fix: cap request body size at 1 MiB

[VaibhavAcharya]

- Summary

Handlers read r.Body with no upper bound, so a multi-gigabyte body would buffer in memory. This adds a limitBodySize middleware that wraps every body in http.MaxBytesReader with a 1 MiB cap, applied right after chi/middleware.RealIP so every route inherits the limit. We use MaxBytesReader rather than io.LimitReader because the former returns a clean error when the cap is hit, while the latter silently truncates and would corrupt JSON mid-parse.

- Test plan

- Description for the changelog

Cap incoming request bodies at 1 MiB.

- A picture of a cute animal (not mandatory but encouraged)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: da19c3a7-0493-4ce6-9a31-6cedc577ee2d

📥 Commits

Reviewing files that changed from the base of the PR and between 96d37f3 and a22f361.

📒 Files selected for processing (1)

• api/middleware.go

🚧 Files skipped from review as they are similar to previous changes (1)

• api/middleware.go

---

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes

  • Enforce a 1 MiB request body size cap so oversized requests fail early instead of being fully buffered.
  • Safely handle empty or nil request bodies without causing failures.

• Tests

  • Added tests covering under, at, and over size-limit behavior and ensuring nil/empty bodies are handled safely.

Walkthrough

This PR adds request body size limiting to the API via middleware. A new limitBodySize middleware function enforces a 1 MiB default limit by wrapping the request body with http.MaxBytesReader, causing parsing to fail when the limit is exceeded rather than buffering the entire body in memory. The middleware is integrated into the router during API initialization. Two test cases validate correct behavior across body sizes (under, at, and over limit) and confirm safe handling of nil request bodies.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• aitchiss

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'fix: cap request body size at 1 MiB' directly and clearly summarizes the main change: adding a middleware to limit request body size to 1 MiB.
Description check	✅ Passed	The description clearly explains the problem (unbounded request body buffering), the solution (limitBodySize middleware with http.MaxBytesReader), and the rationale for design choices.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch vaibhavacharya/ex-1874-identity-no-request-body-size-limit-gotrue

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}