From 77c01dc531899b9ccc5d31eda93d89fbf28c799a Mon Sep 17 00:00:00 2001
From: Josh Creek <8179928+jcreek@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:13:47 +0100
Subject: [PATCH] fix: reject ambiguous queue JSON bodies

---
 server/api/service.go      |  6 ++++++
 server/api/service_test.go | 11 +++++++++++
 2 files changed, 17 insertions(+)

diff --git a/server/api/service.go b/server/api/service.go
index f3dac66b..413a6c36 100644
--- a/server/api/service.go
+++ b/server/api/service.go
@@ -6,6 +6,7 @@ package api
 import (
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -169,6 +170,11 @@ func decodeBody(w http.ResponseWriter, r *http.Request, target any) bool {
 		writeError(w, http.StatusBadRequest, "invalid_request")
 		return false
 	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		writeError(w, http.StatusBadRequest, "invalid_request")
+		return false
+	}
 	return true
 }
 
diff --git a/server/api/service_test.go b/server/api/service_test.go
index 65e01df4..a59bb7c5 100644
--- a/server/api/service_test.go
+++ b/server/api/service_test.go
@@ -99,4 +99,15 @@ func TestQueueAPIRejectsUnauthenticatedUnknownAndOversizedInput(t *testing.T) {
 		t.Fatalf("malformed body status = %d", response.StatusCode)
 	}
 	_ = response.Body.Close()
+	request, _ = http.NewRequest(http.MethodPost, server.URL+"/v1/queue", strings.NewReader(`{"ticket_id":"ticket-1"}{"ticket_id":"ticket-2"}`))
+	request.Header.Set("Authorization", "Bearer "+session.SessionID+":"+token)
+	request.Header.Set("Idempotency-Key", "create-key-789012")
+	response, err = http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != http.StatusBadRequest {
+		t.Fatalf("trailing JSON status = %d", response.StatusCode)
+	}
+	_ = response.Body.Close()
 }