Function decodeJSONWithLimit

internal/server/server.go:1839–1850

decodeJSONWithLimit is the size-configurable variant. Use this for endpoints that accept large payloads (e.g. bulk-import) where the default cap is too small — but always pass an explicit cap, never remove the wrapper.

(r *http.Request, v interface{}, maxBytes int64)

// default cap is too small — but always pass an explicit cap, never
// remove the wrapper.
func decodeJSONWithLimit(r *http.Request, v interface{}, maxBytes int64) error {
	// http.MaxBytesReader.Close() is a no-op; the decoder leaves r.Body at
	// EOF anyway. Setting this here also lets the server return a 413
	// automatically via the error we wrap below.
	if r.Body != nil {
		r.Body = http.MaxBytesReader(nil, r.Body, maxBytes)
	}
	if err := json.NewDecoder(r.Body).Decode(v); err != nil {
		return fmt.Errorf("invalid JSON: %w", err)
	}
	return nil
}

// getWorkspaceID resolves workspace slug/ID from the request.
// If RequireWorkspaceAccess already resolved the workspace, reads from context.