests for all three /generate/* routes: privacy-policy, terms-of-service, and data-processing-agreement
Kept the stricter 100KB limit rather than relaxing to 1MB — the task's intent (prevent multi-GB payloads) is already satisfied

Test plan

Run bun test packages/api/tests/e2e/body-limit.test.ts with the API server running
Verify all 7 body-limit tests pass (4 existing + 3 new)
Confirm normal-sized requests still work

🤖 Generated with Claude Code

## Summary - The global `bodyLimit` middleware (100KB, in `packages/api/src/index.ts:34-45`) already rejects payloads exceeding 1MB with 413 - Added explicit >1MB payload tests for all three `/generate/*` routes: privacy-policy, terms-of-service, and data-processing-agreement - Kept the stricter 100KB limit rather than relaxing to 1MB — the task's intent (prevent multi-GB payloads) is already satisfied ## Test plan - [ ] Run `bun test packages/api/tests/e2e/body-limit.test.ts` with the API server running - [ ] Verify all 7 body-limit tests pass (4 existing + 3 new) - [ ] Confirm normal-sized requests still work 🤖 Generated with [Claude Code](https://claude.com/claude-code)

pook added 1 commit

2026-04-10 16:07:43 -04:00

Add >1MB payload tests for all generate endpoints

CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run

Details

3bbb9ca5e2

The global bodyLimit middleware (100KB) already rejects payloads exceeding
1MB. These tests explicitly verify 413 responses for >1MB payloads on
each /generate/* route: privacy-policy, terms-of-service, and
data-processing-agreement.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agent-bot added 1 commit

2026-04-10 16:07:52 -04:00

feat: issue #443 the-apigenerate-endpoints-accept-request (agent task liancebot443)

CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Has been cancelled

Details

380e59748c

pook referenced this pull request

2026-04-10 16:54:37 -04:00

Review PRs #447, #446, #445 — input sanitization and OpenAI error handling #454

pook commented

2026-04-10 17:18:38 -04:00

Author

Owner

Code Review — PR #446: Body size limit tests for >1MB payloads

Typecheck: PASS (npx tsc --noEmit)

Code Review Findings

Coverage of all three generate endpoints:

/generate/privacy-policy — tested
/generate/terms-of-service — tested
/generate/data-processing-agreement — tested

Boundary conditions:

All three tests use 1024 * 1024 + 1 (1MB + 1 byte) — this is slightly over 1MB
Missing: exactly-1MB boundary test — no test for a payload of exactly 1,048,576 bytes to verify behavior at the boundary
Missing: way over test — no test for e.g. 10MB payloads. While the existing limit is 100KB (so 1MB+ is already way over the actual limit), a very large payload test would verify no OOM or hang behavior.
Existing tests already cover the 100KB boundary (just over, just under)

Implementation note: The PR description correctly identifies that the actual bodyLimit middleware is set to 100KB, not 1MB. The 1MB tests pass because 100KB < 1MB — any payload over 100KB is already rejected. The tests are valid but the title is slightly misleading since 100KB is the real limit.

Code quality: Tests follow existing patterns, proper type assertions on response body. No issues.

Issues

Medium: Missing exact-boundary test at the real 100KB limit
Low: All three endpoint tests are copy-pasted with only the URL changed. Consider a describe.each or loop to reduce duplication.
Low: bun.lock changes are unrelated dependency resolution noise — should ideally be in a separate commit

Verdict: Approve — tests are valid and add meaningful coverage

Reviewed by Claude Code

## Code Review — PR #446: Body size limit tests for >1MB payloads ### Typecheck: PASS (npx tsc --noEmit) ### Code Review Findings **Coverage of all three generate endpoints**: - `/generate/privacy-policy` — tested - `/generate/terms-of-service` — tested - `/generate/data-processing-agreement` — tested **Boundary conditions**: - All three tests use `1024 * 1024 + 1` (1MB + 1 byte) — this is slightly over 1MB - **Missing: exactly-1MB boundary test** — no test for a payload of exactly 1,048,576 bytes to verify behavior at the boundary - **Missing: way over test** — no test for e.g. 10MB payloads. While the existing limit is 100KB (so 1MB+ is already way over the actual limit), a very large payload test would verify no OOM or hang behavior. - Existing tests already cover the 100KB boundary (just over, just under) **Implementation note**: The PR description correctly identifies that the actual `bodyLimit` middleware is set to 100KB, not 1MB. The 1MB tests pass because 100KB < 1MB — any payload over 100KB is already rejected. The tests are valid but the title is slightly misleading since 100KB is the real limit. **Code quality**: Tests follow existing patterns, proper type assertions on response body. No issues. ### Issues 1. **Medium**: Missing exact-boundary test at the real 100KB limit 2. **Low**: All three endpoint tests are copy-pasted with only the URL changed. Consider a `describe.each` or loop to reduce duplication. 3. **Low**: `bun.lock` changes are unrelated dependency resolution noise — should ideally be in a separate commit ### Verdict: Approve — tests are valid and add meaningful coverage Reviewed by Claude Code

pook referenced this pull request

2026-04-10 17:18:46 -04:00

[Agent] Issue #442: all apigenerate endpoints call the opena #445

pook referenced this pull request

2026-04-10 17:18:55 -04:00

[Agent] Issue #454: review three prs addressing input valida #458