feat(security): harden gateway boundaries and usage policies

Consolidate subscription usage policy enforcement, privacy-safe persistence, and gateway security hardening into one reviewable change.

Includes bounded HTTP and execution envelopes, header and protocol guards, DNS and relay validation, authentication and secret projection hardening, secure backup/install paths, and regression coverage.

crates/aether-oauth/src/network/context.rs

@@ -38,7 +38,7 @@ impl OAuthTimeouts {
     };
 }
 
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Clone, PartialEq)]
 pub struct OAuthNetworkContext {
     pub policy: OAuthNetworkPolicy,
     pub requirement: NetworkRequirement,
@@ -46,6 +46,18 @@ pub struct OAuthNetworkContext {
     pub timeouts: OAuthTimeouts,
 }
 
+impl std::fmt::Debug for OAuthNetworkContext {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OAuthNetworkContext")
+            .field("policy", &self.policy)
+            .field("requirement", &self.requirement)
+            .field("has_proxy", &self.proxy.is_some())
+            .field("timeouts", &self.timeouts)
+            .finish()
+    }
+}
+
 impl OAuthNetworkContext {
     pub fn direct_identity() -> Self {
         Self {
@@ -70,3 +82,24 @@ impl OAuthNetworkContext {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::OAuthNetworkContext;
+    use aether_contracts::ProxySnapshot;
+
+    #[test]
+    fn network_context_debug_output_does_not_expose_proxy_credentials() {
+        let context = OAuthNetworkContext::provider_operation(Some(ProxySnapshot {
+            url: Some("http://proxy-user:[email protected]:8080".to_string()),
+            extra: Some(serde_json::json!({"authorization": "proxy-extra-canary"})),
+            ..ProxySnapshot::default()
+        }));
+
+        let debug = format!("{context:?}");
+        assert!(!debug.contains("proxy-user"));
+        assert!(!debug.contains("proxy-password"));
+        assert!(!debug.contains("proxy-extra-canary"));
+        assert!(debug.contains("has_proxy: true"));
+    }
+}

crates/aether-oauth/src/network/executor.rs

@@ -1,11 +1,13 @@
 use crate::core::OAuthError;
-use aether_contracts::ResolvedTransportProfile;
+use aether_contracts::{redact_url_for_debug, ResolvedTransportProfile};
 use async_trait::async_trait;
 use serde_json::Value;
 use std::collections::BTreeMap;
 
 use super::OAuthNetworkContext;
 
+const OAUTH_HTTP_RESPONSE_BODY_LIMIT_BYTES: usize = 4 * 1024 * 1024;
+
 #[derive(Clone, PartialEq)]
 pub struct OAuthHttpRequest {
     pub request_id: String,
@@ -25,7 +27,7 @@ impl std::fmt::Debug for OAuthHttpRequest {
             .debug_struct("OAuthHttpRequest")
             .field("request_id", &self.request_id)
             .field("method", &self.method)
-            .field("url", &self.url)
+            .field("url", &redact_url_for_debug(&self.url))
             .field("header_names", &self.headers.keys().collect::<Vec<_>>())
             .field("content_type", &self.content_type)
             .field("has_json_body", &self.json_body.is_some())
@@ -43,13 +45,24 @@ impl std::fmt::Debug for OAuthHttpRequest {
     }
 }
 
-#[derive(Debug, Clone, PartialEq)]
+#[derive(Clone, PartialEq)]
 pub struct OAuthHttpResponse {
     pub status_code: u16,
     pub body_text: String,
     pub json_body: Option<Value>,
 }
 
+impl std::fmt::Debug for OAuthHttpResponse {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("OAuthHttpResponse")
+            .field("status_code", &self.status_code)
+            .field("body_bytes_len", &self.body_text.len())
+            .field("has_json_body", &self.json_body.is_some())
+            .finish()
+    }
+}
+
 #[async_trait]
 pub trait OAuthHttpExecutor: Send + Sync {
     async fn execute(&self, request: OAuthHttpRequest) -> Result<OAuthHttpResponse, OAuthError>;
@@ -81,15 +94,29 @@ impl OAuthHttpExecutor for ReqwestOAuthHttpExecutor {
             builder = builder.body(body_bytes.clone());
         }
 
-        let response = builder
+        let mut response = builder
             .send()
             .await
             .map_err(|err| OAuthError::transport(err.to_string()))?;
         let status_code = response.status().as_u16();
-        let body_text = response
-            .text()
+        if response
+            .content_length()
+            .is_some_and(|length| length > OAUTH_HTTP_RESPONSE_BODY_LIMIT_BYTES as u64)
+        {
+            return Err(oauth_http_response_too_large());
+        }
+        let mut body = Vec::new();
+        while let Some(chunk) = response
+            .chunk()
             .await
-            .map_err(|err| OAuthError::transport(err.to_string()))?;
+            .map_err(|err| OAuthError::transport(err.to_string()))?
+        {
+            if chunk.len() > OAUTH_HTTP_RESPONSE_BODY_LIMIT_BYTES.saturating_sub(body.len()) {
+                return Err(oauth_http_response_too_large());
+            }
+            body.extend_from_slice(&chunk);
+        }
+        let body_text = String::from_utf8_lossy(&body).to_string();
         let json_body = serde_json::from_str::<Value>(&body_text).ok();
         Ok(OAuthHttpResponse {
             status_code,
@@ -98,3 +125,51 @@ impl OAuthHttpExecutor for ReqwestOAuthHttpExecutor {
         })
     }
 }
+
+fn oauth_http_response_too_large() -> OAuthError {
+    OAuthError::transport(format!(
+        "OAuth response body exceeds {OAUTH_HTTP_RESPONSE_BODY_LIMIT_BYTES} bytes"
+    ))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{OAuthHttpRequest, OAuthHttpResponse};
+    use crate::network::OAuthNetworkContext;
+    use std::collections::BTreeMap;
+
+    #[test]
+    fn response_debug_output_does_not_expose_token_payloads() {
+        let response = OAuthHttpResponse {
+            status_code: 200,
+            body_text: "{\"access_token\":\"response-body-canary\"}".to_string(),
+            json_body: Some(serde_json::json!({"refresh_token": "response-json-canary"})),
+        };
+
+        let debug = format!("{response:?}");
+        assert!(!debug.contains("response-body-canary"));
+        assert!(!debug.contains("response-json-canary"));
+        assert!(debug.contains("body_bytes_len"));
+    }
+
+    #[test]
+    fn request_debug_redacts_url_credentials_and_query() {
+        let request = OAuthHttpRequest {
+            request_id: "request-1".into(),
+            method: reqwest::Method::GET,
+            url: "https://user:[email protected]/oauth?client_secret=url-secret".into(),
+            headers: BTreeMap::from([("authorization".into(), "Bearer header-secret".into())]),
+            content_type: None,
+            json_body: None,
+            body_bytes: None,
+            network: OAuthNetworkContext::direct_identity(),
+            transport_profile: None,
+        };
+        let debug = format!("{request:?}");
+        assert!(!debug.contains("user"));
+        assert!(!debug.contains("pass"));
+        assert!(!debug.contains("url-secret"));
+        assert!(!debug.contains("header-secret"));
+        assert!(debug.contains("https://example.test/oauth"));
+    }
+}