Bind service task HTTP input to authenticated caller before evaluation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

internal/taskexecution/identity.go

@@ -1,5 +1,6 @@
-// Package taskexecution contains proposed source-only identity input validation.
-// It is not registered with HTTP evaluation and grants no executable admission.
+// Package taskexecution contains task input validation, not policy evaluation.
+// The human component remains source-only. The B1 service HTTP path can emit
+// only signed DENY and grants no executable admission.
 package taskexecution
 
 import (

internal/taskexecution/service_input.go

@@ -1,20 +1,27 @@
 package taskexecution
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"github.com/netkingdom/access-engine/internal/callerauth"
 	"github.com/netkingdom/access-engine/pkg/api"
+	"io"
 	"time"
 )
 
 var ErrServiceInput = errors.New("service task execution input refused")
 
+const ServicePilotPackageID = "secrets-engine.task-execution.service-pilot"
+const ServicePilotPackageVersion = "v1"
+
 const ServicePilotMappingVersion = "proposed-service-task-caller/v1"
 const ServicePilotPrincipal = "system:serviceaccount:secrets-engine:secrets-engine"
 
-// ServicePilotInputs is source preparation only. It installs the explicit
+// ServicePilotInputs installs the exact B1 service input mapping for signed DENY.
+// It does not validate Approval facts or establish executable eligibility.
+// It installs the explicit
 // proposed fixed subject-to-transport mapping, never a request-selected mapping.
 // No constructor parameter can select warn/disabled mode or another subject.
 type ServicePilotInputs struct{ auth *callerauth.Authenticator }
@@ -47,6 +54,44 @@ func (s ServiceInput) Request() (api.CheckRequest, error) {
 }
 func (s ServiceInput) Caller() callerauth.Record { return s.caller }
 
+// RequestAt rechecks transport and operation lifetime at the runtime use site.
+// Request() remains a detached source snapshot, never an execution capability.
+func (s ServiceInput) RequestAt(now time.Time) (api.CheckRequest, error) {
+	r, err := s.Request()
+	if err != nil || now.IsZero() || s.caller.Audience != "flex-auth" || !s.caller.NotAfter.After(now) {
+		return api.CheckRequest{}, ErrServiceInput
+	}
+	contract, ok := r.Context["execution_contract"].(map[string]any)
+	if !ok {
+		return api.CheckRequest{}, ErrServiceInput
+	}
+	value, ok := contract["operation_deadline"].(string)
+	if !ok {
+		return api.CheckRequest{}, ErrServiceInput
+	}
+	deadline, err := time.Parse(time.RFC3339Nano, value)
+	if err != nil || !deadline.After(now) || deadline.After(s.caller.NotAfter) {
+		return api.CheckRequest{}, ErrServiceInput
+	}
+	return r, nil
+}
+
+// DecodeServiceRequest reuses the owner strict JSON scanner for this bounded
+// task-only route. It never changes producer canonicalization or legacy input.
+func DecodeServiceRequest(reader io.Reader) (api.CheckRequest, error) {
+	raw, err := io.ReadAll(io.LimitReader(reader, 524289))
+	var request api.CheckRequest
+	if err != nil || len(raw) > 524288 || strictObject(raw, &request) != nil {
+		return request, ErrServiceInput
+	}
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.DisallowUnknownFields()
+	if decoder.Decode(&request) != nil {
+		return api.CheckRequest{}, ErrServiceInput
+	}
+	return request, nil
+}
+
 // DeclaredServiceBinding is public immutable metadata to bind at approval issue.
 // It is not authentication evidence; Prepare independently verifies its principal.
 func DeclaredServiceBinding() map[string]any {

internal/taskexecution/service_input_test.go

@@ -1,7 +1,9 @@
 package taskexecution
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"github.com/netkingdom/access-engine/internal/callerauth"
 	"github.com/netkingdom/access-engine/pkg/api"
 	"testing"
@@ -79,3 +81,33 @@ func TestServicePilotRefusals(t *testing.T) {
 		t.Fatal("missing owner reviewer accepted")
 	}
 }
+
+func TestServiceInputRuntimeRecheckAndStrictHTTPDecode(t *testing.T) {
+	now := time.Now().UTC()
+	r := serviceRequest(t, now)
+	reviewer := &serviceReviewer{identity: callerauth.Identity{Username: ServicePilotPrincipal, Audiences: []string{"flex-auth"}, NotAfter: now.Add(120 * time.Second)}}
+	adapter, _ := NewServicePilotInputs(reviewer)
+	input, err := adapter.Prepare(context.Background(), "Bearer synthetic", r, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := input.RequestAt(now); err != nil {
+		t.Fatal(err)
+	}
+	for _, when := range []time.Time{time.Time{}, now.Add(60 * time.Second), now.Add(120 * time.Second)} {
+		if _, err := input.RequestAt(when); err == nil {
+			t.Fatal("stale/invalid runtime input accepted")
+		}
+	}
+	raw, _ := json.Marshal(r)
+	decoded, err := DecodeServiceRequest(bytes.NewReader(raw))
+	if err != nil || api.RequestDigest(decoded) != api.RequestDigest(r) {
+		t.Fatal("valid decode changed canonical submitted input")
+	}
+	bad := [][]byte{append(append([]byte{}, raw...), []byte(" {}")...), []byte(`{"action":"execute-ccr","action":"apply"}`), []byte(`{"context":{"human_control":true,"human_control":false}}`), []byte(`{"unknown_task_flag":true}`), bytes.Repeat([]byte(" "), 524289)}
+	for _, body := range bad {
+		if _, err := DecodeServiceRequest(bytes.NewReader(body)); err == nil {
+			t.Fatal("malformed/oversized task request accepted")
+		}
+	}
+}