From 34d258b39464a6bc2d323a6503bb87f98c45adef Mon Sep 17 00:00:00 2001
From: Raushankumar0720 <raushan.singh.cg@gmail.com>
Date: Wed, 23 Sep 2026 15:52:21 +0530
Subject: [PATCH] fix(live): return 502 and prevent caching on oversized track
 responses (fixes #720)

---
 server/providers/aircraft/tracks.js |  8 ++++--
 src/tooling/liveProviders.test.mjs  | 38 +++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 2 deletions(-)

diff --git a/server/providers/aircraft/tracks.js b/server/providers/aircraft/tracks.js
index 7d9501628..d9f2a36d5 100644
--- a/server/providers/aircraft/tracks.js
+++ b/server/providers/aircraft/tracks.js
@@ -45,7 +45,9 @@ export function trackBackfillProxies() {
       RESPONSE_CAP_BYTES,
     );
     let body;
+    let status = upstream.status;
     if (tooLarge) {
+      status = 502;
       body = JSON.stringify({ error: 'Upstream track response too large' });
     } else if (!upstream.ok) {
       // Sanitize upstream error surface; status code is signal enough
@@ -53,8 +55,10 @@ export function trackBackfillProxies() {
     } else {
       body = text;
     }
-    cachePut(key, { at: Date.now(), status: upstream.status, body });
-    res.statusCode = upstream.status;
+    if (!tooLarge) {
+      cachePut(key, { at: Date.now(), status, body });
+    }
+    res.statusCode = status;
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
     res.setHeader('Cache-Control', 'no-store');
     res.end(body);
diff --git a/src/tooling/liveProviders.test.mjs b/src/tooling/liveProviders.test.mjs
index 250924b42..de8681490 100644
--- a/src/tooling/liveProviders.test.mjs
+++ b/src/tooling/liveProviders.test.mjs
@@ -353,3 +353,41 @@ test('military cooldown bounds untrusted Retry-After and defaults server errors'
     assert.equal(Number(result.headers['retry-after']), seconds);
   }
 });
+
+test('track backfill proxy returns 502 and skips cache when upstream response exceeds body cap', async (t) => {
+  const tracks = install(providers.trackBackfillProxies(), true);
+  let callCount = 0;
+  t.mock.method(globalThis, 'fetch', async () => {
+    callCount++;
+    if (callCount === 1) {
+      return {
+        ok: true,
+        status: 200,
+        headers: new Map(),
+        body: (async function* () {
+          yield Buffer.alloc(6 * 1024 * 1024, 'x');
+        })(),
+      };
+    }
+    return {
+      ok: true,
+      status: 200,
+      headers: new Map(),
+      body: (async function* () {
+        yield Buffer.from(JSON.stringify({ path: [] }));
+      })(),
+    };
+  });
+
+  const res1 = await tracks('/api/opensky-track', '?icao24=def456');
+  assert.equal(res1.statusCode, 502);
+  assert.deepEqual(JSON.parse(res1.body), {
+    error: 'Upstream track response too large',
+  });
+
+  // Verify failure was NOT cached: second request invokes upstream again and succeeds
+  const res2 = await tracks('/api/opensky-track', '?icao24=def456');
+  assert.equal(res2.statusCode, 200);
+  assert.deepEqual(JSON.parse(res2.body), { path: [] });
+  assert.equal(callCount, 2);
+});