sneak 345a002cc2 feat: cap form POST body size and return 413 (closes #92) ...

Add a LimitBody middleware that caps the request body at MaxFormBytes
(1 MiB) on POST / and POST /generate and rejects an oversized body with
413. It parses the form under the cap before the CSRF middleware, which
reads its token from the body with PostFormValue and would otherwise see a
truncated body as a missing token (403); a successful parse is cached, so
the CSRF check and handler reuse it. Wired ahead of CSRF in SetupRoutes.

This makes the limit explicit rather than resting on ParseForm's incidental
10 MB cap, which would silently vanish if a handler switched to io.ReadAll
or multipart.

Model: opus-4-8

2026-09-21 18:22:22 +00:00

..

http_internal_test.go

test: assert http.Server carries ReadHeaderTimeout and IdleTimeout

2026-09-21 18:22:22 +00:00

http.go

feat: set ReadHeaderTimeout and IdleTimeout on the http.Server

2026-09-21 18:22:22 +00:00

routes.go

feat: cap form POST body size and return 413 (closes #92)

2026-09-21 18:22:22 +00:00

server.go

next -> main (1.0.0 milestone) (#105)

2026-09-21 09:31:54 +02:00