test(identity): bind data-rights ownership to recent authenticated session

[seonghobae]

Intent

Continue #55 with one main-based TDD slice that advances the already-protected recent-authentication policy into session-derived data-rights ownership. The slice remains intentionally bounded: it establishes the authenticated application boundary for export; it does not claim the complete export/deletion orchestration from #55.

Live dependency state

Protected main now contains #136 as 68074830d952e209497e576f0af5ded6d83f8121. This branch still descends from the pre-squash #136 lineage, so predecessor checks are historical and the current PR synthetic merge must be revalidated against the live base. No predecessor review/check evidence transfers.

Implemented on the current head

• AuthenticatedDataRightsApplication authenticates the opaque application session through the existing identity HTTP application boundary.
• recent-authentication age is enforced before any data-rights work.
• workspaceId and actorUserId are derived exclusively from the authenticated session.
• only the trusted session-derived DataRightsWorkspaceContext is passed to DataRightsApplication.exportWorkspace.
• no client parameter can select another workspace or actor.
• deterministic tests cover trusted-context derivation and the recent-authentication boundary.

Current exact-head evidence

At head aa9e809bd2d37914b288d233e8b2b2f7f3fb3ab2, CI, Compose runtime, AppGuardrail, Semgrep, Security Scan, and Commercial Readiness completed successfully before the protected-main #136 squash moved the live base. Those runs are useful source-head evidence but are not treated as current-base merge evidence.

Remaining before merge

• refresh all required PR workflows/review against the unchanged exact head and current live main;
• address every valid current-head review finding;
• retain Add complete tenant export and deletion orchestration #55 as open until destructive erasure, durable request/receipt/reconciliation, recent-auth gateway wiring, protected export delivery/audit, contributor coverage, legal-hold/retention, backup-expiry, and stuck-request recovery are complete.

Refs #55, #136, #134, #21.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3cc9adbc-03ce-4b0d-a198-eaca6a785b9e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@coderabbitai review