Validate and bound plugin settings requests

[Copilot]

The template accepted arbitrary JSON settings bodies and persisted unknown, nested, or oversized values. This adds bounded request handling and a strict schema for the template’s settings.

• Request limits

  • Stream request bodies with a 16 KiB cap before JSON decoding.
  • Reject invalid, negative, and oversized Content-Length values.

• Settings schema

  • Accept only color, intensity, and enable_animations.
  • Enforce supported colors, integer intensity 0–10, and boolean animation state.
  • Normalize legacy persisted settings to defaults when values are invalid or unknown.

• Client alignment

  • Submit enable_animations using the server key.
  • Serialize the range value as a number.

if len(body) + len(chunk) > MAX_SETTINGS_BODY_BYTES:
    return JSONResponse({"error": "request body too large"}, status_code=413)

if not all(_is_valid_setting(key, value) for key, value in incoming.items()):
    return JSONResponse(
        {"error": "body contains invalid setting values"}, status_code=400
    )

• Fixes Settings POST endpoint accepts unvalidated/unbounded JSON body #4

Greptile Summary

The PR bounds settings request bodies at 16 KiB and introduces strict validation for accepted and persisted values.

• Streams request bodies with both header-based and cumulative size checks.
• Restricts settings to the documented color, intensity, and animation schema.
• Aligns frontend keys and numeric serialization with the server contract.

Confidence Score: 5/5

The PR appears safe to merge with no concrete correctness or security failures identified.

The request-size limit remains enforced for bodies with or without a usable Content-Length header, persisted values are normalized as described, and the frontend now submits keys and types accepted by the backend.

Important Files Changed

Filename	Overview
my-plugin/routes.py	Adds bounded body streaming, strict request validation, and normalization of persisted settings without an identified actionable regression.
my-plugin/settings.html	Aligns the animation key and range-value type with the newly enforced backend schema.

_{Reviews (1): Last reviewed commit: "Sanitize invalid JSON errors" | Re-trigger Greptile}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@my-plugin/routes.py`:
- Around line 88-136: The async set_settings handler performs blocking
filesystem work directly; move every _read(), config_dir.mkdir(), and
config_file.write_text() invocation to asyncio.to_thread and await the results.
Preserve the existing bounded-body validation and settings-update behavior while
ensuring no synchronous filesystem operation runs on the event loop.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4b1a8352-e1a1-421c-9969-41141d74cbcd

📥 Commits

Reviewing files that changed from the base of the PR and between 2bdf294 and dcd94a0.

📒 Files selected for processing (2)

• my-plugin/routes.py
• my-plugin/settings.html