#MultipartCapProvider

#Import

1import { MultipartCapProvider } from "alepha/server/multipart";

#Overview

Decides how many bytes a given request is allowed to carry.

It has no opinion of its own, and that is deliberate: a framework-wide ceiling that anything could raise would be a ceiling in name only. Modules add a resolver for the routes they own — alepha/api/files does exactly that, mapping the targeted $storage bucket to its maxSize.

1alepha.inject(MultipartCapProvider).use((request, route) => …);

A registry rather than a substitutable provider, because substitution has an ordering constraint this cannot satisfy: whoever wants to answer usually loads after the server that reads the answer, and by then the provider is already resolved. Adding to a list works whenever it happens.

⚠️ This is a security surface, not a convenience. A resolver can raise a limit, so whatever it keys on is chosen by the caller: a query parameter is attacker-controlled, and a resolver that answers for every route lets any request claim the largest budget the app declares anywhere. Answer undefined for routes you do not own.

⚠️ And a raised limit is only safe on a path that streams. $secure runs after the body hook, so on a buffering path the budget is reachable before authentication — a bigger number there is a cheaper denial of service, not a feature.