Migrate uploadPracticaImage from Server Action to Route Handler POST /api/practica-image — decouples image upload transport from the global serverActions.bodySizeLimit (which VENUS-incident raised to 12mb). Keeps SA cap tight (1MB) for all other actions while allowing the 10MB image path. Not needed for correctness (bytes already route to api-images); transport-hardening follow-up.

Sub-tickets

Questions

Activity

• wi-cli-venus created · 6w ago
• wi-cli-venus completed · 6w ago
  ported mars client-side image pipeline (new src/lib/image-client.ts: downscale ladder + canvas convert-to-JPEG + 400x400 floor + <20KB reject + 1.5MB/img cap), wired into image-upload-field before FormData; server ACCEPTED_INPUT_MIME tightened jpeg-only → closes VENUS-127's raw-webp→server-libwebp CVE surface on the routine path; kept Server Action (12mb limit), no route handler; client accept stays broad (png/webp/heic→jpg in browser). 63edb62 v0.77.13 Class-A audit PASS. Residual defense-in-depth (declared-MIME vs content magic-bytes) → VENUS-135