Make a partly-undone import retryable, and refuse a plan it cannot deliver

shopdb/config.py

@@ -134,6 +134,22 @@ class Config:
     DEFAULT_PAGE_SIZE = 20
     MAX_PAGE_SIZE = 100
 
+    # Hard ceiling on a request body, enforced by Werkzeug before a view runs.
+    #
+    # Upload routes cap their own payloads, but every one of those checks runs
+    # AFTER the body has arrived: the first touch of request.form or
+    # request.files makes Werkzeug parse the whole multipart and spool the file
+    # part to a temp file, so a route can reject the content and still have paid
+    # for the transfer and the disk. Three separate reviews found that shape in
+    # three different routes, which makes it a property of the app rather than
+    # of any handler.
+    #
+    # 128 MB clears the largest thing anyone legitimately sends - the agent
+    # binary upload caps itself at 64 MB - with room for the multipart envelope.
+    # Over this, Werkzeug answers 413 without reading the body.
+    MAX_CONTENT_LENGTH = int(
+        os.environ.get('MAX_CONTENT_LENGTH', 128 * 1024 * 1024))
+
 
 class DevelopmentConfig(Config):
     """Development configuration."""