feat(admin): add device credential isolation

admin/internal/server/evidence.go

@@ -11,6 +11,7 @@ import (
 	"time"
 	"unicode/utf8"
 
+	"cmbuyer/admin/internal/deviceauth"
 	"cmbuyer/admin/internal/evidence"
 
 	"github.com/gin-gonic/gin"
@@ -29,11 +30,22 @@ func uploadEvidence(options Options) gin.HandlerFunc {
 	return func(context *gin.Context) {
 		// Authentication deliberately precedes content-type parsing and every body read. A rejected
 		// device must not make the service spool or inspect a potentially sensitive upload.
-		principal, authenticated := options.DeviceAuthenticator.Authenticate(context.Request)
-		if !authenticated {
+		principal, err := options.DeviceAuthenticator.Authenticate(context.Request)
+		if errors.Is(err, deviceauth.ErrUnauthenticated) {
+			context.Header("WWW-Authenticate", "Bearer")
 			context.Status(http.StatusUnauthorized)
 			return
 		}
+		if err != nil {
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
+		if !deviceauth.ValidDeviceID(principal.ID) {
+			// A custom authenticator is still an untrusted boundary. Do not defer principal
+			// validation until Commit because multipart bytes would already have been read.
+			context.Status(http.StatusServiceUnavailable)
+			return
+		}
 
 		boundary, ok := multipartBoundary(context.GetHeader("Content-Type"))
 		if !ok {