increased size limit

backend/src/layer/trigger/api/auth.rs

@@ -29,6 +29,8 @@ use thiserror::Error;
 
 use crate::{interface::persistent_data::model::ApiKey, util::Uuid};
 
+use super::server::MAX_BODY_SIZE;
+
 pub(super) type AuthResult<T> = Result<T, AuthError>;
 
 const AUTH_DOC_URL: &str = "https://github.com/kronos-et-al/MensaApp/blob/main/doc/ApiAuth.md";
@@ -139,8 +141,6 @@ impl IntoResponse for AuthMiddlewareError {
     }
 }
 
-const MAX_BODY_SIZE: u64 = 1 << 30; // to prevent dos attack, may need to be smaller to be effective? (but large images should still be uploadable)
-
 pub(super) async fn auth_middleware(
     content_type: Option<TypedHeader<ContentType>>,
     auth: Option<TypedHeader<Authorization<MensaAuthHeader>>>,

backend/src/layer/trigger/api/server.rs

@@ -20,6 +20,7 @@ use async_graphql::{
 use async_graphql_axum::{GraphQLRequest, GraphQLResponse};
 use axum::{
     error_handling::HandleErrorLayer,
+    extract::DefaultBodyLimit,
     handler::Handler,
     middleware,
     response::{self, IntoResponse},
@@ -78,6 +79,8 @@ impl Display for State {
     }
 }
 
+pub(super) const MAX_BODY_SIZE: u64 = 100 << 20; // 100 MiB
+
 /// Class witch controls the webserver for API requests.
 pub struct ApiServer {
     server_info: ApiServerInfo,
@@ -143,7 +146,12 @@ impl ApiServer {
             )
             .layer(Extension(self.schema.clone()))
             .nest_service(IMAGE_BASE_PATH, ServeDir::new(&self.server_info.image_dir))
-            .layer(rate_limit);
+            .layer(rate_limit)
+            .layer(DefaultBodyLimit::max(
+                MAX_BODY_SIZE
+                    .try_into()
+                    .expect("max body size should fit in usize"),
+            ));
 
         let socket = std::net::SocketAddr::V6(SocketAddrV6::new(
             Ipv6Addr::UNSPECIFIED,