fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/handlers/api/customer_handler.go

@@ -1,7 +1,13 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package api
 
 import (
+ "time"
+
 	"agent-desk/internal/pkg/config"
+ "agent-desk/internal/pkg/dto/response"
+ "agent-desk/internal/pkg/enums"
 	"agent-desk/internal/pkg/httpx"
 	"agent-desk/internal/pkg/openidentity"
 	"agent-desk/internal/services"
@@ -21,6 +27,7 @@ func CustomerPostSession_exchange(ctx *gin.Context) {
 		IdentityHMAC:   identity.Secret,
 		IdentityMaxAge: identity.MaxAge(),
 		ChannelID:      channel.ChannelID,
+		RequireSignedIdentity: services.ChannelService.RequiresSignedIdentity(channel),
 	})
 	if err != nil {
 		httpx.WriteJSON(ctx, err)
@@ -33,3 +40,21 @@ func CustomerPostSession_exchange(ctx *gin.Context) {
 	}
 	httpx.WriteJSON(ctx, resp)
 }
+
+// Refresh requires possession of the still-valid customer credential; unlike
+// unsigned session exchange it never creates or changes an anonymous identity.
+func CustomerPostSession_refresh(ctx *gin.Context) {
+ channel := services.ChannelService.GetEnabledChannel(ctx)
+ if channel == nil { httpx.WriteJSON(ctx, httpx.JsonErrorMsg(ctx, "error.e0209")); return }
+ result, err := services.CustomerSessionService.VerifyRequest(ctx, channel)
+ if err != nil { httpx.WriteJSON(ctx, err); return }
+ services.CustomerSessionService.SetRefreshHeaders(ctx, result)
+ source := "guest:"
+ if result.ExternalUser.ExternalSource == enums.ExternalSourceUser { source = "user:" }
+ httpx.WriteJSON(ctx, &response.CustomerSessionExchangeResponse{
+  CustomerSessionToken: result.Token,
+  ExpiresAt: result.ExpiresAt.UTC().Format(time.RFC3339),
+  IdentityKey: source + result.ExternalUser.ExternalID,
+  Customer: response.CustomerSessionCustomerResponse{ID: result.CustomerID, Name: result.ExternalUser.ExternalName},
+ })
+}