From 2f4d3bc654e6002b04edbee965af9506700dfa7a Mon Sep 17 00:00:00 2001
From: Hellgren Heikki <heikki.hellgren@op.fi>
Date: Thu, 20 Feb 2025 09:43:17 +0200
Subject: [PATCH] fix(events): increase webhook content limit to 5mb

the default 100kb is too low for some github webhook content when there
are lot of changes to a repository. this change increases the max size
of the request to 5mb.

closes #28910

Signed-off-by: Hellgren Heikki <heikki.hellgren@op.fi>
---
 .changeset/nasty-lemons-scream.md             |  5 ++
 .../HttpPostIngressEventPublisher.test.ts     | 80 +++++++++++++++++++
 .../http/HttpPostIngressEventPublisher.ts     |  2 +-
 3 files changed, 86 insertions(+), 1 deletion(-)
 create mode 100644 .changeset/nasty-lemons-scream.md

diff --git a/.changeset/nasty-lemons-scream.md b/.changeset/nasty-lemons-scream.md
new file mode 100644
index 0000000000..2b0254b382
--- /dev/null
+++ b/.changeset/nasty-lemons-scream.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-events-backend': patch
+---
+
+Allow webhook content to be 5mb instead the default 100kb
diff --git a/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.test.ts b/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.test.ts
index 16f36d6b0a..45ee055fa9 100644
--- a/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.test.ts
+++ b/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.test.ts
@@ -96,6 +96,86 @@ describe('HttpPostIngressEventPublisher', () => {
     );
   });
 
+  it('should allow large input', async () => {
+    const config = new ConfigReader({
+      events: {
+        http: {
+          topics: ['testA'],
+        },
+      },
+    });
+
+    const router = Router();
+    const app = express().use(router);
+    const events = new TestEventsService();
+    const data = {
+      testA: 'a'.repeat(1024 * 1024),
+    };
+
+    const publisher = HttpPostIngressEventPublisher.fromConfig({
+      config,
+      events,
+      ingresses: {
+        testB: {},
+      },
+      logger,
+    });
+    publisher.bind(router);
+
+    const response = await request(app)
+      .post('/http/testA')
+      .type('application/json')
+      .set('X-Custom-Header', 'test-value')
+      .timeout(1000)
+      .send(JSON.stringify(data));
+    expect(response.status).toBe(202);
+
+    expect(events.published).toHaveLength(1);
+    expect(events.published[0].topic).toEqual('testA');
+    expect(events.published[0].eventPayload).toEqual(data);
+    expect(events.published[0].metadata).toEqual(
+      expect.objectContaining({
+        'content-type': 'application/json',
+        'x-custom-header': 'test-value',
+      }),
+    );
+  });
+
+  it('should fail on too large input', async () => {
+    const config = new ConfigReader({
+      events: {
+        http: {
+          topics: ['testA'],
+        },
+      },
+    });
+
+    const router = Router();
+    const app = express().use(router);
+    const events = new TestEventsService();
+    const data = {
+      testA: 'a'.repeat(10 * 1024 * 1024),
+    };
+
+    const publisher = HttpPostIngressEventPublisher.fromConfig({
+      config,
+      events,
+      ingresses: {
+        testB: {},
+      },
+      logger,
+    });
+    publisher.bind(router);
+
+    const response = await request(app)
+      .post('/http/testA')
+      .type('application/json')
+      .set('X-Custom-Header', 'test-value')
+      .timeout(1000)
+      .send(JSON.stringify(data));
+    expect(response.status).toBe(413);
+  });
+
   it('no raw body', async () => {
     const config = new ConfigReader({
       events: {
diff --git a/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.ts b/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.ts
index 806247e870..a14bb7243e 100644
--- a/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.ts
+++ b/plugins/events-backend/src/service/http/HttpPostIngressEventPublisher.ts
@@ -90,7 +90,7 @@ export class HttpPostIngressEventPublisher {
     [topic: string]: Omit<HttpPostIngressOptions, 'topic'>;
   }): express.Router {
     const router = Router();
-    router.use(express.raw({ type: '*/*' }));
+    router.use(express.raw({ type: '*/*', limit: '5mb' }));
 
     Object.keys(ingresses).forEach(topic =>
       this.addRouteForTopic(router, topic, ingresses[topic].validator),