Bound request bodies and artifact uploads (Refs #94)

src/lib/server/fleet/scripts.ts

@@ -2,6 +2,7 @@ import { putFileBlob, blobContent } from '../db/file-blobs.js';
 import { createHash } from 'node:crypto';
 import { db } from '../db/index.js';
 import { configFileForGame, type ArtifactKind } from '../config.js';
+import { MAX_ARTIFACT_BYTES } from '../../artifact-limits.js';
 
 export type { ArtifactKind };
 
@@ -72,6 +73,7 @@ export class ScriptError extends Error {
             | 'baseline-exists'
             | 'empty-overlay'
             | 'invalid-release-version'
+            | 'too-large'
     ) {
         super(message);
     }
@@ -218,6 +220,8 @@ export function createScript(input: CreateScriptInput): {
     script: ScriptRow;
     version: ScriptVersionRow;
 } {
+    if (input.content.byteLength > MAX_ARTIFACT_BYTES)
+        throw new ScriptError('Artifacts must not exceed 32 MiB.', 'too-large');
     if (!input.name.trim()) throw new ScriptError('script name is required', 'name-empty');
     const kind: ArtifactKind = input.kind ?? 'script';
     if (!isArtifactKind(kind)) throw new ScriptError(`invalid kind: ${input.kind}`, 'invalid-kind');
@@ -316,6 +320,8 @@ export function uploadNewVersion(
     notes?: string,
     releaseVersion?: string
 ): ScriptVersionRow {
+    if (content.byteLength > MAX_ARTIFACT_BYTES)
+        throw new ScriptError('Artifacts must not exceed 32 MiB.', 'too-large');
     const script = getScript(scriptId);
     if (!script) throw new ScriptError(`no such script (id=${scriptId})`, 'no-such-script');