security: harden first preview boundaries

Sanitized snapshot of private source 13a965dd6ea705dd92499f7dbeaa00c25c15247d. Require same-origin evidence for unsafe methods, fail closed on invalid authentication middleware configuration, and bound untrusted request metadata.

AI-Assistance: OpenAI Codex assisted implementation, testing, and security review.
Signed-off-by: Cole Speelman <crspeelman@gmail.com>

auth/auth.go

@@ -192,6 +192,9 @@ func (service *Service) Session(ctx context.Context, token string) (Principal, e
 }
 
 func (service *Service) RevokeSession(ctx context.Context, token string) error {
+	if len(token) < 32 || len(token) > 128 {
+		return ErrSessionNotFound
+	}
 	digest := sha256.Sum256([]byte(token))
 	return service.repository.DeleteSession(ctx, digest)
 }

auth/service_test.go

@@ -29,6 +29,30 @@ func TestSessionDistinguishesMissingFromUnavailableStorage(t *testing.T) {
 	}
 }
 
+func TestRevokeSessionRejectsInvalidTokenBeforeStorage(t *testing.T) {
+	repository := &recordingRepository{}
+	service, err := New(repository, Options{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err = service.RevokeSession(t.Context(), "short"); !errors.Is(err, ErrSessionNotFound) {
+		t.Fatalf("err=%v", err)
+	}
+	if repository.deleted {
+		t.Fatal("storage called for invalid token")
+	}
+}
+
+type recordingRepository struct {
+	repositoryStub
+	deleted bool
+}
+
+func (repository *recordingRepository) DeleteSession(context.Context, [32]byte) error {
+	repository.deleted = true
+	return nil
+}
+
 type repositoryStub struct{ sessionErr error }
 
 func (repositoryStub) CreateUser(context.Context, User, string) error { return nil }