No documented/enforced request body size limit for IPFS pin content uploads

[meshackyaro]

Description

PinContentDto.content (src/ipfs-pinning/ipfs-pinning.dto.ts) is validated with @IsBase64() and @IsNotEmpty() but has no @MaxLength() or any other size cap, and IpfsPinningService.pinContent() (src/ipfs-pinning/ipfs-pinning.service.ts) does Buffer.from(dto.content, 'base64') on whatever is supplied with no explicit size check before attempting to hash and pin it. main.ts (src/main.ts) never configures an explicit body-size limit either, so the effective cap today is whatever Express's/body-parser's implicit default happens to be — undocumented and easy to hit unexpectedly for legitimate larger deliverables, while also not being a deliberate, reviewed DoS control.

Component

Backend

Difficulty

🟢 Easy

Tasks

• Decide and explicitly configure a maximum request body size in main.ts (e.g. via app.use(json({ limit: '...' }))) appropriate for expected deliverable sizes
• Add a corresponding size cap check in PinContentDto/IpfsPinningService.pinContent() with a clear 400 error rather than relying solely on the framework-level body limit
• Document the maximum deliverable size in the Swagger description for POST /ipfs/pins
• Add a test confirming an oversized payload is rejected with a clear error

Acceptance Criteria

• There is an explicit, documented, and tested maximum size for IPFS pin content uploads
• Exceeding it returns a clear 4xx error rather than an opaque framework-level failure

Estimated Time

3-5 hours