fix(api): bound queue intelligence request size

[JSONbored]

Motivation

• Prevent a denial-of-service vector where the internal POST /v1/internal/queue-intelligence endpoint could accept unbounded arrays and long strings, parse and validate them, then sort and echo them back, allowing privileged callers to exhaust Worker CPU/heap and response bandwidth.
• Ensure the route is treated as a costly operation by the rate limiter so it is throttled into the expensive bucket.

Description

• Add request and field size limits: introduce constants QUEUE_INTELLIGENCE_MAX_BODY_BYTES, QUEUE_INTELLIGENCE_MAX_PULL_REQUESTS, QUEUE_INTELLIGENCE_MAX_AUTHOR_LENGTH, QUEUE_INTELLIGENCE_MAX_TITLE_LENGTH, QUEUE_INTELLIGENCE_MAX_BODY_LENGTH, and QUEUE_INTELLIGENCE_MAX_DUPLICATE_CANDIDATES in src/api/routes.ts.
• Stream and cap request body before JSON parsing using readRequestBodyWithLimit and parsePositiveInt to return 413 for oversized payloads and avoid unbounded c.req.json() parsing.
• Constrain Zod validation for PRs by adding .max() on the PR array and .max() limits on author, title, body, and duplicateCandidates in the PR schema so validation and downstream analyzePRQueue work on bounded inputs.
• Mark the queue-intelligence path as expensive in src/auth/rate-limit.ts so it uses stricter rate-limiting.
• Add integration tests in test/integration/api.test.ts validating too-large payloads, excessive PR counts, and oversized PR fields are rejected, and add a unit assertion in test/unit/auth.test.ts that the route is classified expensive.

Testing

• Type checking was run with npm run typecheck and succeeded.
• Unit and integration tests were executed with npx vitest run test/unit/auth.test.ts test/integration/api.test.ts and all targeted tests passed.
• The change was lint/checked with git diff --check and no issues were reported.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#496 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	b884696	Commit Preview URL Branch Preview URL	Jun 10 2026, 06:59 AM

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.