From f215c6fd47d7881f5e367ddbc6ab218e8019c837 Mon Sep 17 00:00:00 2001 From: "Liam Verdejo (ES)" Date: Tue, 20 Oct 2026 13:06:10 +0200 Subject: [PATCH] Fix: Error Payload Largue --- .env.example | 5 +++++ .github/copilot-instructions.md | 5 +++++ CLAUDE.md | 6 ++++++ README.md | 5 +++++ 4 files changed, 21 insertions(+) diff --git a/.env.example b/.env.example index f9a0545..3743baa 100644 --- a/.env.example +++ b/.env.example @@ -4,6 +4,11 @@ GITDB_ENCRYPTION_KEY=replace-with-a-long-random-secret ORIGIN=http://localhost:3000 +# Maximum request body size accepted by the production server (adapter-node, default 512K). +# CI scanners POST full reports to /api/code-report/scan; large reports need a higher limit. +# Accepts K, M or G suffixes. Not enforced by `bun run dev`. +BODY_SIZE_LIMIT=1M + # Optional GitDB configuration GITDB_BRANCH=main GITDB_DATA_PATH=./data/gitdb diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md index fad4150..4c79b68 100644 --- a/.github/copilot-instructions.md +++ b/.github/copilot-instructions.md @@ -64,6 +64,11 @@ en produccion, asegurar que las credenciales SSH esten disponibles via `SSH_AUTH La variable `ORIGIN` fija el origen de la aplicacion (ej: `http://localhost:3000`) para que el CSRF Origin check de SvelteKit no dependa del header Host, previniendo bypass en proxys. +`BODY_SIZE_LIMIT` (adapter-node, default `512K`, acepta sufijos `K`/`M`/`G`) limita el tamaño de +cuerpos de solicitud en el servidor compilado (`node build`); solicitudes mas grandes fallan con +`413 Payload Too Large`. `/api/code-report/scan` recibe reportes completos de scanners de CI, por +lo que en produccion se debe aumentar (ej: `1M` o mas). `bun run dev` no lo enforce. + ## RBAC y seguridad Los permisos usan `section:action` con scope global, de organizacion o de proyecto. Usar siempre diff --git a/CLAUDE.md b/CLAUDE.md index 3df4eef..7f5f3b5 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -97,6 +97,12 @@ Bitbucket, and GitLab; in production, ensure SSH authentication credentials are SvelteKit's CSRF Origin check depends on this value instead of deriving it from the incoming Host header, preventing bypasses when running behind a proxy that rewrites Host headers. +`BODY_SIZE_LIMIT` (adapter-node, default `512K`, accepts `K`/`M`/`G`) caps request bodies in the +built server (`node build`); larger requests fail with `{"message":"Payload Too Large"}` (413). +`/api/code-report/scan` receives full scanner reports from CI, so deployments should raise it +(e.g. `1M` or more). `bun run dev` does not enforce it. If a reverse proxy sits in front of +GitOps, raise its body size limit as well (e.g. nginx `client_max_body_size`). + ## Authorization Permission grants are always scope-prefixed and match the catalog in `src/lib/config/permissions.ts` diff --git a/README.md b/README.md index 08e90c1..5ee44d7 100644 --- a/README.md +++ b/README.md @@ -41,6 +41,11 @@ docker compose up --build The container is available at `http://localhost:3000` and stores persistent data in `./data`. +The production server rejects request bodies larger than `BODY_SIZE_LIMIT` (default `512K`) with +`413 Payload Too Large`. CI scanners send full reports to `/api/code-report/scan`, so raise it +(for example `BODY_SIZE_LIMIT=1M` or higher) if scans fail with that error. If a reverse proxy sits +in front of GitOps, raise its body size limit as well (e.g. nginx `client_max_body_size`). + ## Development ```bash