limits

func BoundedReader ¶

func BoundedReader(r io.Reader, max int) io.Reader

BoundedReader wraps r so that at most max bytes can be read through it. A source that ends at or before max bytes reads normally (EOF as usual). If the source yields more than max bytes, a Read that would cross the boundary first returns the allowed remainder with a nil error; the following Read returns (0, *OverLimitError). The error is sticky: every subsequent Read returns it again.

max <= 0 is a programmer error and panics; use a positive bound.

func CheckJSONDepth ¶

func CheckJSONDepth(raw []byte, maxDepth int) error

CheckJSONDepth reports *OverLimitError if raw's JSON nesting depth (objects plus arrays) exceeds maxDepth. Depth of `{}` or `[]` is 1; a bare scalar is 0. Brackets inside strings (including after escaped quotes and escaped backslashes) do not count. The scan is a single O(1)-space byte pass — no unmarshalling, no allocation proportional to input size.

maxDepth <= 0 is not "unbounded": it rejects any input containing a container (the first `{` or `[` takes depth to 1, already over the bound), while bare scalars — depth 0 — still pass. Callers wanting to admit containers must pass a positive bound.

Validity is not this function's concern: malformed JSON never panics and is judged only by the bracket depth it exhibits (fail-closed: unmatched closers never reduce depth below zero, so stray opens still count).

func TruncateText ¶

func TruncateText(s string, max int) (string, bool)

TruncateText bounds s to at most max bytes, cutting at a rune boundary and appending TruncationMarker within the budget when truncation occurs. When max <= len(TruncationMarker) there is no room for the marker, so the result is a marker-less hard cut, still at a rune boundary. The result is valid UTF-8 whenever s is. It returns the (possibly truncated) string and whether truncation happened. max < 0 is treated as 0.