Bound remote control object reads

internal/app/remote_locks.go

@@ -5,7 +5,6 @@ import (
 	"context"
 	"errors"
 	"fmt"
-	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -23,7 +22,11 @@ type effectiveLocks struct {
 	Key    string
 }
 
-const remoteLockMutationAttempts = 4
+const (
+	remoteLockMutationAttempts = 4
+	// MaxRemoteLockStoreBytes bounds the mutable remote publish-lock document.
+	MaxRemoteLockStoreBytes int64 = 1 << 20
+)
 
 func remoteLocksKey(cfg *config.Config) (string, error) {
 	if cfg == nil || cfg.Pipeline == nil || cfg.Session == nil {
@@ -48,21 +51,20 @@ func loadRemoteLockStore(ctx context.Context, cfg *config.Config, store storage.
 	if store == nil {
 		return nil, key, "", fmt.Errorf("remote lock store is required")
 	}
-	info, body, err := store.Read(ctx, key)
+	info, data, err := storage.ReadObjectBounded(ctx, store, key, MaxRemoteLockStoreBytes)
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return &config.PublishLockStore{}, key, "", nil
 		}
+		var limitErr *storage.ReadLimitError
+		if errors.As(err, &limitErr) {
+			return nil, key, "", fmt.Errorf("read remote lock control object %q with %d-byte limit: %w", key, MaxRemoteLockStoreBytes, err)
+		}
 		return nil, key, "", fmt.Errorf("read remote locks %q: %w", key, err)
 	}
-	defer body.Close()
 	if strings.TrimSpace(info.ETag) == "" {
 		return nil, key, "", fmt.Errorf("read remote locks %q: object has no generation", key)
 	}
-	data, err := io.ReadAll(body)
-	if err != nil {
-		return nil, key, "", fmt.Errorf("read remote locks %q: %w", key, err)
-	}
 	lockStore, err := config.LoadPublishLockStoreBytes("s3://"+s3BucketName(cfg.Pipeline)+"/"+key, data, cfg.Pipeline.Scriptorium, cfg.Pipeline.Notarius)
 	if err != nil {
 		return nil, key, "", err