feat: Make the gzip size limits configurable

`maxDecompressedRequestBytes` moves the inflation ceiling off its 10 MiB
default, for services whose legitimate payloads are larger. It is capped
at Integer.MAX_VALUE because the inflated body is buffered into an array.

`minimumGzipResponseBytes` moves the compression threshold off its 1 KiB
default. Setting it to 0 compresses every compressible body; setting it
above any response this server produces turns compression off, which is
what a service behind a proxy that already terminates compression wants.

Author: thced

docs/plans/dynamic-discovering-piglet.md

@@ -278,7 +278,7 @@ as it completes.
 
 ### Task 4 — builder
 
-- [ ] **Step 9** `OpenApiServerBuilderTest` — `maxDecompressedRequestBytesRejectsZero`,
+- [x] **Step 9** `OpenApiServerBuilderTest` — `maxDecompressedRequestBytesRejectsZero`,
       `maxDecompressedRequestBytesRejectsNegative`, `minimumGzipResponseBytesRejectsNegative`.
       Then add the two setters, the `HandlerConfig` fields and the `build()` wiring.
 

src/main/java/com/retailsvc/http/OpenApiServer.java

@@ -65,7 +65,9 @@ record HandlerConfig(
       ExceptionHandler exceptionHandler,
       Map<String, RequestHandler> extras,
       boolean externalAuth,
-      List<AfterResponseHook> afterHooks) {}
+      List<AfterResponseHook> afterHooks,
+      long maxDecompressedRequestBytes,
+      long minimumGzipResponseBytes) {}
 
   OpenApiServer(
       List<SpecBinding> bindings,
@@ -93,9 +95,10 @@ record HandlerConfig(
     this.httpServer = createHttpServer(socketAddress, sslContext);
     httpServer.setExecutor(newThreadPerTaskExecutor(ofVirtual().name("http-", 0).factory()));
 
-    ResponseRenderer renderer = new ResponseRenderer(bodyMappers);
+    ResponseRenderer renderer =
+        new ResponseRenderer(bodyMappers, handlerConfig.minimumGzipResponseBytes());
     RequestBodyReader bodyReader =
-        new RequestBodyReader(RequestBodyReader.DEFAULT_MAX_DECOMPRESSED_BYTES);
+        new RequestBodyReader(handlerConfig.maxDecompressedRequestBytes());
     boolean anyBindingAtRoot =
         wireBindings(
             httpServer,
@@ -278,6 +281,8 @@ public static final class Builder {
     private final LinkedHashMap<String, RequestHandler> extras = new LinkedHashMap<>();
     private final Map<String, SchemeValidator> securityValidators = new LinkedHashMap<>();
     private boolean externalAuth = false;
+    private long maxDecompressedRequestBytes = RequestBodyReader.DEFAULT_MAX_DECOMPRESSED_BYTES;
+    private long minimumGzipResponseBytes = ResponseRenderer.DEFAULT_MINIMUM_GZIP_BYTES;
     private final List<SpecBinding> bindings = new ArrayList<>();
 
     private Builder() {}
@@ -427,6 +432,42 @@ public Builder https(Path certificateChainPem, Path privateKeyPem) {
      * stops immediately; positive values wait up to that many seconds for in-flight exchanges to
      * finish.
      */
+    /**
+     * Ceiling on the inflated size of a gzip request body, 10 MiB by default. A compressed payload
+     * can expand by orders of magnitude, so this bounds what a single request may allocate;
+     * exceeding it fails the request with 413. Bodies that arrive uncompressed are not affected.
+     */
+    public Builder maxDecompressedRequestBytes(long maxDecompressedRequestBytes) {
+      if (maxDecompressedRequestBytes <= 0) {
+        throw new IllegalArgumentException(
+            "maxDecompressedRequestBytes must be positive, got " + maxDecompressedRequestBytes);
+      }
+      if (maxDecompressedRequestBytes > Integer.MAX_VALUE) {
+        throw new IllegalArgumentException(
+            "maxDecompressedRequestBytes must not exceed "
+                + Integer.MAX_VALUE
+                + ", got "
+                + maxDecompressedRequestBytes);
+      }
+      this.maxDecompressedRequestBytes = maxDecompressedRequestBytes;
+      return this;
+    }
+
+    /**
+     * Smallest response body worth gzipping, 1 KiB by default. Below this, the coding costs more
+     * than it saves. Set it to 0 to compress every compressible body, or high enough to exceed any
+     * response this server produces to stop compressing altogether — useful when a proxy in front
+     * already terminates compression.
+     */
+    public Builder minimumGzipResponseBytes(long minimumGzipResponseBytes) {
+      if (minimumGzipResponseBytes < 0) {
+        throw new IllegalArgumentException(
+            "minimumGzipResponseBytes must be non-negative, got " + minimumGzipResponseBytes);
+      }
+      this.minimumGzipResponseBytes = minimumGzipResponseBytes;
+      return this;
+    }
+
     public Builder shutdownTimeoutSeconds(int shutdownTimeoutSeconds) {
       if (shutdownTimeoutSeconds < 0) {
         throw new IllegalArgumentException(
@@ -468,7 +509,9 @@ public OpenApiServer build() throws IOException {
               effectiveExceptionHandler,
               extras,
               externalAuth,
-              List.copyOf(afterHooks));
+              List.copyOf(afterHooks),
+              maxDecompressedRequestBytes,
+              minimumGzipResponseBytes);
       int resolvedPort = resolvePort();
       SSLContext sslContext =
           httpsCertChain != null ? PemSslContext.load(httpsCertChain, httpsPrivateKey) : null;

src/test/java/com/retailsvc/http/OpenApiServerBuilderTest.java

@@ -1,6 +1,7 @@
 package com.retailsvc.http;
 
 import static java.util.Collections.emptyMap;
+import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
 
@@ -49,6 +50,42 @@ void rejectsExtraPathEqualToSpecBasePathAtBuildTime() {
         .hasMessageContaining("/api");
   }
 
+  @Test
+  void rejectsNonPositiveMaxDecompressedRequestBytes() {
+    OpenApiServer.Builder b = OpenApiServer.builder();
+
+    assertThatThrownBy(() -> b.maxDecompressedRequestBytes(0))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("0");
+    assertThatThrownBy(() -> b.maxDecompressedRequestBytes(-1))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("-1");
+  }
+
+  @Test
+  void rejectsOversizedMaxDecompressedRequestBytes() {
+    OpenApiServer.Builder b = OpenApiServer.builder();
+
+    assertThatThrownBy(() -> b.maxDecompressedRequestBytes(Integer.MAX_VALUE + 1L))
+        .isInstanceOf(IllegalArgumentException.class);
+  }
+
+  @Test
+  void rejectsNegativeMinimumGzipResponseBytes() {
+    OpenApiServer.Builder b = OpenApiServer.builder();
+
+    assertThatThrownBy(() -> b.minimumGzipResponseBytes(-1))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("-1");
+  }
+
+  @Test
+  void acceptsContentCodingLimits() {
+    OpenApiServer.Builder b = OpenApiServer.builder();
+
+    assertThat(b.maxDecompressedRequestBytes(4096).minimumGzipResponseBytes(0)).isSameAs(b);
+  }
+
   @Test
   void rejectsNegativeShutdownTimeout() {
     OpenApiServer.Builder b = OpenApiServer.builder();