From b0c6217cb40c67c78930161c7e0e983f5c4afb0b Mon Sep 17 00:00:00 2001 From: Experiments DB Dev Date: Mon, 1 Jun 2026 10:30:06 -0400 Subject: [PATCH] fix(backend): widen plot_config size cap to fit a full hiddenSubjects list Co-Authored-By: Claude Opus 4.8 --- backend/src/routes/experiments.js | 7 ++++--- backend/tests/experiments.test.js | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/backend/src/routes/experiments.js b/backend/src/routes/experiments.js index 01c6154..27f93ca 100644 --- a/backend/src/routes/experiments.js +++ b/backend/src/routes/experiments.js @@ -224,9 +224,10 @@ function validateSubjectTemplate(template) { return null; } -// Upper bound on the stored UI-preference blob. Generous for the known fields; -// guards against a client persisting an arbitrarily large object. -const PLOT_CONFIG_MAX_BYTES = 16 * 1024; +// Upper bound on the stored UI-preference blob. Sized to comfortably hold the known +// fields plus a full hiddenSubjects list (≤500 UUIDs ≈ 20 KB) with headroom, while +// still guarding against a client persisting an arbitrarily large object. +const PLOT_CONFIG_MAX_BYTES = 64 * 1024; // The blob is intentionally schema-loose (clients may add display keys over time); // only hiddenSubjects is structurally validated since the backend reasons about it. diff --git a/backend/tests/experiments.test.js b/backend/tests/experiments.test.js index be586fd..058cbc5 100644 --- a/backend/tests/experiments.test.js +++ b/backend/tests/experiments.test.js @@ -176,7 +176,7 @@ describe('PUT /api/experiments/:id/plot-config', () => { it('rejects an oversized config with 422', async () => { prisma.experiment.findUnique.mockResolvedValue(EXPERIMENT); - const big = { blob: 'x'.repeat(20000) }; + const big = { blob: 'x'.repeat(70000) }; const res = await request(app).put(`/api/experiments/${EXPERIMENT.id}/plot-config`).send(big); expect(res.status).toBe(422); expect(prisma.experiment.update).not.toHaveBeenCalled();