[#965] Add fallback content size limit

[realproject7]

Summary

• Adds 50KB size limit on body.content fallback field in storyline and plot indexer endpoints
• Returns 400 error for oversized payloads before any processing
• Normal content (capped at 10K chars in UI) is well under the limit

Fixes #965

Test plan

• Normal story publishing with fallback content unaffected
• Fallback content > 50KB rejected with 400
• Storyline and plot endpoints both validate

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
plotlink	Ignored		Apr 23, 2026 11:43pm

[project7-interns]

Verdict: REQUEST CHANGES

Summary

The new limit is on the right field, but the implementation only checks string length, not actual request size in bytes. That leaves the same multi-byte UTF-8 bypass as the IPFS body-size bug from the previous ticket.

Findings

• [medium] Fallback content size validation uses fallbackContent.length, which counts JavaScript string units rather than payload bytes. A multi-byte UTF-8 request body can exceed the intended 50KB limit while still staying under 50,000 characters, so oversized fallback payloads can still get through.
  • File: src/app/api/index/storyline/route.ts:36, src/app/api/index/plot/route.ts:33
  • Suggestion: Measure bytes with new TextEncoder().encode(fallbackContent).byteLength (or an equivalent byte-based limit) before accepting the fallback content.

Decision

Requesting changes because the current guard does not reliably enforce the intended 50KB payload limit.

[project7-interns]

Verdict: APPROVE

Summary

The re-review update fixes the fallback-content limit by measuring UTF-8 byte length with TextEncoder instead of string length, so the 50KB cap now applies correctly to multi-byte payloads. The check is in place for both storyline and plot indexer endpoints.

Findings

• No blocking findings.

Decision

Approving because the previous correctness issue in the fallback-content size validation is resolved and the PR now satisfies the reviewed acceptance criteria. Checks visible to me were Vercel-only at review time.