Function readJSON

internal/agent/api.go:60–63

readJSON wraps the request body in a MaxBytesReader and decodes into dst. Use this for every JSON-decoding handler to bound memory and reject obviously oversized payloads early. We deliberately do not DisallowUnknownFields — adding it would break existing clients that send forward-compatible extra f

(w http.ResponseWriter, r *http.Request, dst any, maxBytes int64)

// send forward-compatible extra fields, and the SDKs publish typed
// requests so unknown-fields strictness adds little defense.
func readJSON(w http.ResponseWriter, r *http.Request, dst any, maxBytes int64) error {
	r.Body = http.MaxBytesReader(w, r.Body, maxBytes)
	return json.NewDecoder(r.Body).Decode(dst)
}

// normalizeEmail is the agent-package-local alias for identity.NormalizeEmail.
// Defined here as a one-line forwarder so the existing call sites in this