@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/common/internalservice/resolver_test.go

@@ -0,0 +1,42 @@
+package internalservice
+
+import (
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"{{module}}/pkg/apierror"
+)
+
+func TestReferenceResolverResolvesEnvironmentAndFileReferences(t *testing.T) {
+	const environmentName = "ONEX_TEST_INTERNAL_SERVICE_CREDENTIAL"
+	t.Setenv(environmentName, "iamk_ck_environment.secret")
+	resolver := NewReferenceResolver()
+
+	fromEnvironment, err := resolver.ResolveSecret(context.Background(), "env://"+environmentName)
+	require.NoError(t, err)
+	require.Equal(t, "iamk_ck_environment.secret", fromEnvironment)
+
+	directory := t.TempDir()
+	path := filepath.Join(directory, "internal-service.credential")
+	require.NoError(t, os.WriteFile(path, []byte("iamk_ck_file.secret\n"), 0o600))
+	fromFile, err := resolver.ResolveSecret(context.Background(), "file://"+path)
+	require.NoError(t, err)
+	require.Equal(t, "iamk_ck_file.secret", fromFile)
+}
+
+func TestReferenceResolverRejectsUnsupportedReference(t *testing.T) {
+	_, err := NewReferenceResolver().ResolveSecret(context.Background(), "vault://secret/internal-service")
+	var apiErr *apierror.APIError
+	require.ErrorAs(t, err, &apiErr)
+	require.Equal(t, "Internal service credential reference scheme is not supported", apiErr.Detail.Message)
+}
+
+func TestReferenceResolverReturnsEmptyMissingEnvironmentSecret(t *testing.T) {
+	value, err := NewReferenceResolver().ResolveSecret(context.Background(), "env://ONEX_TEST_MISSING_CREDENTIAL")
+	require.NoError(t, err)
+	require.Empty(t, value)
+}

package/dist/resources/templates/go-backend/internal/common/internalservice/route_scope.go

@@ -0,0 +1,95 @@
+package internalservice
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var routeScopeParameterNamePattern = regexp.MustCompile(`^[A-Za-z][A-Za-z0-9_]*$`)
+var routeScopeStaticSegmentPattern = regexp.MustCompile(`^[A-Za-z0-9._~-]+$`)
+
+// CanonicalRouteScope 将 HTTP 方法与注册路由模板投影为持久化和令牌共用的 scope。
+func CanonicalRouteScope(httpMethod string, routeTemplate string) (string, error) {
+	method := strings.TrimSpace(httpMethod)
+	if method != httpMethod || method != strings.ToUpper(method) || !isRouteScopeHTTPMethod(method) {
+		return "", fmt.Errorf("service route scope method is invalid")
+	}
+	route := strings.TrimSpace(routeTemplate)
+	if route != routeTemplate || route == "" || strings.Contains(route, "//") {
+		return "", fmt.Errorf("service route scope template is invalid")
+	}
+	if strings.HasPrefix(route, "/") {
+		route = strings.TrimPrefix(route, "/internal/v1/")
+		route = strings.TrimPrefix(route, "/")
+	}
+	if route == "" || route == "internal/v1" || strings.HasPrefix(route, "internal/v1/") {
+		return "", fmt.Errorf("service route scope template is invalid")
+	}
+	segments := strings.Split(route, "/")
+	for index, segment := range segments {
+		if segment == "" {
+			return "", fmt.Errorf("service route scope template is invalid")
+		}
+		if strings.HasPrefix(segment, ":") {
+			name := strings.TrimPrefix(segment, ":")
+			if !routeScopeParameterNamePattern.MatchString(name) {
+				return "", fmt.Errorf("service route scope parameter is invalid")
+			}
+			segments[index] = ":" + name
+			continue
+		}
+		if strings.HasPrefix(segment, "{") || strings.HasSuffix(segment, "}") {
+			if len(segment) < 3 || segment[0] != '{' || segment[len(segment)-1] != '}' ||
+				!routeScopeParameterNamePattern.MatchString(segment[1:len(segment)-1]) {
+				return "", fmt.Errorf("service route scope parameter is invalid")
+			}
+			segments[index] = ":" + segment[1:len(segment)-1]
+			continue
+		}
+		if segment == "." || segment == ".." || !routeScopeStaticSegmentPattern.MatchString(segment) {
+			return "", fmt.Errorf("service route scope segment is invalid")
+		}
+	}
+	return method + " " + strings.Join(segments, "/"), nil
+}
+
+// IsCanonicalRouteScope 校验持久化 scope 已去除协议前缀并使用 Gin 参数模板。
+func IsCanonicalRouteScope(scope string) bool {
+	trimmed := strings.TrimSpace(scope)
+	if trimmed != scope {
+		return false
+	}
+	parts := strings.Fields(trimmed)
+	if len(parts) != 2 {
+		return false
+	}
+	if strings.HasPrefix(parts[1], "/") || strings.Contains(parts[1], "{") || strings.Contains(parts[1], "}") {
+		return false
+	}
+	canonical, err := CanonicalRouteScope(parts[0], parts[1])
+	return err == nil && canonical == trimmed
+}
+
+// RouteScopeMatches 将 Gin FullPath 投影后与持久化 canonical scope 精确比较。
+func RouteScopeMatches(httpMethod string, routeTemplate string, allowedScopes []string) bool {
+	requestScope, err := CanonicalRouteScope(httpMethod, routeTemplate)
+	if err != nil {
+		return false
+	}
+	for _, allowedScope := range allowedScopes {
+		if IsCanonicalRouteScope(allowedScope) && allowedScope == requestScope {
+			return true
+		}
+	}
+	return false
+}
+
+func isRouteScopeHTTPMethod(value string) bool {
+	switch value {
+	case "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD":
+		return true
+	default:
+		return false
+	}
+}

package/dist/resources/templates/go-backend/internal/common/internalservice/route_scope_test.go

@@ -0,0 +1,78 @@
+package internalservice
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestCanonicalRouteScopeProjectsGinParameters(t *testing.T) {
+	canonical, err := CanonicalRouteScope(http.MethodPost, "/internal/v1/orders/:order_id/payments/:payment_id")
+	require.NoError(t, err)
+	require.Equal(t, "POST orders/:order_id/payments/:payment_id", canonical)
+	require.True(t, IsCanonicalRouteScope(canonical))
+	require.True(t, RouteScopeMatches(http.MethodPost, "/internal/v1/orders/:order_id/payments/:payment_id", []string{canonical}))
+}
+
+func TestCanonicalRouteScopeRejectsLegacyAndWildcardForms(t *testing.T) {
+	for _, scope := range []string{
+		"POST orders/*",
+		"POST /internal/v1/orders/:order_id",
+		"POST orders/{order_id}",
+		"POST /orders/*",
+	} {
+		require.False(t, IsCanonicalRouteScope(scope), scope)
+	}
+}
+
+func TestCanonicalRouteScopeUsesCrossRuntimeGrammar(t *testing.T) {
+	accepted := map[string]string{
+		"GET /internal/v1/orders":                                            "GET orders",
+		"POST /oauth2/token":                                                 "POST oauth2/token",
+		"GET /api/v1/documentation/sites/:siteCode/live":                     "GET api/v1/documentation/sites/:siteCode/live",
+		"POST /mcp/documentation":                                            "POST mcp/documentation",
+		"POST /internal/v1/orders/:order_id/payments/:payment_id":            "POST orders/:order_id/payments/:payment_id",
+		"PATCH /internal/v1/resources/{resource_id}/sub-resource.v2":         "PATCH resources/:resource_id/sub-resource.v2",
+		"HEAD /internal/v1/assets/download-credentials":                      "HEAD assets/download-credentials",
+		"DELETE /internal/v1/quotas/allocations/{allocation_no}/reservation": "DELETE quotas/allocations/:allocation_no/reservation",
+	}
+	for input, expected := range accepted {
+		parts := strings.SplitN(input, " ", 2)
+		actual, err := CanonicalRouteScope(parts[0], parts[1])
+		require.NoError(t, err, input)
+		require.Equal(t, expected, actual, input)
+	}
+
+	rejected := []string{
+		"OPTIONS /internal/v1/orders",
+		"get /internal/v1/orders",
+		"GET /internal/v1/",
+		"GET /internal/v1//orders",
+		"GET /internal/v1/./orders",
+		"GET /internal/v1/../orders",
+		"GET /internal/v1/orders/",
+		"GET /internal/v1/orders/*",
+		"GET /internal/v1/orders/%2F",
+		"GET /internal/v1/orders?state=open",
+		"GET /internal/v1/orders#latest",
+		"GET /internal/v1/order items",
+		"GET /internal/v1/orders/{order-id}",
+		"GET /internal/v1/orders/:order-id",
+		" GET /internal/v1/orders",
+		"GET /internal/v1/orders ",
+		"GET //internal/v1/orders",
+		"GET /",
+	}
+	for _, input := range rejected {
+		parts := strings.SplitN(input, " ", 2)
+		if len(parts) != 2 {
+			require.False(t, IsCanonicalRouteScope(input), input)
+			continue
+		}
+		_, err := CanonicalRouteScope(parts[0], parts[1])
+		require.Error(t, err, input)
+		require.False(t, IsCanonicalRouteScope(input), input)
+	}
+}

package/dist/resources/templates/go-backend/internal/common/internalservice/service_identity_test.go

@@ -0,0 +1,387 @@
+package internalservice
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+	"go.uber.org/zap"
+
+	"{{module}}/internal/common/types"
+	"{{module}}/internal/core/config"
+	"{{module}}/internal/core/httpclient"
+)
+
+func TestServiceTokenSourceValidatesAccountAndCachesPerPolicy(t *testing.T) {
+	const firstCredentialEnvironment = "ONEX_TEST_PRODUCT_A_BOOTSTRAP_CREDENTIAL"
+	const secondCredentialEnvironment = "ONEX_TEST_PRODUCT_B_BOOTSTRAP_CREDENTIAL"
+	const firstCredential = "iamk_ck_AAAAAAAAAAAAAAAAAAAAAAAA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+	const secondCredential = "iamk_ck_CCCCCCCCCCCCCCCCCCCCCCCC.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+	t.Setenv(firstCredentialEnvironment, firstCredential)
+	t.Setenv(secondCredentialEnvironment, secondCredential)
+	now := time.Date(2026, time.August, 4, 8, 0, 0, 0, time.UTC)
+	requests := make(map[string]int)
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		var payload serviceTokenExchangeRequest
+		require.NoError(t, json.NewDecoder(request.Body).Decode(&payload))
+		productCode := request.Header.Get(types.HeaderProductCode)
+		credential := request.Header.Get(serviceCredentialHeader)
+		serviceAccountCode := map[string]string{
+			firstCredential:  "svc_product_alpha_bff_prod",
+			secondCredential: "svc_product_beta_worker_prod",
+		}[credential]
+		require.NotEmpty(t, serviceAccountCode)
+		cacheKey := credential + "\x00" + productCode + "\x00" + payload.Audience
+		requests[cacheKey]++
+		require.Equal(t, "/internal/v1/iam/service-tokens", request.URL.Path)
+		require.Empty(t, request.Header.Get(authorizationHeader))
+		writer.Header().Set("Content-Type", "application/json")
+		writer.Header().Set("Cache-Control", "No-Store, PRIVATE")
+		writer.Header().Set("Pragma", "no-cache")
+		writer.WriteHeader(http.StatusCreated)
+		require.NoError(t, json.NewEncoder(writer).Encode(serviceTokenExchangeResponse{
+			AccessToken: "iamt_" + productCode, TokenType: "Bearer",
+			ExpiresAt: now.Add(120 * time.Second), Audience: payload.Audience,
+			ServiceAccountCode: serviceAccountCode,
+		}))
+	}))
+	t.Cleanup(server.Close)
+
+	exchanger, err := NewBootstrapTokenExchanger(httpclient.New(zap.NewNop()), &config.Config{
+		InternalService: config.InternalServiceConfig{
+			PlatformBaseURL: server.URL + "/internal/v1", TokenTTLSeconds: 120, RequestTimeout: 2 * time.Second,
+		},
+	}, NewReferenceResolver())
+	require.NoError(t, err)
+	exchanger.now = func() time.Time { return now }
+	source, err := NewAudienceTokenSource(exchanger)
+	require.NoError(t, err)
+	source.now = func() time.Time { return now }
+
+	base := TokenPolicy{
+		CredentialRef: "env://" + firstCredentialEnvironment, ProductCode: "product_alpha",
+		Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+	}
+	first, err := source.Token(context.Background(), base)
+	require.NoError(t, err)
+	second, err := source.Token(context.Background(), base)
+	require.NoError(t, err)
+	require.Equal(t, first, second)
+	differentExpectedSender := base
+	differentExpectedSender.ExpectedServiceAccountCode = "svc_product_alpha_worker_prod"
+	_, err = source.Token(context.Background(), differentExpectedSender)
+	require.ErrorContains(t, err, "response contract is invalid")
+
+	otherTarget := TokenPolicy{
+		CredentialRef: "env://" + secondCredentialEnvironment, ProductCode: "product_beta",
+		Audience: "urn:onex:resource:document-api", ExpectedServiceAccountCode: "svc_product_beta_worker_prod",
+	}
+	_, err = source.Token(context.Background(), otherTarget)
+	require.NoError(t, err)
+	require.Equal(t, map[string]int{
+		firstCredential + "\x00product_alpha\x00urn:onex:resource:platform-internal-api": 2,
+		secondCredential + "\x00product_beta\x00urn:onex:resource:document-api":          1,
+	}, requests)
+}
+
+func TestServiceTokenSourceTokenWithCredentialUsesExactVersionCacheWithoutResolver(t *testing.T) {
+	const firstCredential = "iamk_ck_AAAAAAAAAAAAAAAAAAAAAAAA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB"
+	const secondCredential = "iamk_ck_CCCCCCCCCCCCCCCCCCCCCCCC.DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"
+	now := time.Date(2026, time.September, 3, 8, 0, 0, 0, time.UTC)
+	var requestCredentials []string
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		var payload serviceTokenExchangeRequest
+		require.NoError(t, json.NewDecoder(request.Body).Decode(&payload))
+		requestCredentials = append(requestCredentials, request.Header.Get(serviceCredentialHeader))
+		require.Equal(t, "customer_operations_os", request.Header.Get(types.HeaderProductCode))
+		require.Equal(t, "urn:onex:resource:platform-internal-api", payload.Audience)
+		writer.Header().Set("Content-Type", "application/json")
+		writer.Header().Set("Cache-Control", "private, no-store")
+		writer.Header().Set("Pragma", "no-cache")
+		writer.WriteHeader(http.StatusCreated)
+		require.NoError(t, json.NewEncoder(writer).Encode(serviceTokenExchangeResponse{
+			AccessToken:        fmt.Sprintf("iamt_exact_%d", len(requestCredentials)),
+			TokenType:          "Bearer",
+			ExpiresAt:          now.Add(120 * time.Second),
+			Audience:           payload.Audience,
+			ServiceAccountCode: "svc_customer_operations_worker_prod",
+		}))
+	}))
+	t.Cleanup(server.Close)
+
+	resolver := &countingInternalServiceSecretResolver{}
+	exchanger, err := NewBootstrapTokenExchanger(httpclient.New(zap.NewNop()), &config.Config{
+		InternalService: config.InternalServiceConfig{
+			PlatformBaseURL: server.URL + "/internal/v1", TokenTTLSeconds: 120, RequestTimeout: 2 * time.Second,
+		},
+	}, resolver)
+	require.NoError(t, err)
+	exchanger.now = func() time.Time { return now }
+	source, err := NewAudienceTokenSource(exchanger)
+	require.NoError(t, err)
+	source.now = func() time.Time { return now }
+
+	policy := TokenPolicy{
+		CredentialRef: "scv_" + strings.Repeat("a", 40), ProductCode: "customer_operations_os",
+		Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_customer_operations_worker_prod",
+	}
+	firstValue := []byte(firstCredential)
+	firstToken, err := source.TokenWithCredential(context.Background(), policy, firstValue)
+	require.NoError(t, err)
+	requireClearedCredential(t, firstValue)
+
+	cachedValue := []byte(firstCredential)
+	cachedToken, err := source.TokenWithCredential(context.Background(), policy, cachedValue)
+	require.NoError(t, err)
+	require.Equal(t, firstToken, cachedToken)
+	requireClearedCredential(t, cachedValue)
+
+	secondPolicy := policy
+	secondPolicy.CredentialRef = "scv_" + strings.Repeat("b", 40)
+	secondValue := []byte(secondCredential)
+	secondToken, err := source.TokenWithCredential(context.Background(), secondPolicy, secondValue)
+	require.NoError(t, err)
+	require.NotEqual(t, firstToken, secondToken)
+	requireClearedCredential(t, secondValue)
+	require.Equal(t, []string{firstCredential, secondCredential}, requestCredentials)
+	require.Zero(t, resolver.calls)
+
+	_, err = source.Token(context.Background(), policy)
+	require.ErrorContains(t, err, "reference resolver must not serve exact credential versions")
+	require.Equal(t, 1, resolver.calls)
+}
+
+func TestServiceTokenSourceTokenWithCredentialRejectsNonExactReferenceAndClearsCredential(t *testing.T) {
+	var requests int
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { requests++ }))
+	t.Cleanup(server.Close)
+	resolver := &countingInternalServiceSecretResolver{}
+	exchanger, err := NewBootstrapTokenExchanger(httpclient.New(zap.NewNop()), &config.Config{
+		InternalService: config.InternalServiceConfig{
+			PlatformBaseURL: server.URL + "/internal/v1", TokenTTLSeconds: 120, RequestTimeout: 2 * time.Second,
+		},
+	}, resolver)
+	require.NoError(t, err)
+	source, err := NewAudienceTokenSource(exchanger)
+	require.NoError(t, err)
+	credential := []byte("iamk_ck_AAAAAAAAAAAAAAAAAAAAAAAA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB")
+
+	_, err = source.TokenWithCredential(context.Background(), TokenPolicy{
+		CredentialRef: "env://ONEX_BOOTSTRAP_CREDENTIAL", ProductCode: "customer_operations_os",
+		Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_customer_operations_worker_prod",
+	}, credential)
+	require.ErrorContains(t, err, "exact credential version reference is invalid")
+	requireClearedCredential(t, credential)
+	require.Zero(t, requests)
+	require.Zero(t, resolver.calls)
+}
+
+func TestBoundServiceTokenSignerUsesExplicitImmutablePolicy(t *testing.T) {
+	source := &staticAudienceTokenSource{tokens: map[TokenPolicy]string{
+		{CredentialRef: "env://ONEX_TEST_CREDENTIAL", ProductCode: "product_alpha", Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_product_alpha_bff_prod"}: "iamt_product_alpha",
+	}}
+	signer, err := NewBoundServiceTokenSigner(source, TokenPolicy{
+		CredentialRef: "env://ONEX_TEST_CREDENTIAL", ProductCode: "product_alpha", Audience: "urn:onex:resource:platform-internal-api",
+		ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+	})
+	require.NoError(t, err)
+	request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://platform.internal/internal/v1/ping", nil)
+	require.NoError(t, err)
+	require.NoError(t, signer.AuthorizeRequest(context.Background(), request))
+	require.Equal(t, "Bearer iamt_product_alpha", request.Header.Get(authorizationHeader))
+
+	require.Len(t, source.calls, 1)
+}
+
+func TestProductScopedServiceTokenSignerAllowsOnlyConfiguredProducts(t *testing.T) {
+	alphaPolicy := TokenPolicy{
+		CredentialRef: "env://ONEX_TEST_CREDENTIAL", ProductCode: "product_alpha",
+		Audience: "urn:onex:resource:documentation-api", ExpectedServiceAccountCode: "svc_documentation_client_prod",
+	}
+	betaPolicy := alphaPolicy
+	betaPolicy.ProductCode = "product_beta"
+	source := &staticAudienceTokenSource{tokens: map[TokenPolicy]string{
+		alphaPolicy: "iamt_product_alpha",
+		betaPolicy:  "iamt_product_beta",
+	}}
+	signer, err := NewProductScopedServiceTokenSigner(source, ProductTokenPolicy{
+		CredentialRef: "env://ONEX_TEST_CREDENTIAL", AllowedProductCodes: []string{"product_alpha", "product_beta"},
+		Audience: "urn:onex:resource:documentation-api", ExpectedServiceAccountCode: "svc_documentation_client_prod",
+	})
+	require.NoError(t, err)
+
+	request, err := http.NewRequestWithContext(context.Background(), http.MethodGet, "https://documentation.internal/internal/v1/pages", nil)
+	require.NoError(t, err)
+	request.Header = nil
+	require.NoError(t, signer.AuthorizeRequestForProduct(context.Background(), request, "product_alpha"))
+	require.Equal(t, "Bearer iamt_product_alpha", request.Header.Get(authorizationHeader))
+
+	headers, err := signer.AuthHeadersForProduct(context.Background(), "product_beta")
+	require.NoError(t, err)
+	require.Equal(t, "Bearer iamt_product_beta", headers[authorizationHeader])
+
+	_, err = signer.AuthHeadersForProduct(context.Background(), "product_gamma")
+	require.ErrorContains(t, err, "outside the configured allowlist")
+	require.Equal(t, []TokenPolicy{alphaPolicy, betaPolicy}, source.calls)
+}
+
+func TestRefreshWindowRemainsStrictlyInsideShortTokenLifetime(t *testing.T) {
+	key := tokenCacheKey{
+		credentialRef: "env://ONEX_TEST_CREDENTIAL", productCode: "product_alpha", audience: "urn:onex:resource:test",
+		expectedServiceAccountCode: "svc_product_alpha_bff_prod",
+	}
+	for _, remaining := range []time.Duration{time.Second, 2 * time.Second} {
+		window := refreshWindow(key, remaining)
+		require.Positive(t, window)
+		require.Less(t, window, remaining)
+	}
+}
+
+func TestValidateTokenPolicyRequiresCanonicalAudienceAndServiceAccount(t *testing.T) {
+	valid := TokenPolicy{
+		CredentialRef: "env://ONEX_TEST_CREDENTIAL", ProductCode: "product_alpha",
+		Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+	}
+	require.NoError(t, ValidateTokenPolicy(valid))
+	for _, mutate := range []func(*TokenPolicy){
+		func(policy *TokenPolicy) { policy.Audience = "relative-audience" },
+		func(policy *TokenPolicy) { policy.Audience = "https://user@platform.internal/api" },
+		func(policy *TokenPolicy) { policy.ExpectedServiceAccountCode = "" },
+		func(policy *TokenPolicy) { policy.ExpectedServiceAccountCode = "svc_Invalid" },
+	} {
+		policy := valid
+		mutate(&policy)
+		require.Error(t, ValidateTokenPolicy(policy), policy)
+	}
+}
+
+func TestBootstrapTokenExchangerRejectsNonCanonicalCredentialBeforeNetwork(t *testing.T) {
+	const credentialEnvironment = "ONEX_TEST_INVALID_BOOTSTRAP_CREDENTIAL"
+	t.Setenv(credentialEnvironment, "iamk_prefix_only")
+	var calls int
+	server := httptest.NewServer(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { calls++ }))
+	t.Cleanup(server.Close)
+	exchanger, err := NewBootstrapTokenExchanger(httpclient.New(zap.NewNop()), &config.Config{
+		InternalService: config.InternalServiceConfig{
+			PlatformBaseURL: server.URL + "/internal/v1", TokenTTLSeconds: 120, RequestTimeout: 2 * time.Second,
+		},
+	}, NewReferenceResolver())
+	require.NoError(t, err)
+	_, err = exchanger.Exchange(context.Background(), TokenPolicy{
+		CredentialRef: "env://" + credentialEnvironment, ProductCode: "product_alpha",
+		Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+	})
+	require.ErrorContains(t, err, "credential format is invalid")
+	require.Zero(t, calls)
+}
+
+func TestDecodeServiceTokenExchangeResponseRejectsNonExactContracts(t *testing.T) {
+	valid := `{"access_token":"iamt_signed","token_type":"Bearer","expires_at":"2026-08-04T08:02:00Z","audience":"urn:onex:resource:platform-internal-api","service_account_code":"svc_product_alpha_bff_prod"}`
+	tests := []struct {
+		name string
+		body []byte
+	}{
+		{name: "unknown field", body: []byte(strings.TrimSuffix(valid, "}") + `,"unexpected":true}`)},
+		{name: "legacy expires in", body: []byte(strings.TrimSuffix(valid, "}") + `,"expires_in":120}`)},
+		{name: "legacy identity", body: []byte(strings.TrimSuffix(valid, "}") + `,"identity_id":42}`)},
+		{name: "legacy product", body: []byte(strings.TrimSuffix(valid, "}") + `,"product_code":"product_alpha"}`)},
+		{name: "duplicate field", body: []byte(strings.Replace(valid, `"audience":`, `"audience":"urn:onex:resource:other","audience":`, 1))},
+		{name: "trailing value", body: []byte(valid + ` {}`)},
+		{name: "oversized body", body: bytes.Repeat([]byte("x"), maximumTokenExchangeResponseBytes+1)},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			_, err := decodeServiceTokenExchangeResponse(test.body)
+			require.Error(t, err)
+		})
+	}
+}
+
+func TestBootstrapTokenExchangerRejectsInvalidResponseMetadata(t *testing.T) {
+	const credentialEnvironment = "ONEX_TEST_EXCHANGE_METADATA_CREDENTIAL"
+	t.Setenv(credentialEnvironment, "iamk_ck_AAAAAAAAAAAAAAAAAAAAAAAA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB")
+	now := time.Date(2026, time.August, 4, 8, 0, 0, 0, time.UTC)
+	tests := []struct {
+		name         string
+		status       int
+		contentType  string
+		cacheControl string
+		pragma       string
+	}{
+		{name: "wrong status", status: http.StatusOK, contentType: "application/json", cacheControl: "private, no-store", pragma: "no-cache"},
+		{name: "missing content type", status: http.StatusCreated, cacheControl: "private, no-store", pragma: "no-cache"},
+		{name: "wrong content type", status: http.StatusCreated, contentType: "text/plain", cacheControl: "private, no-store", pragma: "no-cache"},
+		{name: "missing private", status: http.StatusCreated, contentType: "application/json", cacheControl: "no-store", pragma: "no-cache"},
+		{name: "missing no store", status: http.StatusCreated, contentType: "application/json", cacheControl: "private", pragma: "no-cache"},
+		{name: "substring is not directive", status: http.StatusCreated, contentType: "application/json", cacheControl: "private, not-no-store", pragma: "no-cache"},
+		{name: "missing pragma", status: http.StatusCreated, contentType: "application/json", cacheControl: "private, no-store"},
+		{name: "non exact pragma", status: http.StatusCreated, contentType: "application/json", cacheControl: "private, no-store", pragma: "No-Cache"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+				if test.contentType != "" {
+					writer.Header().Set("Content-Type", test.contentType)
+				}
+				if test.cacheControl != "" {
+					writer.Header().Set("Cache-Control", test.cacheControl)
+				}
+				if test.pragma != "" {
+					writer.Header().Set("Pragma", test.pragma)
+				}
+				writer.WriteHeader(test.status)
+				_, _ = fmt.Fprintf(writer, `{"access_token":"iamt_signed","token_type":"Bearer","expires_at":"%s","audience":"urn:onex:resource:platform-internal-api"}`, now.Add(120*time.Second).Format(time.RFC3339))
+			}))
+			t.Cleanup(server.Close)
+			exchanger, err := NewBootstrapTokenExchanger(httpclient.New(zap.NewNop()), &config.Config{
+				InternalService: config.InternalServiceConfig{
+					PlatformBaseURL: server.URL + "/internal/v1", TokenTTLSeconds: 120, RequestTimeout: 2 * time.Second,
+				},
+			}, NewReferenceResolver())
+			require.NoError(t, err)
+			exchanger.now = func() time.Time { return now }
+			_, err = exchanger.Exchange(context.Background(), TokenPolicy{
+				CredentialRef: "env://" + credentialEnvironment, ProductCode: "product_alpha",
+				Audience: "urn:onex:resource:platform-internal-api", ExpectedServiceAccountCode: "svc_product_alpha_bff_prod",
+			})
+			require.ErrorContains(t, err, "response metadata is invalid")
+		})
+	}
+}
+
+type staticAudienceTokenSource struct {
+	tokens map[TokenPolicy]string
+	calls  []TokenPolicy
+}
+
+type countingInternalServiceSecretResolver struct {
+	calls int
+}
+
+func (r *countingInternalServiceSecretResolver) ResolveSecret(context.Context, string) (string, error) {
+	r.calls++
+	return "", fmt.Errorf("reference resolver must not serve exact credential versions")
+}
+
+func requireClearedCredential(t *testing.T, value []byte) {
+	t.Helper()
+	for index, item := range value {
+		require.Zero(t, item, "credential byte %d was not cleared", index)
+	}
+}
+
+func (s *staticAudienceTokenSource) Token(_ context.Context, policy TokenPolicy) (string, error) {
+	s.calls = append(s.calls, policy)
+	token := s.tokens[policy]
+	if token == "" {
+		return "", fmt.Errorf("token policy is not configured")
+	}
+	return token, nil
+}