#143 Add request body size limit per route override FIXED

[veloura-dev]

Key Findings

• The app used a single global JSON parser with a fixed 256kb limit.
• There was no reusable route-level body size middleware.
• Route-specific overrides for larger webhook payloads were not possible.
• Oversized payload handling relied on default parser behavior instead of an explicit standardized app-level translation.
• The scoped issue is fixed, but the repository still contains unrelated pre-existing TypeScript/build errors outside this change.

Fix Features

• Added src/middleware/bodyLimit.ts.
• Introduced reusable middleware:
  • createBodyLimitMiddleware(...)
• Added body-limit constants:
  • DEFAULT_BODY_LIMIT = "256kb"
  • WEBHOOK_BODY_LIMIT = "1mb"
• Standardized payload-too-large handling:
  • returns HTTP 413
  • uses the app’s standard error envelope
  • includes correlation ID and request ID
• Updated app middleware wiring in src/index.ts:
  • /api/admin/webhooks gets 1mb
  • all other JSON routes keep 256kb
• Added focused tests in tests/bodyLimit.test.ts covering:
  • default allow path
  • default reject path
  • webhook override allow path
  • webhook override reject path
• Updated README.md with request body size limit documentation.

REPORT

Summary

Implemented a route-aware request body size limit solution for the backend.

This change:

• keeps the default JSON body limit at 256kb
• allows per-route body size overrides through middleware
• applies a 1mb override for webhook-related routes
• returns standardized 413 Payload Too Large responses
• adds test coverage and documentation

Issue Addressed

The codebase previously used:

express.json({ limit: "256kb" })

That prevented route-specific body size overrides and lacked a reusable middleware abstraction for per-route body-size control.

What Was Implemented

1. New middleware

Created:

• src/middleware/bodyLimit.ts

Features:

• createBodyLimitMiddleware(...)
• DEFAULT_BODY_LIMIT = "256kb"
• WEBHOOK_BODY_LIMIT = "1mb"
• translates entity.too.large parser errors into standardized app errors

2. App wiring update

Updated:

• src/index.ts

Changes:

• replaced single global parser usage with reusable middleware
• mounted webhook override before default parser

Applied routing:

• /api/admin/webhooks → 1mb
• all other JSON routes → 256kb

3. Tests added

Created:

• tests/bodyLimit.test.ts

Coverage includes:

• default limit accepts valid payloads
• default limit rejects oversized payloads with 413
• webhook override accepts larger payloads
• webhook override rejects payloads above 1mb

4. Documentation updated

Updated:

• README.md

Added:

• request body size limits section
• default vs override behavior
• 413 response behavior

Validation Performed

Targeted test run

npm test -- --runInBand tests/bodyLimit.test.ts

Result:

• Passed

Build/test/lint attempt

Commands attempted:

npm run build
npm run lint
npm test -- --runInBand

Result:

• full repo validation is currently blocked by pre-existing unrelated TypeScript errors

Examples:

• src/db/indexerRepository.ts
• src/routes/adminWebhooks.ts
• src/services/drizzleWebhookStore.ts
• src/services/marketEventsStream.ts
• src/services/marketResolutionService.ts
• src/workers/indexer.ts

These failures are outside the scope of the body-size fix.

Acceptance Criteria Status

• Per-route config: Done
• 413 returned on exceed: Done
• Tests cover: Done
• Doc updated: Done

Confidence

• Confidence in the scoped fix: 90%+

Files Changed

Modified

• src/index.ts
• README.md

Created

• src/middleware/bodyLimit.ts
• tests/bodyLimit.test.ts

Suggested Commit Message

feat: add per-route body size limit override

CLOSE #143

[drips-wave]

@veloura-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[veloura-dev]

PLEASE REVIEW AND PING ME

[veloura-dev]

@greatest0fallt1me pls review