fix: add field validation to API request models (top_k limit, file_name pattern)

src/server/app.py

@@ -5,7 +5,7 @@ from pathlib import Path
 
 from fastapi import FastAPI, HTTPException, Depends, Request
 from fastapi.responses import RedirectResponse
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 from src.core.config import load_config, EmbedConfig, DEFAULT_CONFIG_PATH
 from src.core.db import VectorDB
@@ -31,12 +31,12 @@ def _is_safe_path(path_str: str) -> bool:
 class IngestRequest(BaseModel):
     file_path: str | None = None
     content: str | None = None
-    file_name: str | None = None
+    file_name: str | None = Field(default=None, max_length=255, pattern=r"^[^\\/:*?\"<>|]+\.md$")
 
 
 class SearchRequest(BaseModel):
-    query: str
-    top_k: int = 10
+    query: str = Field(..., min_length=1, max_length=2000)
+    top_k: int = Field(default=10, ge=1, le=100)
 
 
 # -- 懒加载单例 --