fix(app): harden account and workflow state

tools/summarizer/app.py

@@ -1096,7 +1096,13 @@ def _extract_plain_text(data: bytes) -> str:
 async def extract_text(file: UploadFile = File(...)):
     filename = file.filename or "document"
     extension = "." + filename.rsplit(".", 1)[1].lower() if "." in filename else ""
-    data = await file.read()
+    data = bytearray()
+    while len(data) <= MAX_EXTRACT_FILE_BYTES:
+        chunk = await file.read(min(64 * 1024, MAX_EXTRACT_FILE_BYTES - len(data) + 1))
+        if not chunk:
+            break
+        data.extend(chunk)
+    data = bytes(data)
     if not data:
         raise HTTPException(status_code=400, detail="The uploaded file was empty.")
     if len(data) > MAX_EXTRACT_FILE_BYTES:

tools/summarizer/tests/test_app.py

@@ -510,6 +510,18 @@ def test_health_stays_open_so_probes_and_healthchecks_work(monkeypatch):
     assert client.get("/health").status_code == 200
 
 
+def test_extract_text_rejects_oversized_upload_before_parsing(monkeypatch):
+    module = load_app_module(monkeypatch)
+    monkeypatch.setattr(module, "MAX_EXTRACT_FILE_BYTES", 32)
+    monkeypatch.setattr(module, "_extract_plain_text", lambda data: (_ for _ in ()).throw(AssertionError("parser must not run")))
+    client = TestClient(module.app)
+
+    response = client.post("/extract-text", files={"file": ("large.txt", b"x" * 64, "text/plain")})
+
+    assert response.status_code == 400
+    assert "too large" in response.json()["detail"].lower()
+
+
 def test_cache_purge_requires_service_token_and_clears_content(monkeypatch):
     module = load_app_module(monkeypatch, service_token="s3cret")
     module.cache["synthetic-key"] = "synthetic-summary"