fix: harden identity, live access, drafts and setup (review only)

Source-reviewed hardening changes and regression tests. UNBUILT / UNTESTED: not a deployable release. Go formatting, compilation, automated regression tests, full frontend validation and staging acceptance remain required. See docs/hardening/VALIDATION.md. Main remains the original clean snapshot; no upstream Git history imported.

internal/pkg/openidentity/external_identity_test.go

@@ -1,3 +1,5 @@
+// Modified in the independent hardening fork; see docs/hardening.
+
 package openidentity
 
 import (
@@ -269,3 +271,25 @@ func flipLastChar(signature string) string {
 func itoa(value int64) string {
 	return strconv.FormatInt(value, 10)
 }
+
+func TestRequireSignedIdentityRejectsUnsignedAndInvalidSignatures(t *testing.T) {
+ for _, signature := range []string{"", "invalid"} {
+  ctx, _ := newIdentityContext(map[string]string{"X-External-Id": testUserID, "X-External-Id-Signature": signature})
+  if _, err := GetExternalUser(ctx, Secrets{ChannelID: testChannelID, IdentityHMAC: testSecret, RequireSignedIdentity: true}); err == nil { t.Fatal("signed-only policy accepted an unsigned or invalid identity") }
+ }
+ ctx, _ := newIdentityContext(signedIdentityHeaders(testSecret,testChannelID,testUserID,time.Now()))
+ user, err := GetExternalUser(ctx, Secrets{ChannelID:testChannelID,IdentityHMAC:testSecret,RequireSignedIdentity:true})
+ if err != nil || user.IdentityScope != IdentityScope(testChannelID,"hmac") { t.Fatal("valid signed identity did not retain its HMAC scope") }
+}
+
+func TestIdentityScopeSeparatesIssuersAndChannels(t *testing.T) {
+ seen := map[string]bool{}
+ for _, channel := range []string{"channel-one","channel-two"} {
+  for _, issuer := range []string{"guest","hmac","jwt"} {
+   scope := IdentityScope(channel,issuer)
+   if scope == "" || seen[scope] { t.Fatal("identity scopes collided") }
+   seen[scope] = true
+  }
+ }
+ if IdentityScope("", "hmac") != "" || IdentityScope("channel", "unknown") != "" { t.Fatal("invalid scope inputs accepted") }
+}