fix: reject oversized request bodies via Content-Length before parsing

JSON body endpoints (layout/topology/external) only rejected oversized
node/edge lists after Starlette buffered and Pydantic parsed the full
body. Add global middleware that 413s early based on declared
Content-Length. Backstop for direct backend exposure (docker-compose
dev) — nginx's client_max_body_size already covers the prod path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: vagkaratzas

backend/app/main.py

@@ -1,5 +1,7 @@
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
 
+from app import config
 from app.routers import attributes as attributes_router
 from app.routers import config as config_router
 from app.routers import external as external_router
@@ -18,6 +20,27 @@
 app.include_router(attributes_router.router)
 
 
+# Defense-in-depth: JSON body endpoints (layout/topology/external) validate
+# node/edge counts only *after* Starlette buffers + Pydantic parses the full
+# body, so an oversized payload is fully read into memory before rejection.
+# Reject early using the declared Content-Length. This is a backstop for
+# direct/non-nginx exposure (e.g. docker-compose dev) — the prod deploy's
+# nginx client_max_body_size already enforces this at the edge. A request
+# without Content-Length (chunked transfer) isn't caught here; it still hits
+# the per-endpoint UploadFile checks for the file-upload routes.
+@app.middleware("http")
+async def limit_body_size(request: Request, call_next):  # type: ignore[no-untyped-def]
+    content_length = request.headers.get("content-length")
+    if content_length is not None:
+        try:
+            too_large = int(content_length) > config.MAX_UPLOAD_BYTES
+        except ValueError:
+            too_large = False  # malformed header — let normal parsing reject it
+        if too_large:
+            return JSONResponse(status_code=413, content={"detail": "Payload too large."})
+    return await call_next(request)
+
+
 @app.get("/api/health")
 async def health() -> dict[str, str]:
     return {"status": "ok"}

backend/tests/test_main.py

@@ -0,0 +1,24 @@
+from fastapi.testclient import TestClient
+
+from app import config
+from app.main import app
+
+client = TestClient(app)
+
+
+def test_oversized_content_length_rejected_before_parsing() -> None:
+    headers = {"content-length": str(config.MAX_UPLOAD_BYTES + 1)}
+    resp = client.post("/api/layout", headers=headers, content=b"")
+    assert resp.status_code == 413
+
+
+def test_undersized_content_length_reaches_normal_validation() -> None:
+    # No node/edge lists -> 422 from Pydantic, proving the middleware let it
+    # past the size gate rather than blocking every request.
+    resp = client.post("/api/layout", json={})
+    assert resp.status_code == 422
+
+
+def test_malformed_content_length_is_ignored() -> None:
+    resp = client.post("/api/layout", headers={"content-length": "not-a-number"}, json={})
+    assert resp.status_code == 422