fix: enforce required file size limit on presigned upload route and R2 PutObjectCommand

[Basharameez]

Summary

Enforces mandatory size validation in the upload presign API schema and binds ContentLength in the S3/R2 PutObjectCommand presigned URL generator to prevent arbitrary-sized file uploads.

Problem

Previously, size was an optional parameter in app/api/upload/presign/route.ts, and getPresignedUploadUrl in lib/r2/upload.ts did not pass ContentLength to PutObjectCommand. Consequently, a client could request a presigned upload URL without specifying a file size, and upload an arbitrarily large file (bypassing the 5 MB server-side limit).

Solution

1. API Validation: Updated schema in app/api/upload/presign/route.ts to make size required (z.number().min(1).max(MAX_SIZE_BYTES)).
2. Server-Side Enforcement: Extended getPresignedUploadUrl in lib/r2/upload.ts to accept contentLength?: number and bind ContentLength in PutObjectCommand.
3. Route Integration: Forwarded size from the validated presign request payload to getPresignedUploadUrl.

Testing

• New Unit Tests:
  • app/api/upload/presign/route.test.ts: Verified 400 Bad Request responses for missing size and oversized size (> 5 MB), 429 rate limiting, and successful URL generation with valid size.
  • lib/r2/upload.test.ts: Verified that ContentLength is properly set on PutObjectCommand.
• Automated Verification:
  • npx vitest run: All 16 test files (138 tests) passed.
  • next lint: 0 ESLint warnings or errors.
  • prettier: Formatting verified.

Closes #100

[github-actions]

Welcome, @Basharameez, and thanks for your first pull request to agentpostmortem.

A quick look at CONTRIBUTING.md covers how things are set up and run here.

I'll review this shortly. Ask anything in the thread if something is unclear.

[github-actions]

And it's in. Thanks @Basharameez.

Good, focused change. Exactly the kind of thing agentpostmortem needs.

If agentpostmortem is useful to you, a star goes a long way.

Happy to see more from you whenever you have the time.