From 31205e44d821da8272a1e0ac5f76dc6f2daf608e Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Wed, 14 Oct 2026 04:17:51 +0200
Subject: [PATCH] fix: stop cutting off uploads over 10 MB that pass through
 the server, such as office documents saved from the editor

---
 lib/plugin-secrets/proxy.ts | 4 ++--
 next.config.ts              | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/lib/plugin-secrets/proxy.ts b/lib/plugin-secrets/proxy.ts
index 043e5c916..46dab8124 100644
--- a/lib/plugin-secrets/proxy.ts
+++ b/lib/plugin-secrets/proxy.ts
@@ -12,8 +12,8 @@ import { DisallowedUrlError, fetchPublicUrl } from '@/lib/security/url-guard';
 import { authHeaderFor, credentialOrigin, privateProxyOrigins, type CredentialInject, type CredentialSpec } from './credentials';
 import { getUserCredential, setUserCredentialSecret, userKey, type VaultUser } from './vault';
 
-/** Largest request body the proxy forwards (one upload chunk). */
-export const MAX_PROXY_REQUEST_BYTES = 512 * 1024 * 1024;
+/** Largest request body the proxy forwards (one upload chunk); see proxyClientMaxBodySize in next.config.ts. */
+export const MAX_PROXY_REQUEST_BYTES = 100 * 1024 * 1024;
 /** Largest response body it passes back (a download). */
 export const MAX_PROXY_RESPONSE_BYTES = 2 * 1024 * 1024 * 1024;
 /** Largest response it reads to capture a secret from. */
diff --git a/next.config.ts b/next.config.ts
index 43ebe02b0..65f3e6c1b 100644
--- a/next.config.ts
+++ b/next.config.ts
@@ -59,6 +59,14 @@ const nextConfig: NextConfig = {
   // it from node_modules at runtime instead of trying to bundle it. Used by
   // PLUGIN_DEV_DIR's on-the-fly bundler.
   serverExternalPackages: ["esbuild"],
+  experimental: {
+    // proxy.ts runs for every request, /api included, and Next buffers the
+    // body for it up to this size and silently cuts off the rest. 10 MB (the
+    // default) truncated WOPI saves and WebDAV uploads of bigger files, and
+    // plugin uploads through /api/plugin-proxy. Keep MAX_PROXY_REQUEST_BYTES
+    // in lib/plugin-secrets/proxy.ts in step with it.
+    proxyClientMaxBodySize: "100mb",
+  },
   // Response headers are the host's job in a static export (see out/_headers).
   ...(isLite
     ? {}