From 0226cdd52b01d5a6304c65fcaca18f27fb714e77 Mon Sep 17 00:00:00 2001 From: BOHA Date: Mon, 8 Jun 2026 15:05:16 +0200 Subject: [PATCH] fix(ai): cap extract-invoices batch at 20 files Final review flagged that the multipart limits set only fileSize, so a single /extract-invoices request could carry unbounded PDF parts. The per-batch budget re-check already bounds total spend, but this bounds the work (one vision call per file) of any single request. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/routes/admin/ai.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/routes/admin/ai.ts b/src/routes/admin/ai.ts index 261323b..a6ef126 100644 --- a/src/routes/admin/ai.ts +++ b/src/routes/admin/ai.ts @@ -19,7 +19,9 @@ import { export default async function aiRoutes(app: FastifyInstance): Promise { await app.register(multipart, { - limits: { fileSize: config.nas.maxUploadSize }, + // Cap files per request: the budget re-check already bounds *spend* mid-batch, + // but this bounds the work (one vision call per file) of a single request. + limits: { fileSize: config.nas.maxUploadSize, files: 20 }, }); // GET /api/admin/ai/usage — current-month spend + budget