Validation middleware consumes request body without restoring for downstream handlers

[coderabbitai]

Problem

The OpenAPI validation middleware in go/pkg/zen/middleware_openapi_validation.go calls validator.Validate() which consumes the request body (r.Body) without buffering or restoring it. This leaves downstream handlers with an exhausted stream (EOF) when they attempt to read the request body.

Impact

• Downstream handlers cannot access request body content
• API endpoints that need to parse request bodies will fail after validation
• Silent failures where handlers receive empty/EOF body streams

Context

This issue was identified during review of PR #3841 in comment: #3841 (comment)

The validation logic needs to be updated to:

1. Buffer the request body before validation
2. Restore the body for downstream handlers on both success and error paths
3. Ensure proper cleanup and memory management

References

• PR: feat: poc migrating from prefixed-api-key #3841
• Comment: feat: poc migrating from prefixed-api-key #3841 (comment)
• Requested by: @Flo4604

[linear]

ENG-2028 Validation middleware consumes request body without restoring for downstream handlers