add 1MB photo upload limit

app/Rules/Base64ImageRule.php

@@ -16,6 +16,8 @@ class Base64ImageRule implements ValidationRule
         'image/png',
     ];
 
+    private const int MAX_BYTES = 1024 * 1024;
+
     /**
      * Run the validation rule.
      *
@@ -32,6 +34,12 @@ class Base64ImageRule implements ValidationRule
         $file = Base64File::decode($value);
         if ($file === null || ! in_array($file['mime_type'], self::ALLOWED_MIME_TYPES, true)) {
             $fail(__('validation.mimes', ['values' => 'jpg, png']));
+
+            return;
+        }
+
+        if (strlen($file['data']) > self::MAX_BYTES) {
+            $fail(__('validation.max.file', ['max' => (string) (self::MAX_BYTES / 1024)]));
         }
     }
 }

tests/Unit/Endpoint/Api/V1/UserEndpointTest.php

@@ -354,6 +354,25 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         $response->assertJsonValidationErrors(['photo']);
     }
 
+    public function test_update_fails_if_photo_exceeds_1_megabyte(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $photo = file_get_contents(resource_path('testfiles/test.png'));
+        $this->assertIsString($photo);
+        $photo .= str_repeat("\0", 1024 * 1024);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => base64_encode($photo),
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['photo']);
+    }
+
     public function test_update_with_null_photo_deletes_photo_file_and_clears_profile_photo_path(): void
     {
         // Arrange