feat(security): harden gateway boundaries and usage policies

Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change.

Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.

apps/aether-gateway/src/video_tasks/mod.rs

@@ -1,4 +1,5 @@
 use crate::control::GatewayControlAuthContext;
+use crate::GatewayError;
 use aether_contracts::{ExecutionPlan, ExecutionTimeouts, ProxySnapshot, RequestBody};
 
 pub(crate) use self::service::VideoTaskService;
@@ -33,5 +34,16 @@ mod service;
 mod store;
 mod types;
 
+pub(crate) fn not_found_body() -> serde_json::Value {
+    serde_json::json!({"detail": "Video task not found"})
+}
+
+pub(crate) fn not_found_error() -> GatewayError {
+    GatewayError::Client {
+        status: http::StatusCode::NOT_FOUND,
+        message: "Video task not found".to_string(),
+    }
+}
+
 #[cfg(test)]
 mod tests;

apps/aether-gateway/src/video_tasks/service.rs

@@ -16,9 +16,10 @@ impl VideoTaskService {
     pub(crate) fn with_file_store(
         mode: VideoTaskTruthSourceMode,
         path: impl Into<PathBuf>,
+        encryption_key: impl Into<String>,
     ) -> std::io::Result<Self> {
         Ok(Self(
-            aether_video_tasks_core::VideoTaskService::with_file_store(mode, path)?,
+            aether_video_tasks_core::VideoTaskService::with_file_store(mode, path, encryption_key)?,
         ))
     }
 
@@ -43,6 +44,43 @@ impl VideoTaskService {
             trace_id,
         )
     }
+
+    pub(crate) fn prepare_follow_up_sync_plan_for_user(
+        &self,
+        plan_kind: &str,
+        request_path: &str,
+        body_json: Option<&serde_json::Value>,
+        auth_context: Option<&GatewayControlAuthContext>,
+        trace_id: &str,
+    ) -> Option<LocalVideoTaskFollowUpPlan> {
+        self.0.prepare_follow_up_sync_plan_for_user(
+            plan_kind,
+            request_path,
+            body_json,
+            auth_context.map(|value| value.user_id.as_str()),
+            auth_context.map(|value| value.api_key_id.as_str()),
+            trace_id,
+        )
+    }
+
+    pub(crate) fn prepare_follow_up_sync_plan_for_user_id(
+        &self,
+        plan_kind: &str,
+        request_path: &str,
+        body_json: Option<&serde_json::Value>,
+        user_id: &str,
+        api_key_id: Option<&str>,
+        trace_id: &str,
+    ) -> Option<LocalVideoTaskFollowUpPlan> {
+        self.0.prepare_follow_up_sync_plan_for_user(
+            plan_kind,
+            request_path,
+            body_json,
+            Some(user_id),
+            api_key_id,
+            trace_id,
+        )
+    }
 }
 
 impl Deref for VideoTaskService {

apps/aether-gateway/src/video_tasks/tests/fixtures.rs

@@ -55,6 +55,7 @@ pub(super) fn sample_auth_context() -> GatewayControlAuthContext {
         local_rejection: None,
         allowed_models: None,
         ip_rules: None,
+        verified_api_key_hash: None,
     }
 }
 

apps/aether-gateway/src/video_tasks/tests/plans.rs

@@ -62,6 +62,30 @@ fn rust_authoritative_service_builds_openai_cancel_follow_up_plan() {
             .and_then(Value::as_str),
         Some("task-local-123")
     );
+
+    let mut same_user_new_key = sample_auth_context();
+    same_user_new_key.api_key_id = "key-rotated".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_cancel_sync",
+            "/v1/videos/task-local-123/cancel",
+            None,
+            Some(&same_user_new_key),
+            "trace-openai-cancel-owner-rotated-key",
+        )
+        .is_some());
+    let mut foreign_auth = sample_auth_context();
+    foreign_auth.user_id = "user-foreign".to_string();
+    foreign_auth.api_key_id = "key-foreign".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_cancel_sync",
+            "/v1/videos/task-local-123/cancel",
+            None,
+            Some(&foreign_auth),
+            "trace-openai-cancel-foreign",
+        )
+        .is_none());
 }
 
 #[test]
@@ -123,6 +147,30 @@ fn rust_authoritative_service_builds_openai_remix_follow_up_plan() {
             .and_then(Value::as_str),
         Some("task-local-123")
     );
+
+    let mut same_user_new_key = sample_auth_context();
+    same_user_new_key.api_key_id = "key-rotated".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_remix_sync",
+            "/v1/videos/task-local-123/remix",
+            Some(&remix_body),
+            Some(&same_user_new_key),
+            "trace-openai-remix-owner-rotated-key",
+        )
+        .is_some());
+    let mut foreign_auth = sample_auth_context();
+    foreign_auth.user_id = "user-foreign".to_string();
+    foreign_auth.api_key_id = "key-foreign".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_remix_sync",
+            "/v1/videos/task-local-123/remix",
+            Some(&remix_body),
+            Some(&foreign_auth),
+            "trace-openai-remix-foreign",
+        )
+        .is_none());
 }
 
 #[test]
@@ -180,6 +228,30 @@ fn rust_authoritative_service_builds_openai_delete_follow_up_plan() {
             .and_then(Value::as_str),
         Some("task-local-123")
     );
+
+    let mut same_user_new_key = sample_auth_context();
+    same_user_new_key.api_key_id = "key-rotated".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_delete_sync",
+            "/v1/videos/task-local-123",
+            None,
+            Some(&same_user_new_key),
+            "trace-openai-delete-owner-rotated-key",
+        )
+        .is_some());
+    let mut foreign_auth = sample_auth_context();
+    foreign_auth.user_id = "user-foreign".to_string();
+    foreign_auth.api_key_id = "key-foreign".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "openai_video_delete_sync",
+            "/v1/videos/task-local-123",
+            None,
+            Some(&foreign_auth),
+            "trace-openai-delete-foreign",
+        )
+        .is_none());
 }
 
 #[test]
@@ -230,6 +302,30 @@ fn rust_authoritative_service_builds_gemini_cancel_follow_up_plan() {
             .and_then(Value::as_str),
         Some("localshort123")
     );
+
+    let mut same_user_new_key = sample_auth_context();
+    same_user_new_key.api_key_id = "key-rotated".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "gemini_video_cancel_sync",
+            "/v1beta/models/veo-3/operations/localshort123:cancel",
+            None,
+            Some(&same_user_new_key),
+            "trace-gemini-cancel-owner-rotated-key",
+        )
+        .is_some());
+    let mut foreign_auth = sample_auth_context();
+    foreign_auth.user_id = "user-foreign".to_string();
+    foreign_auth.api_key_id = "key-foreign".to_string();
+    assert!(service
+        .prepare_follow_up_sync_plan_for_user(
+            "gemini_video_cancel_sync",
+            "/v1beta/models/veo-3/operations/localshort123:cancel",
+            None,
+            Some(&foreign_auth),
+            "trace-gemini-cancel-foreign",
+        )
+        .is_none());
 }
 
 #[test]
@@ -367,9 +463,13 @@ fn rust_authoritative_service_builds_poll_refresh_batch_for_active_tasks_only()
 fn file_video_task_store_persists_snapshots_across_service_rebuilds() {
     let store_path =
         std::env::temp_dir().join(format!("aether-video-task-store-{}.json", Uuid::new_v4()));
-    let service =
-        VideoTaskService::with_file_store(VideoTaskTruthSourceMode::RustAuthoritative, &store_path)
-            .expect("file-backed service should build");
+    let encryption_key = "video-task-test-encryption-key";
+    let service = VideoTaskService::with_file_store(
+        VideoTaskTruthSourceMode::RustAuthoritative,
+        &store_path,
+        encryption_key,
+    )
+    .expect("file-backed service should build");
     service.record_snapshot(LocalVideoTaskSnapshot::OpenAi(OpenAiVideoTaskSeed {
         local_task_id: "task-file-123".to_string(),
         upstream_task_id: "ext-video-task-123".to_string(),
@@ -393,9 +493,16 @@ fn file_video_task_store_persists_snapshots_across_service_rebuilds() {
     }));
     drop(service);
 
-    let reopened =
-        VideoTaskService::with_file_store(VideoTaskTruthSourceMode::RustAuthoritative, &store_path)
-            .expect("reopened file-backed service should build");
+    let stored_bytes = std::fs::read(&store_path).expect("encrypted store should exist");
+    assert!(stored_bytes.starts_with(b"aether-video-tasks-v2\n"));
+    assert!(!String::from_utf8_lossy(&stored_bytes).contains("api.openai.example"));
+
+    let reopened = VideoTaskService::with_file_store(
+        VideoTaskTruthSourceMode::RustAuthoritative,
+        &store_path,
+        encryption_key,
+    )
+    .expect("reopened file-backed service should build");
     let response = reopened
         .read_response(Some("openai"), "/v1/videos/task-file-123")
         .expect("persisted read response should exist");

apps/aether-gateway/src/video_tasks/tests/projection.rs

@@ -57,8 +57,8 @@ fn rust_authoritative_service_projects_openai_status_into_local_read_response()
             "progress": 100,
             "completed_at": 1712345688u64,
             "error": {
-                "code": "upstream_failed",
-                "message": "provider failed"
+                "code": "Bearer code-secret",
+                "message": "request failed at https://internal.test/result?token=message-secret"
             }
         })
         .as_object()
@@ -79,8 +79,14 @@ fn rust_authoritative_service_projects_openai_status_into_local_read_response()
             .get("error")
             .and_then(Value::as_object)
             .and_then(|value| value.get("code")),
-        Some(&json!("upstream_failed"))
+        Some(&json!("provider_error"))
     );
+    assert_eq!(
+        failed.body_json["error"]["message"],
+        "Video generation failed"
+    );
+    assert!(!failed.body_json.to_string().contains("code-secret"));
+    assert!(!failed.body_json.to_string().contains("message-secret"));
 }
 
 #[test]
@@ -125,6 +131,28 @@ fn rust_authoritative_service_builds_openai_content_stream_plan_from_direct_vide
         "https://cdn.example.com/ext-video-task-123.mp4"
     );
     assert!(plan.headers.is_empty());
+
+    assert!(service
+        .prepare_openai_content_stream_action_for_user(
+            "/v1/videos/task-local-123/content",
+            Some("variant=video"),
+            "trace-foreign-content-123",
+            "user-foreign",
+        )
+        .is_none());
+
+    let owner_action = service
+        .prepare_openai_content_stream_action_for_user(
+            "/v1/videos/task-local-123/content",
+            Some("variant=video"),
+            "trace-owner-content-123",
+            "user-123",
+        )
+        .expect("owner content action should exist");
+    assert!(matches!(
+        owner_action,
+        LocalVideoTaskContentAction::StreamPlan(_)
+    ));
 }
 
 #[test]
@@ -197,7 +225,9 @@ fn rust_authoritative_service_projects_gemini_status_into_local_read_response()
         json!({
             "done": false,
             "metadata": {
-                "state": "PROCESSING"
+                "state": "PROCESSING",
+                "authorization": "Bearer metadata-secret",
+                "debug_url": "https://internal.test/status?token=query-secret"
             }
         })
         .as_object()
@@ -211,10 +241,9 @@ fn rust_authoritative_service_projects_gemini_status_into_local_read_response()
         .expect("processing read response should exist");
     assert_eq!(processing.status_code, 200);
     assert_eq!(processing.body_json.get("done"), Some(&json!(false)));
-    assert_eq!(
-        processing.body_json.get("metadata"),
-        Some(&json!({"state": "PROCESSING"}))
-    );
+    assert_eq!(processing.body_json.get("metadata"), Some(&json!({})));
+    assert!(!processing.body_json.to_string().contains("metadata-secret"));
+    assert!(!processing.body_json.to_string().contains("query-secret"));
 
     assert!(service.project_gemini_task_response(
         "localshort123",

apps/aether-gateway/src/video_tasks/tests/sync.rs

@@ -253,6 +253,13 @@ fn rust_authoritative_service_reads_openai_task_from_local_registry() {
         response.body_json.get("status").and_then(Value::as_str),
         Some("queued")
     );
+
+    assert!(service
+        .read_response_for_user(Some("openai"), "/v1/videos/task-local-123", "user-foreign",)
+        .is_none());
+    assert!(service
+        .read_response_for_user(Some("openai"), "/v1/videos/task-local-123", "user-123",)
+        .is_some());
 }
 
 #[test]