Add NEXT_API_BODY_SIZE_LIMIT config (#325)

* Add `NEXT_API_BODY_SIZE_LIMIT` config

* Add NEXT_API_BODY_SIZE_LIMIT env var to more files

.env.example

@@ -37,6 +37,9 @@ NEXT_PUBLIC_STORAGE_DOMAIN=
 NEXT_PUBLIC_ALLOW_CREDENTIALS=
 NEXT_PUBLIC_DISABLE_SIGN_UP=
 
+# API configuration (optional)
+NEXT_API_BODY_SIZE_LIMIT= # e.g. 50mb (defaults to 1mb)
+
 # Integration providers (optional)
 TRELLO_APP_API_KEY=
 TRELLO_APP_SECRET=

README.md

@@ -150,6 +150,7 @@ pnpm dev
 | `SMTP_REJECT_UNAUTHORIZED`                | Reject invalid certificates (defaults to true if not set) | For Email                             | `false`                                                     |
 | `NEXT_PUBLIC_DISABLE_EMAIL`               | To disable all email features                             | For Email                             | `true`                                                      |
 | `NEXT_PUBLIC_BASE_URL`                    | Base URL of your installation                             | Yes                                   | `http://localhost:3000`                                     |
+| `NEXT_API_BODY_SIZE_LIMIT`                | Maximum API request body size (defaults to 1mb)           | No                                    | `50mb`                                                      |
 | `BETTER_AUTH_ALLOWED_DOMAINS`             | Comma-separated list of allowed domains for OIDC logins   | For OIDC/Social login                 | `example.com,subsidiary.com`                                |
 | `BETTER_AUTH_SECRET`                      | Auth encryption secret                                    | Yes                                   | Random 32+ char string                                      |
 | `BETTER_AUTH_TRUSTED_ORIGINS`             | Allowed callback origins                                  | No                                    | `http://localhost:3000,http://localhost:3001`               |

apps/web/next.config.js

@@ -95,6 +95,12 @@ const config = {
     swcPlugins: [["@lingui/swc-plugin", {}]],
   },
 
+  api: {
+    bodyParser: {
+      sizeLimit: env("NEXT_API_BODY_SIZE_LIMIT") || '1mb',
+    },
+  },
+
   async rewrites() {
     return [
       {

cloud/docker-compose.yml

@@ -56,10 +56,13 @@ services:
       - NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME=${NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME}
       - NEXT_PUBLIC_STORAGE_DOMAIN=${NEXT_PUBLIC_STORAGE_DOMAIN}
 
-      # Auth config
+      # Auth config (optional)
       - NEXT_PUBLIC_ALLOW_CREDENTIALS=${NEXT_PUBLIC_ALLOW_CREDENTIALS}
       - NEXT_PUBLIC_DISABLE_SIGN_UP=${NEXT_PUBLIC_DISABLE_SIGN_UP}
 
+      # API configuration (optional)
+      - NEXT_API_BODY_SIZE_LIMIT=${NEXT_API_BODY_SIZE_LIMIT}
+
       # Integration providers
       - TRELLO_APP_API_KEY=${TRELLO_APP_API_KEY}
       - TRELLO_APP_SECRET=${TRELLO_APP_SECRET}

docker-compose.yml

@@ -50,6 +50,9 @@ services:
       - NEXT_PUBLIC_ALLOW_CREDENTIALS=${NEXT_PUBLIC_ALLOW_CREDENTIALS}
       - NEXT_PUBLIC_DISABLE_SIGN_UP=${NEXT_PUBLIC_DISABLE_SIGN_UP}
 
+      # API configuration (optional)
+      - NEXT_API_BODY_SIZE_LIMIT=${NEXT_API_BODY_SIZE_LIMIT}
+
       # Integration providers (optional)
       - TRELLO_APP_API_KEY=${TRELLO_APP_API_KEY}
       - TRELLO_APP_SECRET=${TRELLO_APP_SECRET}

turbo.json

@@ -114,6 +114,7 @@
     "NEXT_PUBLIC_AVATAR_BUCKET_NAME",
     "NEXT_PUBLIC_ATTACHMENTS_BUCKET_NAME",
     "NEXT_PUBLIC_ALLOW_CREDENTIALS",
+    "NEXT_API_BODY_SIZE_LIMIT",
     "NEXT_PUBLIC_DISABLE_SIGN_UP",
     "NEXT_PUBLIC_USE_STANDALONE_OUTPUT",
     "S3_REGION",