Does the AppView not currently enforce image blob size limits or accept types?

[snarfed]

Hi all! I recently implemented (well, finished) lexicon schema validation for stored/emitted records and XRPC method input, output, and params, and I've been seeing a trickle of surprising failures on data that the AppView is evidently ok with. One big one: it seems like image blobs are often allowed with types and sizes that don't satisfy maxSize or accept. Is this known?

A couple specific examples:

1. This post has an image embed blob (getBlob call) with size 1858016, which is larger than maxSize: 1000000on app.bsky.embed.images#image, but the AppView allowed it and it's visible on the post.
2. This profile has avatar (getBlob call) with mime_type: image/webp, which doesn't satisfy accept: [image/png, image/jpeg] on app.bsky.actor.profile, but the AppView allowed it and it's visible on the profile.

Totally ok if this is expected! I'm just trying to understand how to reconcile it with any lexicon schema validation I do on my end.

Thanks in advance!

(re: snarfed/bridgy-fed#1348, snarfed/bridgy-fed#1349 (comment))

[snarfed]

We're currently adding image processing in snarfed/granary#844 to get aspect ratios, and we'll probably use our own higher limit for images, maybe 5MB, since the appview still doesn't seem to enforce the lexicon's 1M limit.

[bnewbold]

Catching up on some old reports!

This one is quite interesting. I think the short answer is that the bsky appview implementation is not being strict enough here; these posts should be rejected.

cc: @devinivy @ericvolp12