fix: reject PDF template uploads larger than 10MB (#460)

[1sakshm]

Description

POST /templates/upload read the entire uploaded file into memory without checking its size, so a very large upload could exhaust server memory.

This adds a 10 MB limit (_MAX_TEMPLATE_BYTES) and reuses the same 413 pattern the voice input route already uses (app/api/routes/input.py):

• fast path: reject based on the declared file.size before reading
• fallback: reject based on len(content) after reading
• error: AppError with status_code=413, error_code="FILE_TOO_LARGE" and detail={"max_size_bytes", "received_size_bytes"}

Fixes #460

Note: POST /forms/transcribe (app/api/routes/forms.py) also calls audio.file.read() with no limit. I left it out to keep this PR scoped, but I'm happy to add it here or in a follow-up.

Type of change

• Bug fix (non-breaking change which fixes an issue)

How Has This Been Tested?

• Added test_upload_oversize_pdf_rejected in tests/test_api.py (monkeypatches the limit to 5 bytes and checks for 413 / FILE_TOO_LARGE / detail values)
• Full suite: PYTHONPATH=. python -m pytest tests/ → 174 passed
• ruff check app/ → all checks passed

Test Configuration:

• Python version: 3.11
• Docker/Compose version: N/A (tests run locally)
• OS: Windows 11

Checklist:

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published in downstream modules
• The Lint workflow check passes on this PR ✅
• The Tests workflow check passes on this PR ✅

[marcvergees]

Hi @1sakshm, sorry for the delay responding.

Your PR looks good, but we cannot merge it unless it has a frontend implementation too.

We should have a message error in the frontend that says so.

You can create an issue in the frontend for that and submit your PR.

We'll. be able to merge it when we have both things.

Lmk if you have problems with anything. You can tag other maintainers too.

Marc

[1sakshm]

Thanks @marcvergees! I'll do that right away: I'll open an issue in fireform-frontend for showing the file-too-large error and send a PR for it, then link both here.

[1sakshm]

@marcvergees the frontend part is up:

• Issue: [FEAT]: Show an error when a template PDF exceeds the 10 MB upload limit fireform-frontend#47
• PR: Show an error when a template PDF exceeds the 10 MB upload limit fireform-frontend#48

Studio now checks the file size when a PDF is selected and shows the size and the 10 MB limit instead of uploading it. If the backend still returns 413, its message is shown as well.