From c573d31ef99af26ad44e9ee39e47660756f769fa Mon Sep 17 00:00:00 2001
From: Gregor Vostrak <gregor@solidtime.io>
Date: Tue, 26 May 2026 13:59:44 +0200
Subject: [PATCH] add 1MB photo upload limit

---
 app/Rules/Base64ImageRule.php                 |  8 ++++++++
 .../Unit/Endpoint/Api/V1/UserEndpointTest.php | 19 +++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/app/Rules/Base64ImageRule.php b/app/Rules/Base64ImageRule.php
index 1c09f7dd..d60ff9b0 100644
--- a/app/Rules/Base64ImageRule.php
+++ b/app/Rules/Base64ImageRule.php
@@ -16,6 +16,8 @@ class Base64ImageRule implements ValidationRule
         'image/png',
     ];
 
+    private const int MAX_BYTES = 1024 * 1024;
+
     /**
      * Run the validation rule.
      *
@@ -32,6 +34,12 @@ class Base64ImageRule implements ValidationRule
         $file = Base64File::decode($value);
         if ($file === null || ! in_array($file['mime_type'], self::ALLOWED_MIME_TYPES, true)) {
             $fail(__('validation.mimes', ['values' => 'jpg, png']));
+
+            return;
+        }
+
+        if (strlen($file['data']) > self::MAX_BYTES) {
+            $fail(__('validation.max.file', ['max' => (string) (self::MAX_BYTES / 1024)]));
         }
     }
 }
diff --git a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
index 8d971708..90184354 100644
--- a/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
+++ b/tests/Unit/Endpoint/Api/V1/UserEndpointTest.php
@@ -354,6 +354,25 @@ class UserEndpointTest extends ApiEndpointTestAbstract
         $response->assertJsonValidationErrors(['photo']);
     }
 
+    public function test_update_fails_if_photo_exceeds_1_megabyte(): void
+    {
+        // Arrange
+        $data = $this->createUserWithPermission();
+        $photo = file_get_contents(resource_path('testfiles/test.png'));
+        $this->assertIsString($photo);
+        $photo .= str_repeat("\0", 1024 * 1024);
+        Passport::actingAs($data->user);
+
+        // Act
+        $response = $this->putJson(route('api.v1.users.update', $data->user->getKey()), [
+            'photo' => base64_encode($photo),
+        ]);
+
+        // Assert
+        $response->assertUnprocessable();
+        $response->assertJsonValidationErrors(['photo']);
+    }
+
     public function test_update_with_null_photo_deletes_photo_file_and_clears_profile_photo_path(): void
     {
         // Arrange