upload files without API-Key

app/infrastructure/settings.py

@@ -163,6 +163,22 @@ BATCH_QUEUE_MAX = int(os.getenv("BATCH_QUEUE_MAX", "4"))
 # resource it has.
 BATCH_RETENTION_DAYS = int(os.getenv("BATCH_RETENTION_DAYS", "7"))
 
+# --- Review inbox ----------------------------------------------------------
+# POST /api/uploads/catalog accepts files with NO credential, so that colleagues
+# can send spreadsheets without one being issued to them. Nothing it accepts is
+# queued - files wait in the admin review inbox - which removes BATCH_QUEUE_MAX
+# as the bound on that endpoint and leaves the volume as the only thing an
+# anonymous sender can exhaust. These are that bound; past either, the endpoint
+# answers 429 and stages nothing.
+#
+# Both count only files still AWAITING review. Starting or dismissing a drop
+# releases its share immediately, and BATCH_RETENTION_DAYS reclaims whatever
+# nobody ever looks at.
+INBOX_MAX_PENDING_FILES = int(os.getenv("INBOX_MAX_PENDING_FILES", "200"))
+INBOX_MAX_PENDING_BYTES = int(
+    os.getenv("INBOX_MAX_PENDING_BYTES", str(200 * 1024 * 1024))
+)
+
 # Deliberately false. A batch interrupted by a restart is marked "interrupted"
 # and waits for someone to press Resume. Auto-resuming would mean a container
 # stuck in a restart loop re-runs the heaviest work in the app on every boot,