fix(v2): clamp explicit body caps to the proxy ceiling too

The previous commit clamped the default JSON body cap but left explicit
per-route overrides alone, so a route declaring a larger `maxBodyBytes`
still fell into the truncation it was meant to report: the four inline
workspace-file routes at 70 MB and the deployed-chat route at 220 MB.

Next attaches `proxyClientMaxBodySize` to every request and clones the
body unconditionally for any non-GET method on a matched path, pushing
EOF at ten mebibytes with only a warning, so the handler reads a
truncated prefix. Those routes therefore already fail above that size —
as a malformed-JSON 400. Clamping the effective limit inside the two
body readers makes the same request fail as payload-too-large, quoting
the limit actually in force.

One existing test asserted the unreachable case, allowing a sixty-mebibyte
base64 body; it now asserts what the proxy will forward intact.

The inline-file path still advertises fifty mebibytes and cannot exceed
the proxy ceiling until that ceiling is raised, which changes buffering
for every route and belongs in its own change.

Author: waleedlatif1

apps/sim/app/api/workspaces/[id]/files/[fileId]/content/route.test.ts

@@ -135,18 +135,23 @@ describe('PUT /api/workspaces/[id]/files/[fileId]/content', () => {
     })
   })
 
-  it('allows JSON bodies above the default 50 MiB cap for base64 expansion', async () => {
+  it('allows a base64 JSON body up to what the proxy forwards intact', async () => {
     const response = await PUT(
-      createRequest({ content: 'TQ==', encoding: 'base64' }, 60 * 1024 * 1024),
+      createRequest({ content: 'TQ==', encoding: 'base64' }, 10 * 1024 * 1024),
       routeContext
     )
 
     expect(response.status).toBe(200)
     expect(mocks.updateContent).toHaveBeenCalled()
   })
 
-  it('rejects a JSON body above the inline-content cap after admission', async () => {
-    const response = await PUT(createRequest({ content: '' }, 70 * 1024 * 1024 + 1), routeContext)
+  /**
+   * The route declares a 70 MB inline cap, but Next's proxy truncates a client
+   * body past 10 MiB, so the parser clamps to that ceiling and answers 413
+   * rather than letting a truncated prefix surface as malformed JSON.
+   */
+  it('rejects a JSON body above the proxy ceiling after admission', async () => {
+    const response = await PUT(createRequest({ content: '' }, 10 * 1024 * 1024 + 1), routeContext)
 
     expect(response.status).toBe(413)
     expect(mocks.admit).toHaveBeenCalled()

apps/sim/lib/api/server/validation.test.ts

@@ -3,14 +3,24 @@
  */
 import { NextRequest } from 'next/server'
 import { describe, expect, it } from 'vitest'
-import { DEFAULT_MAX_JSON_BODY_BYTES, parseJsonBody } from '@/lib/api/server/validation'
+import {
+  DEFAULT_MAX_JSON_BODY_BYTES,
+  parseJsonBody,
+  parseOptionalJsonBody,
+} from '@/lib/api/server/validation'
 
 /**
  * Next.js truncates a proxied client body past `experimental.proxyClientMaxBodySize`
  * without signalling it, so this is the largest body a handler can actually receive.
  */
 const PROXY_CLIENT_MAX_BODY_BYTES = 10 * 1024 * 1024
 
+/** Mirrors `MAX_WORKSPACE_FILE_INLINE_BODY_BYTES` — an explicit override above the ceiling. */
+const INLINE_FILE_BODY_BYTES = 70 * 1024 * 1024
+
+/** Mirrors the knowledge-search override — below the ceiling, so the clamp must not touch it. */
+const BELOW_CEILING_BODY_BYTES = 2 * 1024 * 1024
+
 /**
  * Declares `content-length` independently of the bytes actually attached, which is
  * how the guard sees an oversized request without buffering one in the test.
@@ -60,6 +70,65 @@ describe('parseJsonBody default size boundary', () => {
     expect(result.response.status).toBe(413)
   })
 
+  it('rejects an explicit over-ceiling override the same way, quoting the enforced limit', async () => {
+    const result = await parseJsonBody(
+      requestDeclaring(PROXY_CLIENT_MAX_BODY_BYTES + 1, JSON.stringify({ value: 'ok' })),
+      'response',
+      INLINE_FILE_BODY_BYTES
+    )
+
+    expect(result.success).toBe(false)
+    if (result.success) return
+    expect(result.reason).toBe('too_large')
+    expect(result.response.status).toBe(413)
+    await expect(result.response.json()).resolves.toEqual({
+      error: `Request body exceeds the maximum allowed size of ${PROXY_CLIENT_MAX_BODY_BYTES} bytes`,
+    })
+  })
+
+  it('still accepts a body at the ceiling under an over-ceiling override', async () => {
+    const result = await parseJsonBody(
+      requestDeclaring(PROXY_CLIENT_MAX_BODY_BYTES, JSON.stringify({ value: 'ok' })),
+      'response',
+      INLINE_FILE_BODY_BYTES
+    )
+
+    expect(result.success).toBe(true)
+  })
+
+  it('leaves an override below the ceiling exactly as declared', async () => {
+    const atLimit = await parseJsonBody(
+      requestDeclaring(BELOW_CEILING_BODY_BYTES, JSON.stringify({ value: 'ok' })),
+      'response',
+      BELOW_CEILING_BODY_BYTES
+    )
+    expect(atLimit.success).toBe(true)
+
+    const overLimit = await parseJsonBody(
+      requestDeclaring(BELOW_CEILING_BODY_BYTES + 1, JSON.stringify({ value: 'ok' })),
+      'response',
+      BELOW_CEILING_BODY_BYTES
+    )
+    expect(overLimit.success).toBe(false)
+    if (overLimit.success) return
+    expect(overLimit.reason).toBe('too_large')
+    await expect(overLimit.response.json()).resolves.toEqual({
+      error: `Request body exceeds the maximum allowed size of ${BELOW_CEILING_BODY_BYTES} bytes`,
+    })
+  })
+
+  it('applies the same clamp to an optional body', async () => {
+    const result = await parseOptionalJsonBody(
+      requestDeclaring(PROXY_CLIENT_MAX_BODY_BYTES + 1, JSON.stringify({ value: 'ok' })),
+      INLINE_FILE_BODY_BYTES
+    )
+
+    expect(result.success).toBe(false)
+    if (result.success) return
+    expect(result.reason).toBe('too_large')
+    expect(result.response.status).toBe(413)
+  })
+
   it('still reports a genuinely malformed body as malformed', async () => {
     const result = await parseJsonBody(requestDeclaring(7, '{"a":  '))
 

apps/sim/lib/api/server/validation.ts

@@ -46,6 +46,27 @@ export const DEFAULT_MAX_JSON_BODY_BYTES = Math.min(
   PROXY_CLIENT_MAX_BODY_BYTES
 )
 
+/**
+ * Clamps a per-route body cap to {@link PROXY_CLIENT_MAX_BODY_BYTES}.
+ *
+ * A route that raises `maxBodyBytes` above the proxy ceiling cannot actually
+ * receive a body that large: the proxy truncates the stream, the handler parses
+ * a prefix, and the caller gets `400 "Request body must be valid JSON"` for a
+ * request whose only fault was its size. Clamping at the point of use turns that
+ * into an accurate `413`; nothing that succeeds today changes, because a body
+ * over the ceiling already fails — just less honestly.
+ *
+ * Consequence worth keeping in view: `MAX_WORKSPACE_FILE_INLINE_BODY_BYTES`
+ * (70 MB) exists so a 50 MiB file can be sent inline as base64, and that ceiling
+ * stays unreachable until `experimental.proxyClientMaxBodySize` is raised in
+ * `apps/sim/next.config.ts`. Raising it changes the memory profile of every
+ * `/api` route, so it is a separate decision — this clamp only makes the limit
+ * that is actually in force report itself correctly.
+ */
+function clampToProxyLimit(maxBytes: number): number {
+  return Math.min(maxBytes, PROXY_CLIENT_MAX_BODY_BYTES)
+}
+
 export interface ValidationErrorBody {
   error: string
   details: z.core.$ZodIssue[]
@@ -76,7 +97,8 @@ export interface ParseRequestOptions {
   /**
    * Maximum number of bytes to read for the JSON body before rejecting with a
    * 413. Defaults to {@link DEFAULT_MAX_JSON_BODY_BYTES}. Raise this only for
-   * routes that legitimately accept large JSON payloads (e.g. inline file uploads).
+   * routes that legitimately accept large JSON payloads (e.g. inline file uploads);
+   * a value above what the proxy forwards is clamped — see {@link clampToProxyLimit}.
    */
   maxBodyBytes?: number
   /** Treat an absent or whitespace-only body as `undefined` before contract validation. */
@@ -163,16 +185,17 @@ export async function parseJsonBody(
       response: NextResponse<{ error: string }>
     }
 > {
+  const limit = clampToProxyLimit(maxBytes)
   try {
-    return { success: true, data: await readJsonBodyWithLimit(request, maxBytes) }
+    return { success: true, data: await readJsonBodyWithLimit(request, limit) }
   } catch (error) {
     if (invalidJson === 'throw') throw error
     if (isPayloadSizeLimitError(error)) {
       return {
         success: false,
         reason: 'too_large',
         response: NextResponse.json(
-          { error: `Request body exceeds the maximum allowed size of ${maxBytes} bytes` },
+          { error: `Request body exceeds the maximum allowed size of ${limit} bytes` },
           { status: 413 }
         ),
       }
@@ -203,13 +226,14 @@ export async function parseOptionalJsonBody(
       response: NextResponse<{ error: string }>
     }
 > {
+  const limit = clampToProxyLimit(maxBytes)
   try {
-    assertContentLengthWithinLimit(request.headers, maxBytes, REQUEST_BODY_LABEL)
+    assertContentLengthWithinLimit(request.headers, limit, REQUEST_BODY_LABEL)
 
     const stream = request.body
     const text = stream
       ? new TextDecoder().decode(
-          await readStreamToBufferWithLimit(stream, { maxBytes, label: REQUEST_BODY_LABEL })
+          await readStreamToBufferWithLimit(stream, { maxBytes: limit, label: REQUEST_BODY_LABEL })
         )
       : await request.text()
 
@@ -223,7 +247,7 @@ export async function parseOptionalJsonBody(
         success: false,
         reason: 'too_large',
         response: NextResponse.json(
-          { error: `Request body exceeds the maximum allowed size of ${maxBytes} bytes` },
+          { error: `Request body exceeds the maximum allowed size of ${limit} bytes` },
           { status: 413 }
         ),
       }