environmentd: make webhook request size limit configurable via dyncfg

[sjwiesman]

Motivation

Webhook source requests are hardcoded to a 5 MiB body size limit, enforced globally for all environmentd HTTP routes by an Axum DefaultBodyLimit layer (src/environmentd/src/http.rs). Operators have no way to raise it for webhook sources that legitimately need to accept larger payloads.

What this does

Introduces the webhook_max_request_size dyncfg (default 5 MiB) that bounds the size of a webhook request body, read live on every request. Other HTTP routes (SQL API, WebSocket, etc.) keep the existing 5 MiB MAX_REQUEST_SIZE. Oversized requests are rejected with 413 Payload Too Large.

Reading the limit cheaply

The webhook handler is deliberately coordinator-free in steady state (it caches the appender via WebhookAppenderCache), so reading the limit must not add a coordinator round-trip. Rather than get_system_vars().await (which sends a command to the coordinator and awaits a reply), the handler reads a clone of the process-wide live ConfigSet carried on the shared PersistClientCache. Cloning a ConfigSet shares its inner atomics, so reads are O(1) atomic loads that reflect runtime updates. The storage controller already applies the full set of dyncfg updates to that ConfigSet via apply_from, and catalog_config.persist_clients / controller.persist_clients are the same Arc<PersistClientCache>, so updates are visible to the webhook's clone.

Enforcement

The handler's body extractor switches from Bytes (which silently inherits the global DefaultBodyLimit) to axum::body::Body, collected via to_bytes(body, limit). Because the handler runs inside the request-decompression layer, the limit applies to the decompressed body, preserving today's decompression-bomb protection. A from_fn middleware would have been forced outside decompression by Axum's body-type plumbing (limiting only the compressed wire size), which is why enforcement lives in the handler.

Testing

Adds a case to test/testdrive/webhook.td that shrinks the limit and confirms a larger body is rejected with 413, then raises the limit and confirms the same body is accepted without a restart — proving the dyncfg is read live per request.

Release note

This release will allow the maximum webhook request body size to be configured at runtime via the webhook_max_request_size system parameter.

🤖 Generated with Claude Code