fix: reject ambiguous queue JSON bodies

server/api/service.go

@@ -6,6 +6,7 @@ package api
 import (
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -169,6 +170,11 @@ func decodeBody(w http.ResponseWriter, r *http.Request, target any) bool {
 		writeError(w, http.StatusBadRequest, "invalid_request")
 		return false
 	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		writeError(w, http.StatusBadRequest, "invalid_request")
+		return false
+	}
 	return true
 }
 

server/api/service_test.go

@@ -99,4 +99,15 @@ func TestQueueAPIRejectsUnauthenticatedUnknownAndOversizedInput(t *testing.T) {
 		t.Fatalf("malformed body status = %d", response.StatusCode)
 	}
 	_ = response.Body.Close()
+	request, _ = http.NewRequest(http.MethodPost, server.URL+"/v1/queue", strings.NewReader(`{"ticket_id":"ticket-1"}{"ticket_id":"ticket-2"}`))
+	request.Header.Set("Authorization", "Bearer "+session.SessionID+":"+token)
+	request.Header.Set("Idempotency-Key", "create-key-789012")
+	response, err = http.DefaultClient.Do(request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.StatusCode != http.StatusBadRequest {
+		t.Fatalf("trailing JSON status = %d", response.StatusCode)
+	}
+	_ = response.Body.Close()
 }