v0.0.62: лимиты 50МБ/файл, 500МБ/сессия (фронт+бэк), лимиты в UI

site/routes/api_bp.py

@@ -22,7 +22,8 @@ from flask import Blueprint, request, send_file, jsonify, Response, stream_with_
 
 from drhider import obfuscate_files, LLMClient
 from session import (create_session, add_file, get_files, store_result,
-                     get_result, store_csv, get_csv, cleanup, file_count)
+                     get_result, store_csv, get_csv, cleanup, file_count,
+                     MAX_FILE_BYTES)
 
 api_bp = Blueprint("api", __name__, url_prefix="/api")
 log = logging.getLogger("routes.api_bp")
@@ -52,6 +53,10 @@ def upload():
             continue
         data = f.read()
         log.info("upload: sid=%s file=%r size=%d", sid, f.filename, len(data))
+        if len(data) > MAX_FILE_BYTES:
+            log.warning("upload: file exceeds %dMB, skipped sid=%s file=%r size=%d",
+                        MAX_FILE_BYTES // (1024 * 1024), sid, f.filename, len(data))
+            continue
         if not add_file(sid, f.filename, data):
             log.warning("upload: session not found/limit, sid=%s file=%r", sid, f.filename)
             return jsonify({"ok": False, "error": "Session not found"}), 404
@@ -89,10 +94,27 @@ def upload_refs():
                 url = ref.get("url")
                 if not name or not url:
                     continue
+                # Лимит на один файл (50 МБ): сверх лимита — пропускаем (не участвует)
+                if (ref.get("size") or 0) > MAX_FILE_BYTES:
+                    log.warning("upload_refs: file exceeds %dMB, skip sid=%s file=%r size=%s",
+                                MAX_FILE_BYTES // (1024 * 1024), sid, name, ref.get("size"))
+                    try:
+                        client.delete(url)
+                    except Exception:
+                        pass
+                    continue
                 with client.stream("GET", url) as resp:
                     resp.raise_for_status()
                     content = b"".join(resp.iter_bytes())
                 log.info("upload_refs: pulled sid=%s file=%r size=%d", sid, name, len(content))
+                if len(content) > MAX_FILE_BYTES:
+                    log.warning("upload_refs: pulled file exceeds %dMB, skip sid=%s file=%r size=%d",
+                                MAX_FILE_BYTES // (1024 * 1024), sid, name, len(content))
+                    try:
+                        client.delete(url)
+                    except Exception:
+                        pass
+                    continue
                 if not add_file(sid, name, content):
                     log.warning("upload_refs: session not found/limit, sid=%s file=%r", sid, name)
                     return jsonify({"ok": False, "error": "Session not found"}), 404