Batch endpoint item limits enforced

Batch endpoints that accept unbounded arrays are denial-of-service vectors dressed as productivity features. OWASP API Security Top 10 2023 API4 (Unrestricted Resource Consumption) and CWE-770 (Allocation of Resources Without Limits) both cover this class. A batch endpoint processing 10,000 items when your system is designed for 100 can exhaust connection pools, trigger N+1 database loads, and block the event loop. Unlike pagination, batch size is often not rate-limited because the request count stays low — an attacker sends one request per minute, each containing the maximum amount of work the server will perform. The same endpoint that handles 100 items correctly can be DoS-ed by requesting 100,000.

Validate array length before processing any batch operation. Reject oversized batches with a 400 rather than silently truncating — truncation hides the attack from monitoring.

// src/app/api/batch-send/route.ts
const batchSchema = z.object({
  recipients: z.array(
    z.object({ email: z.string().email(), name: z.string() })
  ).min(1).max(100)  // hard limit enforced by Zod schema
})

export async function POST(req: Request) {
  const parsed = batchSchema.safeParse(await req.json())
  if (!parsed.success) {
    return Response.json(
      { error: 'Batch size must be 1–100 items', detail: parsed.error.flatten() },
      { status: 400 }
    )
  }

  const results = await processBatch(parsed.data.recipients)
  return Response.json({ processed: results.length })
}