fix(files): restore the plugin-wide upload size limit

req.file({ limits: { fileSize: undefined } }) does not fall back to the
6MB limit registered on @fastify/multipart — deepmerge overwrites the
default with the undefined and busboy ends up unbounded. Callers that pass
no maximum (local attachment and image uploads, PUT /files/:type/:name)
were therefore accepting files of any size.

Author: Innei

apps/core/src/processors/helper/helper.upload.service.ts

@@ -11,11 +11,14 @@ export class UploadService {
       maxFileSize?: number
     },
   ): Promise<MultipartFile> {
-    const data = await req.file({
-      limits: {
-        fileSize: options?.maxFileSize,
-      },
-    })
+    // Passing `fileSize: undefined` does not fall back to the limit registered
+    // on the plugin — deepmerge overwrites the 6MB default with the undefined,
+    // leaving busboy unbounded. Omit the option entirely instead.
+    const data = await req.file(
+      options?.maxFileSize === undefined
+        ? undefined
+        : { limits: { fileSize: options.maxFileSize } },
+    )
 
     if (!data) {
       throw new BadRequestException('Only file uploads are accepted!')

apps/core/test/src/processors/helper/helper.upload.service.spec.ts

@@ -0,0 +1,34 @@
+import type { FastifyRequest } from 'fastify'
+import { describe, expect, it, vi } from 'vitest'
+
+import { UploadService } from '~/processors/helper/helper.upload.service'
+
+function requestWithFileSpy() {
+  const file = vi.fn(async () => ({ fieldname: 'file' }))
+  return { file, req: { file } as unknown as FastifyRequest }
+}
+
+describe('UploadService.getAndValidMultipartField', () => {
+  it('omits the limits option so the plugin-wide file size limit applies', async () => {
+    const { file, req } = requestWithFileSpy()
+    await new UploadService().getAndValidMultipartField(req)
+    expect(file).toHaveBeenCalledWith(undefined)
+  })
+
+  it('forwards an explicit maximum file size', async () => {
+    const { file, req } = requestWithFileSpy()
+    await new UploadService().getAndValidMultipartField(req, {
+      maxFileSize: 1024,
+    })
+    expect(file).toHaveBeenCalledWith({ limits: { fileSize: 1024 } })
+  })
+
+  it('rejects a part sent under a field name other than "file"', async () => {
+    const req = {
+      file: async () => ({ fieldname: 'avatar' }),
+    } as unknown as FastifyRequest
+    await expect(
+      new UploadService().getAndValidMultipartField(req),
+    ).rejects.toThrow('The field name must be "file"')
+  })
+})