Fix : Add file size validation for CSV import endpoint

[Athrv-D]

Pull Request

🔗 Related Issue

Closes #327

---

📝 Summary of Changes

• Added a maximum CSV upload size limit of 10 MB.
• Added validation to reject oversize CSV upload before reading the file into memory.
• Return HTTP 400 Bad Request with a appropriate error message when upload exceeds the allowed limit.
• Added a test to verify oversize CSV file uploads are rejected.

---

🏷️ Type of Change

• [☑️] 🐛 Bug fix
• [] ✨ New feature
• ♻️ Refactor
• 📝 Documentation update
• 🎨 UI / Style change
• 🔧 Chore

---

🧪 Testing

Steps to test:
1 .Upload CSV file larger than 10 MB
2. Verify the API returns HTTP 400 with expected error message.
3. Upload a CSV file smaller than 10 MB and verify it is accepted.
4. Run: python manage.py test leads.tests

---

📸 Screenshots (if applicable)

---

✅ Checklist

• [ ✅] No merge conflicts
• [ ✅] Changes follow the project guidelines
• Documentation updated (if applicable)
• [ ✅] Related issue linked
• [ ✅] Changes tested locally (if applicable)

Summary by CodeRabbit

• Bug Fixes
  • CSV lead imports larger than 10 MB are now rejected with a clear error message.
  • Oversized uploads no longer create import jobs or start processing.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CSV import endpoint now rejects files larger than 10 MB before processing. A test verifies the HTTP 400 response, error message, and absence of created import jobs.

Changes

CSV upload validation

Layer / File(s)	Summary
CSV upload size guard backend/leads/views.py, backend/leads/tests.py	Defines a 10 MB upload limit, rejects oversized files with HTTP 400 before job creation, and tests the response and organization-scoped job count.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: kunal-9090

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues check	⚠️ Warning	The 400 rejection and oversized-file test are present, but the requested configurable MAX_CSV_UPLOAD_SIZE setting is implemented as a module constant.	Expose the limit as a configurable setting and use it in views, then keep the pre-read size check and test.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Out of Scope Changes check	✅ Passed	The changes stay focused on CSV upload size validation and its test coverage.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: adding file size validation to the CSV import endpoint.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

backend/leads/views.py (1)

103-106: 🩺 Stability & Availability | 🔵 Trivial

Consider Celery broker payload limits and decoding safety for large files.

• Broker payload limits: While capping the upload size at 10 MB mitigates extreme memory consumption on the web thread, sending up to 10 MB of string payload directly as a Celery task argument downstream (import_leads_from_csv.delay(...)) can still exceed message broker limits (e.g., Redis or RabbitMQ) and degrade queue performance. Consider persisting the file to object storage or a temporary location and passing a reference to the task instead.
• Decoding safety: Just below the size check, file_obj.read().decode('utf-8') executes without error handling. If a user uploads a non-UTF-8 file (e.g., a binary file renamed to .csv), this will throw a UnicodeDecodeError and result in an unhandled 500 error.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@backend/leads/views.py` around lines 103 - 106, Update the CSV upload flow
around the size check and import_leads_from_csv.delay call to avoid placing the
full file contents in the Celery broker: persist the uploaded file to temporary
or object storage and pass only its reference to the task. Wrap the
file_obj.read().decode("utf-8") operation with handling for UnicodeDecodeError
and return a client-facing 400 response for invalid UTF-8 uploads.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@backend/leads/views.py`:
- Around line 103-106: Update the CSV upload flow around the size check and
import_leads_from_csv.delay call to avoid placing the full file contents in the
Celery broker: persist the uploaded file to temporary or object storage and pass
only its reference to the task. Wrap the file_obj.read().decode("utf-8")
operation with handling for UnicodeDecodeError and return a client-facing 400
response for invalid UTF-8 uploads.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 5684a457-a82c-4a40-8330-a3f7b3c4240c

📥 Commits

Reviewing files that changed from the base of the PR and between 4a33158 and f7d194e.

📒 Files selected for processing (2)

• backend/leads/tests.py
• backend/leads/views.py