Implement authorization import and revocation checks (T-503)

core/application/launch/service_test.go

@@ -13,6 +13,11 @@ func TestServiceStartsOnlyVerifiedCurrentEntrypoint(t *testing.T) {
 	store, appRoot := seedInstalledApp(t)
 	launcher := &recordingLauncher{pid: 42}
 	service := newService(t, store, launcher)
+	var checkedProduct string
+	service.authorization = authorizationFunc(func(productID string) (bool, error) {
+		checkedProduct = productID
+		return true, nil
+	})
 
 	result, err := service.Start(Request{AppID: "test-app"})
 	if err != nil {
@@ -27,6 +32,9 @@ func TestServiceStartsOnlyVerifiedCurrentEntrypoint(t *testing.T) {
 		!launcher.command.RequiresAdmin {
 		t.Fatalf("command = %#v", launcher.command)
 	}
+	if checkedProduct != "test-product" {
+		t.Fatalf("authorization product = %q, want test-product", checkedProduct)
+	}
 }
 
 func TestServiceRejectsUnsafeOrUnavailableLaunchStates(t *testing.T) {
@@ -49,6 +57,14 @@ func TestServiceRejectsUnsafeOrUnavailableLaunchStates(t *testing.T) {
 			wantErr:  ErrLaunchMetadata,
 			wantCode: FailureCodeLaunchMetadataInvalid,
 		},
+		{
+			name: "missing legacy product metadata",
+			mutate: func(record *storage.InstalledApp, _ string) {
+				record.ProductID = ""
+			},
+			wantErr:  ErrAuthorizationCheck,
+			wantCode: FailureCodeAuthorizationFailed,
+		},
 		{
 			name: "entrypoint is absent",
 			mutate: func(_ *storage.InstalledApp, appRoot string) {
@@ -202,6 +218,7 @@ func seedInstalledApp(t *testing.T) (*storage.InstalledAppStore, string) {
 		Entrypoint:       "bin/App.exe",
 		WorkingDirectory: "bin",
 		MinOS:            "windows-10",
+		ProductID:        "test-product",
 		RequiresAdmin:    true,
 		Files: []storage.InstalledFile{{
 			Path:   "bin/App.exe",