feat: add Sense identity RBAC and audit (#22)

Sense/server/internal/platform/http.go

@@ -3,6 +3,7 @@ package platform
 import (
 	"encoding/json"
 	"errors"
+	"io"
 	"net/http"
 )
 
@@ -30,10 +31,13 @@ func WriteError(w http.ResponseWriter, err error) {
 }
 
 func DecodeJSON(r *http.Request, target any) error {
-	decoder := json.NewDecoder(http.MaxBytesReader(nil, r.Body, 1<<20))
+	decoder := json.NewDecoder(io.LimitReader(r.Body, (1<<20)+1))
 	decoder.DisallowUnknownFields()
 	if err := decoder.Decode(target); err != nil {
 		return &APIError{Status: http.StatusBadRequest, Code: "invalid_request", Message: "请求内容格式不正确"}
 	}
+	if err := decoder.Decode(&struct{}{}); err != io.EOF {
+		return &APIError{Status: http.StatusBadRequest, Code: "invalid_request", Message: "请求内容格式不正确"}
+	}
 	return nil
 }