From e441d2aaff03c48cd7f28435ef0e3a8d039ee755 Mon Sep 17 00:00:00 2001
From: whit3rabbit <whit3rabbit@users.noreply.github.com>
Date: Fri, 27 Mar 2026 15:52:05 -0500
Subject: [PATCH] security: add 1MB body size limit to admin API

---
 crates/proxy/src/admin/routes.rs | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/crates/proxy/src/admin/routes.rs b/crates/proxy/src/admin/routes.rs
index e992f52..941a07e 100644
--- a/crates/proxy/src/admin/routes.rs
+++ b/crates/proxy/src/admin/routes.rs
@@ -4,7 +4,7 @@ use crate::admin::auth::validate_admin_token;
 use crate::admin::state::SharedState;
 use crate::admin::ws::ws_handler;
 use axum::{
-    extract::{ConnectInfo, Path, Query, State},
+    extract::{ConnectInfo, DefaultBodyLimit, Path, Query, State},
     http::StatusCode,
     middleware,
     response::IntoResponse,
@@ -199,7 +199,11 @@ pub fn admin_router(shared: SharedState, token: Arc<String>) -> Router {
         .route("/admin", get(serve_spa));
 
     // Merge all routes.
-    public.merge(protected).merge(ws_route).merge(spa_route)
+    public
+        .merge(protected)
+        .merge(ws_route)
+        .merge(spa_route)
+        .layer(DefaultBodyLimit::max(1_048_576))
 }
 
 async fn health() -> Json<serde_json::Value> {