From c3405dbc91b7795013091e6507819af56bc639c5 Mon Sep 17 00:00:00 2001
From: Adam Letizia <LetiziaAdam@JohnDeere.com>
Date: Mon, 25 Aug 2025 09:35:48 -0500
Subject: [PATCH] fix(scaffolder-backend): sets router max upload size to 10MB

Signed-off-by: Adam Letizia <LetiziaAdam@JohnDeere.com>
---
 .changeset/silent-results-stick.md            |  5 +++
 .../src/service/router.test.ts                | 42 +++++++------------
 .../scaffolder-backend/src/service/router.ts  |  9 ++--
 3 files changed, 27 insertions(+), 29 deletions(-)
 create mode 100644 .changeset/silent-results-stick.md

diff --git a/.changeset/silent-results-stick.md b/.changeset/silent-results-stick.md
new file mode 100644
index 0000000000..6cb501027c
--- /dev/null
+++ b/.changeset/silent-results-stick.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Fixed a regression that prevented uploads greater than 100KB. Uploads up to 10MB are supported again.
diff --git a/plugins/scaffolder-backend/src/service/router.test.ts b/plugins/scaffolder-backend/src/service/router.test.ts
index 467b590bed..4144c552fb 100644
--- a/plugins/scaffolder-backend/src/service/router.test.ts
+++ b/plugins/scaffolder-backend/src/service/router.test.ts
@@ -1385,34 +1385,24 @@ data: {"id":1,"taskId":"a-random-id","type":"completion","createdAt":"","body":{
         expect.anything(),
       );
     });
-    it('disallows users from seeing tasks they do not own', async () => {
-      const { permissions, router, taskBroker } = await createTestRouter();
-      jest
-        .spyOn(permissions, 'authorizeConditional')
-        .mockImplementationOnce(async () => [
-          {
-            conditions: {
-              resourceType: 'scaffolder-task',
-              rule: 'IS_TASK_OWNER',
-              params: { createdBy: ['user'] },
-            },
-            pluginId: 'scaffolder',
-            resourceType: 'scaffolder-task',
-            result: AuthorizeResult.CONDITIONAL,
+    it('allows payloads up to 10MB', async () => {
+      const { unwrappedRouter } = await createTestRouter();
+      const mockToken = mockCredentials.user.token();
+      const mockTemplate = generateMockTemplate();
+
+      const response = await request(unwrappedRouter)
+        .post('/v2/dry-run')
+        .set('Authorization', `Bearer ${mockToken}`)
+        .send({
+          template: mockTemplate,
+          values: {
+            requiredParameter1: 'A'.repeat(9 * 1024 * 1024), // ~9MB
+            requiredParameter2: 'required-value-2',
           },
-        ]);
-      const response = await request(router).get(
-        `/v2/tasks?createdBy=not-user`,
-      );
-      expect(taskBroker.list).toHaveBeenCalledWith({
-        filters: { createdBy: ['not-user'], status: undefined },
-        order: undefined,
-        pagination: { limit: undefined, offset: undefined },
-        permissionFilters: { key: 'created_by', values: ['user'] },
-      });
+          directoryContents: [],
+        });
+
       expect(response.status).toBe(200);
-      expect(response.body.totalTasks).toBe(0);
-      expect(response.body.tasks).toEqual([]);
     });
   });
 
diff --git a/plugins/scaffolder-backend/src/service/router.ts b/plugins/scaffolder-backend/src/service/router.ts
index 9315e8ccb2..8296a6003f 100644
--- a/plugins/scaffolder-backend/src/service/router.ts
+++ b/plugins/scaffolder-backend/src/service/router.ts
@@ -186,9 +186,12 @@ const readDuration = (
 export async function createRouter(
   options: RouterOptions,
 ): Promise<express.Router> {
-  const router = await createOpenApiRouter();
-  // Be generous in upload size to support a wide range of templates in dry-run mode.
-  router.use(express.json({ limit: '10MB' }));
+  const router = await createOpenApiRouter({
+    middleware: [
+      // Be generous in upload size to support a wide range of templates in dry-run mode.
+      express.json({ limit: '10MB' }),
+    ],
+  });
 
   const {
     logger: parentLogger,