Validate total attachment size

[whabanks]

Summary | Résumé

This PR adds additional defensive validation to files/rest.py::create_file that ensures total file attachment size does not exceed 6MB. It takes the size of the newly requested file + existing file attachments into account. The InvalidRequest raised returns data to aid in constructing an appropriate error message on the front end.

{
  "error": "Total file size exceeds the 6MB limit.",
  "current_usage": existing_size,
  "requested": data["file_size"],
  "limit": MAX_TOTAL_FILE_SIZE,
}

Related Issues | Cartes liées

Bug bash issue: https://docs.google.com/document/d/1m_EzXNJbqjJH-WLzxRKMtO4k5CAHwk51uCXi7xJQR44/edit?tab=t.0#task=NbqwOoo-dIWUUrb0

Test instructions | Instructions pour tester la modification

1. Hook your local up to staging
2. Add a few files to a template eventually adding one that would put you over the 6Mb limit
3. Note that the file isn't attached (currently nothing will happen, no error message yet as it needs to be caught in the front end and displayed)

Release Instructions | Instructions pour le déploiement

None.

Reviewer checklist | Liste de vérification du réviseur

• This PR does not break existing functionality.
• This PR does not violate GCNotify's privacy policies.
• This PR does not raise new security concerns. Refer to our GC Notify Risk Register document on our Google drive.
• This PR does not significantly alter performance.
• Additional required documentation resulting of these changes is covered (such as the README, setup instructions, a related ADR or the technical documentation).

⚠ If boxes cannot be checked off before merging the PR, they should be moved to the "Release Instructions" section with appropriate steps required to verify before release. For example, changes to celery code may require tests on staging to verify that performance has not been affected.

[Copilot]

Pull request overview

Adds server-side validation to the template file upload endpoint to cap the combined size of attachments for a template at 6MB, with accompanying tests to verify expected 400/201 behavior (including archived-file handling).

Changes:

• Introduce MAX_TOTAL_FILE_SIZE (6MB) and reject uploads when existing attachments + requested size exceed the limit.
• Return a structured 400 response payload including current usage, requested size, and limit.
• Add unit tests covering over-limit, exact-limit, single-file over-limit, and archived-file exclusion cases.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
app/files/rest.py	Adds total-size validation logic and a new size-limit constant in create_file.
tests/app/files/test_rest.py	Adds test coverage for the new total-size validation scenarios.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[andrewleith]

This seems to be throwing an uncaught exception in API instead of return a 400 to ADMIN.

[andrewleith]

You could try something like:

return jsonify({"error": "over_file_limit"}), 400

We'll need to come up with a format there so ADMIN can read it on the other side.

[whabanks]

Updated! Let me know what you think