feat(settings): add request body limit setting (#1968)

Integrated into release/v3.7.9

src/shared/constants/bodySize.ts

@@ -0,0 +1,39 @@
+export const REQUEST_BODY_BYTES_PER_MB = 1024 * 1024;
+export const DEFAULT_REQUEST_BODY_LIMIT_MB = 10;
+export const MIN_REQUEST_BODY_LIMIT_MB = 1;
+export const MAX_REQUEST_BODY_LIMIT_MB = 500;
+export const DEFAULT_REQUEST_BODY_LIMIT_BYTES =
+  DEFAULT_REQUEST_BODY_LIMIT_MB * REQUEST_BODY_BYTES_PER_MB;
+
+export function normalizeRequestBodyLimitMb(value: unknown): number | null {
+  const parsed =
+    typeof value === "number" ? value : typeof value === "string" ? Number(value) : NaN;
+  if (!Number.isFinite(parsed)) return null;
+
+  const normalized = Math.floor(parsed);
+  if (normalized < MIN_REQUEST_BODY_LIMIT_MB || normalized > MAX_REQUEST_BODY_LIMIT_MB) {
+    return null;
+  }
+
+  return normalized;
+}
+
+export function requestBodyLimitMbToBytes(value: number): number {
+  return value * REQUEST_BODY_BYTES_PER_MB;
+}
+
+export function parseRequestBodyLimitBytes(value: string | undefined): number {
+  if (!value) return DEFAULT_REQUEST_BODY_LIMIT_BYTES;
+
+  const parsed = parseInt(value, 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : DEFAULT_REQUEST_BODY_LIMIT_BYTES;
+}
+
+export function requestBodyLimitBytesToMb(value: number): number {
+  const configuredMb = Math.round(value / REQUEST_BODY_BYTES_PER_MB);
+  return Math.min(MAX_REQUEST_BODY_LIMIT_MB, Math.max(MIN_REQUEST_BODY_LIMIT_MB, configuredMb));
+}
+
+export function requestBodyLimitMbFromEnv(value: string | undefined): number {
+  return requestBodyLimitBytesToMb(parseRequestBodyLimitBytes(value));
+}

src/shared/middleware/bodySizeGuard.ts

@@ -13,8 +13,12 @@
  * @module shared/middleware/bodySizeGuard
  */
 
-/** Default maximum body size: 10 MB */
-const DEFAULT_MAX_BODY_BYTES = 10 * 1024 * 1024;
+import {
+  normalizeRequestBodyLimitMb,
+  parseRequestBodyLimitBytes,
+  requestBodyLimitBytesToMb,
+  requestBodyLimitMbToBytes,
+} from "../constants/bodySize";
 
 /** Larger limit for backup/import routes: 100 MB */
 export const MAX_BODY_BYTES_IMPORT = 100 * 1024 * 1024;
@@ -23,10 +27,7 @@ export const MAX_BODY_BYTES_IMPORT = 100 * 1024 * 1024;
 export const MAX_BODY_BYTES_AUDIO = 100 * 1024 * 1024;
 
 /** Configured limit — reads from env or falls back to 10 MB */
-export const MAX_BODY_BYTES = parseInt(
-  process.env.MAX_BODY_SIZE_BYTES || String(DEFAULT_MAX_BODY_BYTES),
-  10
-);
+export const MAX_BODY_BYTES = parseRequestBodyLimitBytes(process.env.MAX_BODY_SIZE_BYTES);
 
 type BodySizeRule = { prefix: string; limit: number };
 
@@ -35,12 +36,22 @@ const ROUTE_LIMITS: BodySizeRule[] = [
   { prefix: "/api/v1/audio/transcriptions", limit: MAX_BODY_BYTES_AUDIO },
 ];
 
+export function getDefaultRequestBodyLimitMb(): number {
+  return requestBodyLimitBytesToMb(MAX_BODY_BYTES);
+}
+
+export function getConfiguredBodySizeLimitBytes(settings?: Record<string, unknown>): number {
+  const configuredMb = normalizeRequestBodyLimitMb(settings?.maxBodySizeMb);
+  return configuredMb === null ? MAX_BODY_BYTES : requestBodyLimitMbToBytes(configuredMb);
+}
+
 /**
  * Resolve the body size limit for a request path.
  */
-export function getBodySizeLimit(pathname: string): number {
+export function getBodySizeLimit(pathname: string, settings?: Record<string, unknown>): number {
+  const configuredLimit = getConfiguredBodySizeLimitBytes(settings);
   const customRule = ROUTE_LIMITS.find((rule) => pathname.startsWith(rule.prefix));
-  return customRule?.limit ?? MAX_BODY_BYTES;
+  return customRule ? Math.max(customRule.limit, configuredLimit) : configuredLimit;
 }
 
 /**

src/shared/validation/schemas.ts

@@ -4,6 +4,7 @@ import {
   ROUTING_STRATEGY_VALUES,
 } from "@/shared/constants/routingStrategies";
 import { SUPPORTED_BATCH_ENDPOINTS } from "@/shared/constants/batchEndpoints";
+import { MAX_REQUEST_BODY_LIMIT_MB, MIN_REQUEST_BODY_LIMIT_MB } from "@/shared/constants/bodySize";
 import { COMBO_CONFIG_MODES } from "@/shared/constants/comboConfigMode";
 import { isLocalProvider } from "@/shared/constants/providers";
 import { HIDEABLE_SIDEBAR_ITEM_IDS } from "@/shared/constants/sidebarVisibility";
@@ -444,6 +445,12 @@ export const updateSettingsSchema = z.object({
   stickyRoundRobinLimit: z.number().int().min(0).max(1000).optional(),
   requestRetry: z.number().int().min(0).max(10).optional(),
   maxRetryIntervalSec: z.number().int().min(0).max(300).optional(),
+  maxBodySizeMb: z
+    .number()
+    .int()
+    .min(MIN_REQUEST_BODY_LIMIT_MB)
+    .max(MAX_REQUEST_BODY_LIMIT_MB)
+    .optional(),
   // Auto intent classifier settings (multilingual routing)
   intentDetectionEnabled: z.boolean().optional(),
   intentSimpleMaxWords: z.number().int().min(1).max(500).optional(),

src/shared/validation/settingsSchemas.ts

@@ -1,4 +1,109 @@
-// ... existing imports ...
+/**
+ * Settings-specific Zod schemas.
+ *
+ * Extracted from schemas.ts to work around the webpack barrel-file
+ * optimization bug that makes large schema barrel exports `undefined`
+ * at runtime (see: https://github.com/vercel/next.js/issues/12557).
+ */
+import { z } from "zod";
+import { COMBO_CONFIG_MODES } from "@/shared/constants/comboConfigMode";
+import { MAX_REQUEST_BODY_LIMIT_MB, MIN_REQUEST_BODY_LIMIT_MB } from "@/shared/constants/bodySize";
+import { HIDEABLE_SIDEBAR_ITEM_IDS } from "@/shared/constants/sidebarVisibility";
+import { ACCOUNT_FALLBACK_STRATEGY_VALUES } from "@/shared/constants/routingStrategies";
+
+const signatureCacheModeValues = ["enabled", "bypass", "bypass-strict"] as const;
+
+export const updateSettingsSchema = z.object({
+  newPassword: z.string().min(1).max(200).optional(),
+  currentPassword: z.string().max(200).optional(),
+  theme: z.string().max(50).optional(),
+  language: z.string().max(10).optional(),
+  requireLogin: z.boolean().optional(),
+  enableSocks5Proxy: z.boolean().optional(),
+  instanceName: z.string().max(100).optional(),
+  customLogoUrl: z.string().max(2000).optional(),
+  customLogoBase64: z.string().max(100000).optional(),
+  customFaviconUrl: z.string().max(2000).optional(),
+  customFaviconBase64: z.string().max(50000).optional(),
+  corsOrigins: z.string().max(500).optional(),
+  cloudUrl: z.string().max(500).optional(),
+  baseUrl: z.string().max(500).optional(),
+  setupComplete: z.boolean().optional(),
+  blockedProviders: z.array(z.string().max(100)).optional(),
+  hideHealthCheckLogs: z.boolean().optional(),
+  hideEndpointCloudflaredTunnel: z.boolean().optional(),
+  hideEndpointTailscaleFunnel: z.boolean().optional(),
+  hideEndpointNgrokTunnel: z.boolean().optional(),
+  debugMode: z.boolean().optional(),
+  hiddenSidebarItems: z.array(z.enum(HIDEABLE_SIDEBAR_ITEM_IDS)).optional(),
+  comboConfigMode: z.enum(COMBO_CONFIG_MODES).optional(),
+  // Routing settings (#134)
+  fallbackStrategy: z.enum(ACCOUNT_FALLBACK_STRATEGY_VALUES).optional(),
+  wildcardAliases: z.array(z.object({ pattern: z.string(), target: z.string() })).optional(),
+  stickyRoundRobinLimit: z.number().int().min(0).max(1000).optional(),
+  requestRetry: z.number().int().min(0).max(10).optional(),
+  maxRetryIntervalSec: z.number().int().min(0).max(300).optional(),
+  maxBodySizeMb: z
+    .number()
+    .int()
+    .min(MIN_REQUEST_BODY_LIMIT_MB)
+    .max(MAX_REQUEST_BODY_LIMIT_MB)
+    .optional(),
+  // Auto intent classifier settings (multilingual routing)
+  intentDetectionEnabled: z.boolean().optional(),
+  intentSimpleMaxWords: z.number().int().min(1).max(500).optional(),
+  intentExtraCodeKeywords: z.array(z.string().max(100)).optional(),
+  intentExtraReasoningKeywords: z.array(z.string().max(100)).optional(),
+  intentExtraSimpleKeywords: z.array(z.string().max(100)).optional(),
+  // Protocol toggles (default: disabled)
+  mcpEnabled: z.boolean().optional(),
+  mcpTransport: z.enum(["stdio", "sse", "streamable-http"]).optional(),
+  a2aEnabled: z.boolean().optional(),
+  wsAuth: z.boolean().optional(),
+  // CLI Fingerprint compatibility (per-provider)
+  cliCompatProviders: z.array(z.string().max(100)).optional(),
+  // Strip provider/model prefix at proxy layer (e.g. "openai/gpt-4" → "gpt-4")
+  stripModelPrefix: z.boolean().optional(),
+  // Cache control preservation mode
+  alwaysPreserveClientCache: z.enum(["auto", "always", "never"]).optional(),
+  antigravitySignatureCacheMode: z.enum(signatureCacheModeValues).optional(),
+  // Adaptive Volume Routing
+  adaptiveVolumeRouting: z.boolean().optional(),
+  // Usage token buffer — safety margin added to reported prompt/input token counts.
+  // Prevents CLI tools from overrunning context windows. Set to 0 to disable.
+  usageTokenBuffer: z.number().int().min(0).max(50000).optional(),
+  // Custom CLI agent definitions for ACP
+  customAgents: z
+    .array(
+      z.object({
+        id: z.string().max(50),
+        name: z.string().max(100),
+        binary: z.string().max(200),
+        versionCommand: z.string().max(300),
+        providerAlias: z.string().max(50),
+        spawnArgs: z.array(z.string().max(200)),
+        protocol: z.enum(["stdio", "http"]),
+      })
+    )
+    .optional(),
+  // SkillsMP marketplace API key
+  skillsmpApiKey: z.string().max(200).optional(),
+  // Active skills provider (single source of truth for skills page)
+  skillsProvider: z.enum(["skillsmp", "skillssh"]).optional(),
+  // models.dev sync settings
+  modelsDevSyncEnabled: z.boolean().optional(),
+  modelsDevSyncInterval: z.number().int().min(3600000).max(604800000).optional(),
+  // Vision Bridge settings
+  visionBridgeEnabled: z.boolean().optional(),
+  visionBridgeModel: z.string().max(200).optional(),
+  visionBridgePrompt: z.string().max(5000).optional(),
+  visionBridgeTimeout: z.number().int().min(1000).max(300000).optional(),
+  visionBridgeMaxImages: z.number().int().min(1).max(20).optional(),
+  // Missing settings
+  lkgpEnabled: z.boolean().optional(),
+  backgroundDegradation: z.unknown().optional(),
+  bruteForceProtection: z.boolean().optional(),
+});
 
 export const databaseSettingsSchema = z.object(
   {
@@ -69,5 +174,3 @@ export const databaseSettingsSchema = z.object(
 );
 
 export type DatabaseSettingsSchema = z.infer<typeof databaseSettingsSchema>;
-
-// ... rest of the file ...