Bound UnifiedPush endpoint store load

[juanfradb]

Summary

• add a 2 MiB size gate before loading data/unifiedpush_endpoints.json
• start with an empty UnifiedPush endpoint map when the file is oversized
• keep valid endpoint files below the limit loading normally
• document the endpoint-store limit and startup policy

Security validation

Source/sink/control: data/unifiedpush_endpoints.json was read fully into memory with fs::read_to_string before any bound. load_endpoints now checks metadata length first and refuses oversized files before reading.

Original issue no longer reproduces:

• sparse 100 MB endpoint file returns Ok and leaves the endpoint store empty
• valid approximately 1 MB endpoint file loads normally

Refs #10

Tests

• cargo test unifiedpush -- --nocapture
• cargo test
• cargo fmt --check
• cargo clippy --all-targets -- -D warnings
• git diff --check

[coderabbitai]

Warning

Rate limit exceeded

@AndreaDiazCorreia has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 41 minutes and 4 seconds before requesting another review.

You’ve run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 53260a01-cc15-493e-8573-6321d513112e

📥 Commits

Reviewing files that changed from the base of the PR and between 893e7e1 and 2470127.

📒 Files selected for processing (2)

• docs/configuration.md
• src/push/unifiedpush.rs

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2470127192

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep writes under the new startup size cap

When normal UnifiedPush registrations serialize to more than 2 MiB, register_endpoint/save_endpoints still write the oversized JSON without any guard, but the next startup now takes this branch and clears the in-memory map instead of loading it. That means the service can create its own persistent state and then discard all registrations after a restart; please either enforce the same cap before saving or use a load limit that valid persisted data cannot exceed.

Useful? React with 👍 / 👎.

[AndreaDiazCorreia]

@coderabbitai review

[coderabbitai]

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[AndreaDiazCorreia]

Thanks for the fix. Codex's note is worth addressing before merging. load_endpoints rejects files over 2 MiB but save_endpoints and register_endpoint will write any size. Once the registration endpoint lands, we can write a file over 2 MiB, restart, and silently wipe every registration. That's the kind of thing the issue is trying to prevent.

Simplest fix is checking the serialized size in save_endpoints and refusing to write if it goes over the limit. If that feels out of scope, at least a comment on save_endpoints flagging the invariant plus a follow-up issue.

Also, the warn! on a stat failure other than NotFound should be error!, same as the oversize branch. And after we log the oversize error the file stays on disk, so every boot will hit it forever. Either rename it to .corrupt. or document that the operator has to clean it up.

Rest looks good.