fix(auth): harden Windows storage bridge

tools/tht/internal/authstorage/storage.go

@@ -3,6 +3,7 @@
 package authstorage
 
 import (
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
@@ -60,7 +61,11 @@ func Run(ctx context.Context, args []string, stdin io.Reader, stdout, stderr io.
 	if err := ctx.Err(); err != nil {
 		return fail(stderr)
 	}
-	decoder := json.NewDecoder(io.LimitReader(stdin, maximumProtocolBytes+1))
+	payload, err := io.ReadAll(io.LimitReader(stdin, maximumProtocolBytes+1))
+	if err != nil || len(payload) > maximumProtocolBytes {
+		return fail(stderr)
+	}
+	decoder := json.NewDecoder(bytes.NewReader(payload))
 	decoder.DisallowUnknownFields()
 	var input request
 	if err := decoder.Decode(&input); err != nil {
@@ -229,7 +234,7 @@ func createPrivate(directory, filename string, contents []byte) (bool, error) {
 	} else if !errors.Is(err, os.ErrNotExist) {
 		return false, errInvalid
 	}
-	if err := safeio.WriteCanonicalNewFile(path, contents, 0o600); err == nil {
+	if err := safeio.WriteCanonicalNewPrivateFile(path, contents, 0o600); err == nil {
 		return true, nil
 	}
 	if safeio.ValidatePrivateRegular(path) == nil {