feat(auth): add first-party acceptance harness

modules/identity/domain/session.go

@@ -23,7 +23,23 @@ func IssueCreatorSessionForBinding(secret []byte, actorID identity.ActorID, prin
 	if len(secret) < 32 || actorID == "" || principalID == "" || ttl <= 0 {
 		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
 	}
-	session := identity.CreatorSession{ActorID: actorID, PrincipalID: principalID, ExpiresAtUnix: now.Add(ttl).Unix()}
+	session := identity.CreatorSession{ActorID: actorID, PrincipalID: principalID, PrincipalKind: identity.PrincipalKindHuman, ExpiresAtUnix: now.Add(ttl).Unix()}
+	payload, err := json.Marshal(session)
+	if err != nil {
+		return "", identity.CreatorSession{}, err
+	}
+	encoded := base64.RawURLEncoding.EncodeToString(payload)
+	return encoded + "." + signature(secret, encoded), session, nil
+}
+
+func IssueServiceSession(secret []byte, principal identity.ServicePrincipal, now time.Time, ttl time.Duration) (string, identity.CreatorSession, error) {
+	if principal.Kind != identity.PrincipalKindService || !principal.Active || principal.ActorID == "" || principal.PrincipalID == "" || principal.Purpose == "" || ttl <= 0 {
+		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
+	}
+	if len(secret) < 32 {
+		return "", identity.CreatorSession{}, ErrInvalidCreatorSession
+	}
+	session := identity.CreatorSession{ActorID: principal.ActorID, PrincipalID: principal.PrincipalID, PrincipalKind: principal.Kind, ExpiresAtUnix: now.Add(ttl).Unix()}
 	payload, err := json.Marshal(session)
 	if err != nil {
 		return "", identity.CreatorSession{}, err
@@ -45,6 +61,9 @@ func ValidateCreatorSession(secret []byte, token string, now time.Time) (identit
 	if json.Unmarshal(payload, &session) != nil || session.ActorID == "" || session.PrincipalID == "" || now.Unix() >= session.ExpiresAtUnix {
 		return identity.CreatorSession{}, ErrInvalidCreatorSession
 	}
+	if session.PrincipalKind == "" {
+		session.PrincipalKind = identity.PrincipalKindHuman
+	}
 	return session, nil
 }
 

modules/identity/domain/session_test.go

@@ -0,0 +1,36 @@
+package domain
+
+import (
+	"bytes"
+	"testing"
+	"time"
+
+	"git.cin.su/m/Assistant/contracts/identity"
+)
+
+func TestServiceSessionIsDistinctFromHumanCreatorSession(t *testing.T) {
+	secret := bytes.Repeat([]byte{7}, 32)
+	principal := identity.ServicePrincipal{ActorID: "acceptance-actor", PrincipalID: "acceptance-principal", Kind: identity.PrincipalKindService, Purpose: "AUTHENTICATE_ACCEPTANCE_HARNESS", SyntheticScope: "synthetic-acceptance-scope", Active: true, Revision: 1}
+	token, issued, err := IssueServiceSession(secret, principal, time.Unix(100, 0), time.Minute)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if issued.PrincipalKind != identity.PrincipalKindService {
+		t.Fatalf("kind=%q", issued.PrincipalKind)
+	}
+	validated, err := ValidateCreatorSession(secret, token, time.Unix(101, 0))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if validated.PrincipalKind != identity.PrincipalKindService || validated.PrincipalID != principal.PrincipalID {
+		t.Fatalf("validated=%#v", validated)
+	}
+}
+
+func TestServiceSessionRejectsInactivePrincipal(t *testing.T) {
+	secret := bytes.Repeat([]byte{7}, 32)
+	_, _, err := IssueServiceSession(secret, identity.ServicePrincipal{ActorID: "a", PrincipalID: "p", Kind: identity.PrincipalKindService, Purpose: "test"}, time.Unix(100, 0), time.Minute)
+	if err == nil {
+		t.Fatal("inactive service principal was accepted")
+	}
+}