refactor(scum): declare protected run requests

platform/service/game_client_bridge_test.go

@@ -1,6 +1,7 @@
 package service
 
 import (
+	"strings"
 	"testing"
 	"time"
 
@@ -82,6 +83,38 @@ func TestGameClientBridgeCommandLifecycleAndIdempotency(t *testing.T) {
 	}
 }
 
+func TestProtectedGameClientBridgeRequestIsScopedAndRedacted(t *testing.T) {
+	svc, clock := newGameClientBridgeService(t)
+	plugin, err := svc.store.GamePlugins().Get("game.scum")
+	if err != nil {
+		t.Fatal(err)
+	}
+	plugin.RuntimeProfiles.TransportProfiles = []domain.RuntimeTransportProfile{{Key: "database", Kind: "sqlite", TargetKey: "database", Capabilities: []string{domain.JobCapabilityRemoteRunProtectedSQL}}}
+	plugin.GameClientBridge.Commands = append(plugin.GameClientBridge.Commands, domain.GameClientBridgeCommandDeclaration{Type: "database.request", ApprovalLevel: domain.GameClientBridgeApprovalLevelPlatformAdmin, TimeoutSeconds: 60, MaxPayloadBytes: 4096, ProtectedRequest: &domain.GameClientBridgeProtectedRequestDeclaration{Kind: "sql", TransportKey: "database", TargetKey: "database", TextField: "requestText", MaxTextBytes: 1024}})
+	if err := svc.store.GamePlugins().Update(plugin); err != nil {
+		t.Fatal(err)
+	}
+	text := "UPDATE players SET rank = 2 WHERE id = 7"
+	request := domain.GameClientBridgeQueueRequest{ServerInstanceID: "server-1", PluginID: "game.scum", ProfileKey: "scum-client", CommandType: "database.request", Payload: map[string]any{"requestText": text}, IdempotencyKey: "protected-1", ExpiresAt: clock.Add(time.Minute)}
+	command, err := svc.queueGameClientBridgeCommand("user-1", request)
+	if err != nil {
+		t.Fatalf("queue protected request: %v", err)
+	}
+	if command.ApprovalState != domain.GameClientBridgeApprovalPending {
+		t.Fatalf("protected request bypassed approval: %#v", command)
+	}
+	if _, err := svc.queueGameClientBridgeCommand("user-1", domain.GameClientBridgeQueueRequest{ServerInstanceID: "server-1", PluginID: "game.scum", ProfileKey: "scum-client", CommandType: "database.request", Payload: map[string]any{"requestText": text, "unexpected": true}, IdempotencyKey: "protected-extra", ExpiresAt: clock.Add(time.Minute)}); err == nil {
+		t.Fatal("protected request accepted undeclared payload field")
+	}
+	events, err := svc.store.AuditEvents().List(domain.AuditEventFilter{ResourceID: command.ID})
+	if err != nil || len(events) != 1 {
+		t.Fatalf("protected request audit: events=%#v err=%v", events, err)
+	}
+	if strings.Contains(events[0].Summary, text) || !strings.Contains(events[0].Summary, "text=redacted") {
+		t.Fatalf("audit leaked protected request: %#v", events[0])
+	}
+}
+
 func TestGameClientBridgeIdempotencyScopeIsAppliedByService(t *testing.T) {
 	svc, clock := newGameClientBridgeService(t)
 	request := bridgeQueueRequest(*clock, "scope-key")