second pass. low

bincio/edit/server.py

@@ -554,10 +554,15 @@ async def upload_activity(file: UploadFile = File(...)) -> JSONResponse:
     if suffix not in _SUPPORTED_SUFFIXES:
         raise HTTPException(400, f"Unsupported file type '{Path(name).suffix}'. Expected FIT, GPX, or TCX.")
 
+    _MAX_UPLOAD_BYTES = 50 * 1024 * 1024  # 50 MB
+    contents = await file.read()
+    if len(contents) > _MAX_UPLOAD_BYTES:
+        raise HTTPException(413, f"File too large ({len(contents)} bytes). Maximum is 50 MB.")
+
     staging = dd / "_uploads"
     staging.mkdir(exist_ok=True)
     staged = staging / name
-    staged.write_bytes(await file.read())
+    staged.write_bytes(contents)
 
     try:
         from bincio.extract.metrics import compute
@@ -592,7 +597,7 @@ async def upload_activity(file: UploadFile = File(...)) -> JSONResponse:
     except HTTPException:
         raise
     except Exception as exc:
-        raise HTTPException(422, str(exc))
+        raise HTTPException(422, f"Failed to process activity file: {type(exc).__name__}")
     finally:
         staged.unlink(missing_ok=True)