[mromaszewicz]

Summary

Adds runtime.BindJSONBody(r *http.Request, v any) error and runtime.BindJSONValue(value any, v any) error, for the strict net/http server template in oapi-codegen/oapi-codegen#2605.

Strict net/http servers decode a JSON request body a second time after the validation middleware has validated it. encoding/json matches member names case-insensitively, so {"role":"user","ROLE":"admin"} passes validation as role: user and reaches the handler as Role: "admin", bypassing the schema's constraints.

kin-openapi v0.151.0 added openapi3filter.Options.KeepValidatedValue, which leaves the decoded and validated value on r.Body behind a ValidatedValue() any method.

• BindJSONBody binds that value into the request struct when it is present, and otherwise (or when the value does not fit the destination) falls back to json.NewDecoder(r.Body).Decode(v), so error behaviour, including io.EOF for an empty body, is unchanged.
• BindJSONValue does the binding by reflection, following encoding/json's rules (struct tags, embedded struct promotion and dominance, json.Unmarshaler / encoding.TextUnmarshaler, base64 []byte, float64 for any, ,string), with one deliberate difference: member names are matched exactly. The destination is left untouched when binding fails.

No new dependencies; go.mod stays at Go 1.24.

Tests

• A table test binds the same documents through encoding/json and through BindJSONValue into a struct covering every field shape oapi-codegen generates (scalars, pointers, slices, arrays, maps with string and int keys, any, json.RawMessage, time.Time, types.Date, types.UUID, types.Email, nullable.Nullable, embedded structs, json:"-", ,string) and asserts identical results, including null handling.
• Error cases assert that both reject the same inputs and that the destination is untouched.
• BindJSONBody tests cover the validated path, the plain path, the fallback after a failed bind (body still readable) and io.EOF.
• Passes with both the Go 1.27 encoding/json (json/v2-backed) and GOEXPERIMENT=nojsonv2.

🤖 Generated with Claude Code

[mromaszewicz]

Consumed by oapi-codegen/oapi-codegen#2612, which switches the strict net/http template to runtime.BindJSONBody.