fix: reject ambiguous queue JSON bodies

server/api/service.go

@@ -6,6 +6,7 @@ package api
 import (
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 	"strconv"
 	"strings"
@@ -169,6 +170,11 @@ func decodeBody(w http.ResponseWriter, r *http.Request, target any) bool {
 		writeError(w, http.StatusBadRequest, "invalid_request")
 		return false
 	}
+	var extra any
+	if err := decoder.Decode(&extra); err != io.EOF {
+		writeError(w, http.StatusBadRequest, "invalid_request")
+		return false
+	}
 	return true
 }