From 6b2ec70bd584de32df8775d4c01457cf68c35b5a Mon Sep 17 00:00:00 2001
From: Hermes Agent <blake62wf@gmail.com>
Date: Wed, 5 Aug 2026 14:11:14 -0700
Subject: [PATCH] fix: add API error handler helper + JSON body size limit

- Add apiError() helper for consistent error responses (#7)
- Apply error handling to GET/POST /users routes
- Add express.json body size limit (default 1mb) (#9)
- Configurable via MAX_BODY_SIZE env var
---
 apps/api/src/index.ts        |  6 ++++-
 apps/api/src/routes/users.ts | 43 ++++++++++++++++++++++++------------
 2 files changed, 34 insertions(+), 15 deletions(-)

diff --git a/apps/api/src/index.ts b/apps/api/src/index.ts
index 1648ba43fa..8cf92a01ea 100644
--- a/apps/api/src/index.ts
+++ b/apps/api/src/index.ts
@@ -5,7 +5,9 @@ import usersRouter from "./routes/users";
 const app = express();
 const port = process.env.PORT || 4000;
 
-app.use(express.json());
+// Conservative JSON body size limit to prevent resource exhaustion
+const MAX_BODY_SIZE = process.env.MAX_BODY_SIZE || "1mb";
+app.use(express.json({ limit: MAX_BODY_SIZE }));
 
 app.get("/health", (_req, res) => {
   res.json({ status: "ok", service: "taskflow-api" });
@@ -16,3 +18,5 @@ app.use("/users", usersRouter);
 app.listen(port, () => {
   console.log(`TaskFlow API listening on port ${port}`);
 });
+
+export default app;
diff --git a/apps/api/src/routes/users.ts b/apps/api/src/routes/users.ts
index 8d7f6d2ee4..b472556dd8 100644
--- a/apps/api/src/routes/users.ts
+++ b/apps/api/src/routes/users.ts
@@ -1,22 +1,37 @@
-import { Router } from "express";
+import { Router, Request, Response } from "express";
 
 const router = Router();
 
-router.get("/", (_req, res) => {
-  res.json({
-    data: [],
-    message: "User listing is not implemented yet."
-  });
+// Lightweight API error response helper
+function apiError(res: Response, message: string, status = 400): void {
+  res.status(status).json({ error: true, message });
+}
+
+router.get("/", (_req: Request, res: Response) => {
+  try {
+    res.json({
+      data: [],
+      message: "User listing is not implemented yet.",
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Internal server error";
+    apiError(res, message, 500);
+  }
 });
 
-router.post("/", (req, res) => {
-  res.status(201).json({
-    data: {
-      id: "stub-user-id",
-      ...req.body
-    },
-    message: "User creation is not implemented yet."
-  });
+router.post("/", (req: Request, res: Response) => {
+  try {
+    res.status(201).json({
+      data: {
+        id: "stub-user-id",
+        ...req.body,
+      },
+      message: "User creation is not implemented yet.",
+    });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Internal server error";
+    apiError(res, message, 500);
+  }
 });
 
 export default router;