Bind service task HTTP input to authenticated caller before evaluation

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

internal/taskexecution/service_input_test.go

@@ -1,7 +1,9 @@
 package taskexecution
 
 import (
+	"bytes"
 	"context"
+	"encoding/json"
 	"github.com/netkingdom/access-engine/internal/callerauth"
 	"github.com/netkingdom/access-engine/pkg/api"
 	"testing"
@@ -79,3 +81,33 @@ func TestServicePilotRefusals(t *testing.T) {
 		t.Fatal("missing owner reviewer accepted")
 	}
 }
+
+func TestServiceInputRuntimeRecheckAndStrictHTTPDecode(t *testing.T) {
+	now := time.Now().UTC()
+	r := serviceRequest(t, now)
+	reviewer := &serviceReviewer{identity: callerauth.Identity{Username: ServicePilotPrincipal, Audiences: []string{"flex-auth"}, NotAfter: now.Add(120 * time.Second)}}
+	adapter, _ := NewServicePilotInputs(reviewer)
+	input, err := adapter.Prepare(context.Background(), "Bearer synthetic", r, now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := input.RequestAt(now); err != nil {
+		t.Fatal(err)
+	}
+	for _, when := range []time.Time{time.Time{}, now.Add(60 * time.Second), now.Add(120 * time.Second)} {
+		if _, err := input.RequestAt(when); err == nil {
+			t.Fatal("stale/invalid runtime input accepted")
+		}
+	}
+	raw, _ := json.Marshal(r)
+	decoded, err := DecodeServiceRequest(bytes.NewReader(raw))
+	if err != nil || api.RequestDigest(decoded) != api.RequestDigest(r) {
+		t.Fatal("valid decode changed canonical submitted input")
+	}
+	bad := [][]byte{append(append([]byte{}, raw...), []byte(" {}")...), []byte(`{"action":"execute-ccr","action":"apply"}`), []byte(`{"context":{"human_control":true,"human_control":false}}`), []byte(`{"unknown_task_flag":true}`), bytes.Repeat([]byte(" "), 524289)}
+	for _, body := range bad {
+		if _, err := DecodeServiceRequest(bytes.NewReader(body)); err == nil {
+			t.Fatal("malformed/oversized task request accepted")
+		}
+	}
+}