Implement authorization import and revocation checks (T-503)

core/application/launch/service.go

@@ -14,20 +14,21 @@ import (
 )
 
 var (
-	ErrLaunchConfig       = errors.New("invalid launch service configuration")
-	ErrLaunchRequest      = errors.New("invalid launch request")
-	ErrAppNotInstalled    = errors.New("app is not installed")
-	ErrLaunchMetadata     = errors.New("installed launch metadata is invalid")
-	ErrLaunchTargetUnsafe = errors.New("installed launch target is unsafe")
-	ErrEntrypointMissing  = errors.New("installed entrypoint is missing")
-	ErrCompatibilityCheck = errors.New("system compatibility check failed")
-	ErrAppIncompatible    = errors.New("installed app is incompatible with this system")
-	ErrAuthorizationCheck = errors.New("launch authorization check failed")
-	ErrLaunchUnauthorized = errors.New("launch is not authorized")
-	ErrTargetStateCheck   = errors.New("launch target state check failed")
-	ErrAppRunning         = errors.New("installed app is already running")
-	ErrProcessStart       = errors.New("start installed app")
-	launchAppIDPattern    = regexp.MustCompile(`^[a-z0-9-]+$`)
+	ErrLaunchConfig        = errors.New("invalid launch service configuration")
+	ErrLaunchRequest       = errors.New("invalid launch request")
+	ErrAppNotInstalled     = errors.New("app is not installed")
+	ErrLaunchMetadata      = errors.New("installed launch metadata is invalid")
+	ErrLaunchTargetUnsafe  = errors.New("installed launch target is unsafe")
+	ErrEntrypointMissing   = errors.New("installed entrypoint is missing")
+	ErrCompatibilityCheck  = errors.New("system compatibility check failed")
+	ErrAppIncompatible     = errors.New("installed app is incompatible with this system")
+	ErrAuthorizationCheck  = errors.New("launch authorization check failed")
+	ErrLaunchUnauthorized  = errors.New("launch is not authorized")
+	ErrTargetStateCheck    = errors.New("launch target state check failed")
+	ErrAppRunning          = errors.New("installed app is already running")
+	ErrProcessStart        = errors.New("start installed app")
+	launchAppIDPattern     = regexp.MustCompile(`^[a-z0-9-]+$`)
+	launchProductIDPattern = regexp.MustCompile(`^[a-z0-9-]+$`)
 )
 
 // FailureCode is the stable, non-localized result of a launch attempt.
@@ -91,10 +92,10 @@ type CompatibilityChecker interface {
 	IsCompatible(minOS string) (bool, error)
 }
 
-// AuthorizationChecker decides whether the user may launch one app. It is a
-// required boundary; license policy is implemented by the later licensing task.
+// AuthorizationChecker decides whether the user may launch one signed
+// package product. It is a required fail-closed boundary.
 type AuthorizationChecker interface {
-	IsAuthorized(appID string) (bool, error)
+	IsAuthorized(productID string) (bool, error)
 }
 
 // TargetStateChecker reports whether this precise entrypoint is running.
@@ -177,7 +178,10 @@ func (service *Service) Start(request Request) (Result, error) {
 	if !compatible {
 		return Result{}, launchError(ErrAppIncompatible)
 	}
-	authorized, err := service.authorization.IsAuthorized(record.ID)
+	if !launchProductIDPattern.MatchString(record.ProductID) {
+		return Result{}, launchError(ErrAuthorizationCheck)
+	}
+	authorized, err := service.authorization.IsAuthorized(record.ProductID)
 	if err != nil {
 		return Result{}, launchError(fmt.Errorf("%w: %w", ErrAuthorizationCheck, err))
 	}

core/application/launch/service_test.go

@@ -13,6 +13,11 @@ func TestServiceStartsOnlyVerifiedCurrentEntrypoint(t *testing.T) {
 	store, appRoot := seedInstalledApp(t)
 	launcher := &recordingLauncher{pid: 42}
 	service := newService(t, store, launcher)
+	var checkedProduct string
+	service.authorization = authorizationFunc(func(productID string) (bool, error) {
+		checkedProduct = productID
+		return true, nil
+	})
 
 	result, err := service.Start(Request{AppID: "test-app"})
 	if err != nil {
@@ -27,6 +32,9 @@ func TestServiceStartsOnlyVerifiedCurrentEntrypoint(t *testing.T) {
 		!launcher.command.RequiresAdmin {
 		t.Fatalf("command = %#v", launcher.command)
 	}
+	if checkedProduct != "test-product" {
+		t.Fatalf("authorization product = %q, want test-product", checkedProduct)
+	}
 }
 
 func TestServiceRejectsUnsafeOrUnavailableLaunchStates(t *testing.T) {
@@ -49,6 +57,14 @@ func TestServiceRejectsUnsafeOrUnavailableLaunchStates(t *testing.T) {
 			wantErr:  ErrLaunchMetadata,
 			wantCode: FailureCodeLaunchMetadataInvalid,
 		},
+		{
+			name: "missing legacy product metadata",
+			mutate: func(record *storage.InstalledApp, _ string) {
+				record.ProductID = ""
+			},
+			wantErr:  ErrAuthorizationCheck,
+			wantCode: FailureCodeAuthorizationFailed,
+		},
 		{
 			name: "entrypoint is absent",
 			mutate: func(_ *storage.InstalledApp, appRoot string) {
@@ -202,6 +218,7 @@ func seedInstalledApp(t *testing.T) (*storage.InstalledAppStore, string) {
 		Entrypoint:       "bin/App.exe",
 		WorkingDirectory: "bin",
 		MinOS:            "windows-10",
+		ProductID:        "test-product",
 		RequiresAdmin:    true,
 		Files: []storage.InstalledFile{{
 			Path:   "bin/App.exe",