From babff260a115a05d8186531beb0b5fd9385dfad9 Mon Sep 17 00:00:00 2001
From: rafa <rcalvotorrejon@gmail.com>
Date: Mon, 31 Aug 2026 07:32:23 -0400
Subject: [PATCH] fix: cap TTS audio uploads at 25 MiB

---
 mu-plugins/fea-subir-audio-api.php        | 4 ++--
 tests/integration/test_subir_audio_api.sh | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/mu-plugins/fea-subir-audio-api.php b/mu-plugins/fea-subir-audio-api.php
index fa7d24b..e813cc6 100644
--- a/mu-plugins/fea-subir-audio-api.php
+++ b/mu-plugins/fea-subir-audio-api.php
@@ -12,7 +12,7 @@
 
 if (!defined('ABSPATH')) exit;
 
-const FEA_AUDIO_MAX_BYTES = 268435456; // 256 MiB: admite cartas largas.
+const FEA_AUDIO_MAX_BYTES = 26214400; // 25 MiB: límite operativo de producción.
 
 add_action('rest_api_init', function () {
     register_rest_route('fea/v1', '/subir-audio', [
@@ -160,7 +160,7 @@ function fea_subir_audio_validate_file($file) {
     if ((int) $file['size'] <= 0 || (int) $file['size'] > FEA_AUDIO_MAX_BYTES) {
         return new WP_Error(
             'fea_subir_audio_file_too_large',
-            'El audio debe ocupar entre 1 byte y 256 MiB.',
+            'El audio debe ocupar entre 1 byte y 25 MiB.',
             ['status' => 400]
         );
     }
diff --git a/tests/integration/test_subir_audio_api.sh b/tests/integration/test_subir_audio_api.sh
index 2973a36..55fe348 100755
--- a/tests/integration/test_subir_audio_api.sh
+++ b/tests/integration/test_subir_audio_api.sh
@@ -15,6 +15,9 @@ trap 'rm -rf "$tmpdir"' EXIT
 printf '\377\373\220\144' > "$tmpdir/audio.mp3"
 dd if=/dev/zero bs=1 count=413 >> "$tmpdir/audio.mp3" 2>/dev/null
 printf 'no es un mp3' > "$tmpdir/not-audio.txt"
+# Un byte por encima del límite de aplicación de 25 MiB. Se comprueba antes
+# del tipo de fichero, por lo que puede ser disperso y no necesita ser audio.
+truncate -s 26214401 "$tmpdir/too-large.mp3"
 
 assert_status() {
   local expected="$1" actual="$2" label="$3" response_file="$4"
@@ -34,6 +37,9 @@ assert_status 400 "$status" 'falta post_id' "$tmpdir/no-post.json"
 status="$(curl -sS -o "$tmpdir/no-audio.json" -w '%{http_code}' -u "$FEA_TEST_AUTH" -F "post_id=$FEA_TEST_POST_ID" "$endpoint")"
 assert_status 400 "$status" 'falta audio' "$tmpdir/no-audio.json"
 
+status="$(curl -sS -o "$tmpdir/too-large.json" -w '%{http_code}' -u "$FEA_TEST_AUTH" -F "post_id=$FEA_TEST_POST_ID" -F "audio=@$tmpdir/too-large.mp3;type=audio/mpeg" "$endpoint")"
+assert_status 400 "$status" 'audio por encima de 25 MiB' "$tmpdir/too-large.json"
+
 status="$(curl -sS -o "$tmpdir/wrong-type.json" -w '%{http_code}' -u "$FEA_TEST_AUTH" -F "post_id=$FEA_TEST_POST_ID" -F "audio=@$tmpdir/not-audio.txt;type=text/plain" "$endpoint")"
 assert_status 400 "$status" 'extensión o mime no MP3' "$tmpdir/wrong-type.json"