fix(orchestrator): makes the bodyParser limit configurable. (#2802)

[lholmquist]

manual cherry-pick of PR #2802

• fix(orchestrator): makes the bodyParser limit configurable.

A customer was having an issue where the workflows content length was over the 100kb limit. This adds a configurable value to make the content lenght larger

fixes: https://redhat.atlassian.net/browse/RHDHSUPP-351

Hey, I just made a Pull Request!

✔️ Checklist

• A changeset describing the change and affected packages. (more info)
• Added or Updated documentation
• Tests for new functionality and regression tests for bug fixes
• Screenshots attached (for UI changes)

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (1)

1. Default body limit still 100kb 📎 Requirement gap ☼ Reliability

Description

The new orchestrator.contentLengthLimit is optional and not set in the default config, so the
request body limit remains at the Express default (100kb/102400 bytes) and large workflow executions
can still fail with HTTP 413.

Code

workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[R196-207]

+  const contentLengthLimit = config.getOptionalString(
+    'orchestrator.contentLengthLimit',
+  );
+  /**
+   * Set the content length limit for the requests.
+   * Defaults to 102400 bytes (100kb)
+   *
+   * There is a possiblity that some workflows will have a very large payload, which could cause a 413 error.
+   * Increasing this value will allow larger payloads to be processed.
+   *
+   */
+  router.use(express.json({ limit: contentLengthLimit }));

Relevance

⭐ Low

PR #2802 intentionally keeps 100kb default unless config set; commented app-config is expected.

PR-#2802

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR Compliance ID 1 requires workflow executions larger than 102400 bytes to not fail with HTTP 413.
The router reads an optional limit and passes it to express.json, while the provided
app-config.yaml keeps the setting commented out, meaning the default limit remains 102400 bytes
and the 413 risk persists.

Orchestrator backend accepts workflow payloads larger than 102400 bytes (avoid HTTP 413)
workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[196-207]
workspaces/orchestrator/app-config.yaml[149-151]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The orchestrator still defaults to the Express JSON body limit (100kb / 102400 bytes) because `orchestrator.contentLengthLimit` is optional and not enabled in the default configuration, so large workflow execution payloads can still hit HTTP 413.

## Issue Context
Compliance requires workflows with request bodies larger than 102400 bytes to execute without HTTP 413.

## Fix Focus Areas
- workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[196-207]
- workspaces/orchestrator/app-config.yaml[149-151]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Unvalidated body limit 🐞 Bug ☼ Reliability

Description

createBackendRouter forwards orchestrator.contentLengthLimit directly into express.json({ limit })
without validation, so an invalid value can throw during router initialization and prevent the
backend from starting. This is a reliability risk because a simple config typo can take the service
down at boot.

Code

workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[R196-207]

+  const contentLengthLimit = config.getOptionalString(
+    'orchestrator.contentLengthLimit',
+  );
+  /**
+   * Set the content length limit for the requests.
+   * Defaults to 102400 bytes (100kb)
+   *
+   * There is a possiblity that some workflows will have a very large payload, which could cause a 413 error.
+   * Increasing this value will allow larger payloads to be processed.
+   *
+   */
+  router.use(express.json({ limit: contentLengthLimit }));

Relevance

⭐ Low

Similar “validate optional config to avoid boot failure” suggestions were rejected in this repo.

PR-#2512
PR-#2802

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The router reads an optional string from config and passes it directly as the JSON parser limit,
with no guarding/fallback behavior for malformed values.

workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[176-210]
workspaces/orchestrator/plugins/orchestrator-common/config.d.ts[17-30]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
`orchestrator.contentLengthLimit` is passed directly into `express.json({ limit })`. If the value is malformed, the JSON body-parser setup can throw and prevent the backend router from being created.

### Issue Context
This is a config-driven knob, so misconfiguration/typos are realistic. The code currently does not validate or provide an explicit safe fallback when the config value is unusable.

### Fix Focus Areas
- workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts[196-209]

### Suggested fix
- Add an explicit default (e.g. `'100kb'`) and validate the configured value before constructing the middleware.
- If validation fails, log a clear warning/error and fall back to the default instead of crashing.
- Optionally accept both string and number configs (e.g. check `getOptionalNumber` in addition to `getOptionalString`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

Review Summary by Qodo

Make orchestrator bodyParser content length limit configurable

🐞 Bug fix ✨ Enhancement

Walkthroughs

Description

• Makes bodyParser content length limit configurable via config
• Adds orchestrator.contentLengthLimit configuration option
• Defaults to 102400 bytes (100kb) to handle large workflow payloads
• Prevents 413 errors for workflows exceeding default size limit

Diagram

flowchart LR
  A["Config: contentLengthLimit"] -- "read from" --> B["router.ts"]
  B -- "apply limit to" --> C["express.json middleware"]
  C -- "controls request size" --> D["Workflow processing"]

Loading

File Changes

1. workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts ✨ Enhancement +12/-1

Add configurable content length limit to router

• Reads orchestrator.contentLengthLimit configuration value
• Passes limit to express.json() middleware
• Adds detailed comment explaining the configuration purpose
• Allows larger workflow payloads to be processed without 413 errors

workspaces/orchestrator/plugins/orchestrator-backend/src/service/router.ts

---

2. workspaces/orchestrator/plugins/orchestrator-common/config.d.ts ⚙️ Configuration changes +7/-1

Add contentLengthLimit to config interface

• Updates copyright from Backstage Authors to Red Hat, Inc.
• Adds contentLengthLimit optional string property to orchestrator config
• Documents default value of 102400 bytes (100kb)

workspaces/orchestrator/plugins/orchestrator-common/config.d.ts

---

3. workspaces/orchestrator/.changeset/purple-eagles-share.md 📝 Documentation +5/-0

Add changeset for backend bodyParser fix

• Creates changeset for orchestrator-backend package
• Documents fix for configurable bodyParser limit
• Marks as patch version change

workspaces/orchestrator/.changeset/purple-eagles-share.md

---

View more (2)

4. workspaces/orchestrator/.changeset/strong-pillows-yawn.md 📝 Documentation +5/-0

Add changeset for common config update

• Creates changeset for orchestrator-common package
• Documents new contentLengthLimit config value
• Marks as patch version change

workspaces/orchestrator/.changeset/strong-pillows-yawn.md

---

5. workspaces/orchestrator/app-config.yaml ⚙️ Configuration changes +2/-0

Add contentLengthLimit example to app config

• Adds commented example for contentLengthLimit configuration
• Shows example value of 10mb for reference
• Documents default behavior of 102400 bytes (100kb)

workspaces/orchestrator/app-config.yaml

---