diff --git a/backend/src/index.ts b/backend/src/index.ts index 10d01c237c..75fa0f0efa 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -24,6 +24,10 @@ const runtime = loadRuntimeConfig(); const PORT = runtime.port; const isProduction = process.env.NODE_ENV === "production"; +// Ceiling for JSON request bodies. Chat and tabular routes may post document +// text inline; file uploads use multer and are not governed by this parser. +const JSON_BODY_LIMIT = "50mb"; + function envInt(name: string, fallback: number): number { const raw = process.env[name]; if (!raw) return fallback; @@ -90,10 +94,6 @@ const dataDeleteLimiter = makeLimiter({ message: "Too many data deletion requests. Please try again later.", }); -function jsonLimitForPath(path: string): string { - return "50mb"; -} - app.disable("x-powered-by"); app.set("trust proxy", envInt("TRUST_PROXY_HOPS", 1)); @@ -144,9 +144,7 @@ app.delete("/user/chats", dataDeleteLimiter); app.delete("/user/projects", dataDeleteLimiter); app.delete("/user/tabular-reviews", dataDeleteLimiter); -app.use((req, res, next) => - express.json({ limit: jsonLimitForPath(req.path) })(req, res, next), -); +app.use(express.json({ limit: JSON_BODY_LIMIT })); app.use("/chat", chatRouter); app.use("/projects", projectsRouter); diff --git a/docs/upstream-mike-escalation-state.json b/docs/upstream-mike-escalation-state.json index 9e356a2435..e6fbd454aa 100644 --- a/docs/upstream-mike-escalation-state.json +++ b/docs/upstream-mike-escalation-state.json @@ -247,6 +247,42 @@ "risk": "defer", "reason": "Safely adaptable, but high risk because it changes production build validation for Supabase configuration and deployment behavior. The ROSS adaptation reuses its existing production flag and retains all ROSS-specific safeguards. Generated patch was malformed or did not apply cleanly to current ROSS main; no code was applied.", "processed_at": "2026-07-31T17:04:17.826412Z" + }, + { + "number": 242, + "risk": "defer", + "reason": "High-risk SSRF/OAuth security-boundary change. ROSS has divergent MCP egress code and lacks the supplied Vitest harness, so the complete adaptation cannot be validated safely.", + "processed_at": "2026-08-04T21:16:33.885666Z" + }, + { + "number": 273, + "risk": "medium", + "reason": "Bounded backend cleanup: replaces a path-insensitive wrapper with one equivalent static JSON parser while preserving ROSS\u2019s 50 MB limit.", + "processed_at": "2026-08-04T21:16:33.885666Z" + }, + { + "number": 253, + "risk": "defer", + "reason": "ROSS lacks the upstream backend Vitest/coverage harness, and several Mike-specific assertions require speculative adaptation.", + "processed_at": "2026-08-04T21:16:33.885666Z" + }, + { + "number": 255, + "risk": "defer", + "reason": "Depends on an absent frontend test harness and includes prohibited workflow changes; a reliable partial adaptation is unclear.", + "processed_at": "2026-08-04T21:16:33.885666Z" + }, + { + "number": 279, + "risk": "defer", + "reason": "High-risk schema migration, cryptographic signing-key, export, and production-data-boundary change with too broad a blast radius for this batch.", + "processed_at": "2026-08-04T21:16:33.885666Z" + }, + { + "number": 280, + "risk": "defer", + "reason": "The cross-stack UI/API feature is not adequately testable because ROSS lacks the supplied frontend test harness.", + "processed_at": "2026-08-04T21:16:33.885666Z" } ] } diff --git a/reports/release-manifest-v1.json b/reports/release-manifest-v1.json index dd32af8392..94e680b17e 100644 --- a/reports/release-manifest-v1.json +++ b/reports/release-manifest-v1.json @@ -87,8 +87,8 @@ }, { "path": "backend/src/index.ts", - "sha256": "0b031efbfb400166c4e2864713fc8b80803feb5e0d96cc7ddfb7ee0968a1e7d7", - "sizeBytes": 5791 + "sha256": "d613269b4effee8ecc0797db562a90dacbecf1b43a2a8d9af9c8cf66b5237b82", + "sizeBytes": 5858 }, { "path": "backend/src/lib/documentScanDispatcher.ts",