Fix : Add file size validation for CSV import endpoint

backend/leads/tests.py

@@ -1,6 +1,7 @@
 from django.core.files.uploadedfile import SimpleUploadedFile
 from rest_framework import status
 from rest_framework.test import APITestCase
+from django.urls import reverse
 
 from leads.models import BlockedDomain, Lead, Tag, LeadTag, LeadImportJob
 from leads.tasks import import_leads_from_csv
@@ -225,6 +226,27 @@ def test_blocked_domain_list_is_scoped_to_current_organization(self):
         domains = {item['domain'] for item in response.data}
         self.assertEqual(domains, {'orga.test'})
 
+    def test_import_csv_rejects_oversized_file(self):
+        self.client.force_authenticate(self.user_a)
+
+        large_file = SimpleUploadedFile(
+            "large.csv", b"x" * (10 * 1024 * 1024 + 1),
+            content_type="text/csv",
+            )
+        url = reverse("leads-import-csv")
+        response = self.client.post(url,
+         {"file":large_file},
+         format="multipart",
+         )
+
+        self.assertEqual(response.status_code, status.HTTP_400_BAD_REQUEST)
+        self.assertEqual(response.data["error"], "CSV file exceeds the 10 MB limit.")
+
+        self.assertEqual(   
+            LeadImportJob.objects.filter(organization=self.org_a).count(),
+            0,
+        )
+
     def test_import_history_endpoint_is_scoped_and_paginated(self):
         LeadImportJob.objects.create(
             organization=self.org_a,
@@ -252,6 +274,8 @@ def test_import_history_endpoint_is_scoped_and_paginated(self):
         self.assertEqual(response.data['results'][0]['filename'], 'orga.csv')
 
 
+
+
 # ── New tests for Issue #244 ───────────────────────────────────────────────────
 
 class TagColorTests(APITestCase):

backend/leads/views.py

@@ -4,6 +4,9 @@
 from rest_framework.decorators import action
 from rest_framework.response import Response
 from users.permissions import IsOrgManager
+# Maximum allowed CSV upload size (10 MB)
+MAX_CSV_UPLOAD_SIZE = 10 * 1024 * 1024
+
 from .models import BlockedDomain, Lead, LeadImportJob, Tag, LeadTag
 from .serializers import BlockedDomainSerializer, LeadImportJobSerializer, LeadSerializer, TagSerializer
 
@@ -97,6 +100,10 @@ def import_csv(self, request):
         if not file_obj:
             return Response({"error": "No file provided"}, status=status.HTTP_400_BAD_REQUEST)
 
+        if file_obj.size > MAX_CSV_UPLOAD_SIZE:
+            return Response(
+                {"error": "CSV file exceeds the 10 MB limit."},status=status.HTTP_400_BAD_REQUEST,
+            )
         job = LeadImportJob.objects.create(
             organization=request.user.organization,
             filename=file_obj.name or 'lead-import.csv',