feat(cloud-auth): bind host principals

tests/test_cloud_auth.py

@@ -3,9 +3,12 @@ from __future__ import annotations
 from dataclasses import dataclass
 
 import cloud.auth as auth_module
+import pytest
 from cloud.auth import (
     BearerCredential,
     ConfiguredBearerAuthProvider,
+    HostIdentityMismatchError,
+    HostPrincipalRequiredError,
     NullAuthProvider,
 )
 
@@ -91,3 +94,56 @@ def test_null_auth_provider_is_explicitly_unrestricted() -> None:
     assert principal is not None
     assert principal.id == "anonymous"
     assert principal.scopes == frozenset({"*"})
+
+
+def test_host_credential_authenticates_as_one_bound_host() -> None:
+    provider = ConfiguredBearerAuthProvider(
+        [
+            BearerCredential(
+                principal_id="host-agent-a",
+                token="host-secret",
+                scopes=frozenset({"host:agent"}),
+                host_id="host-a",
+            )
+        ]
+    )
+
+    principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer host-secret"})
+    )
+
+    assert principal is not None
+    assert principal.host_id == "host-a"
+    principal.require_host("host-a")
+
+
+def test_host_principal_rejects_cross_host_operation() -> None:
+    provider = ConfiguredBearerAuthProvider(
+        [
+            BearerCredential(
+                principal_id="host-agent-a",
+                token="host-secret",
+                host_id="host-a",
+            )
+        ]
+    )
+    principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer host-secret"})
+    )
+
+    assert principal is not None
+    with pytest.raises(HostIdentityMismatchError):
+        principal.require_host("host-b")
+
+
+def test_public_principal_cannot_act_as_host() -> None:
+    provider = ConfiguredBearerAuthProvider(
+        [BearerCredential(principal_id="integrator", token="public-secret")]
+    )
+    principal = provider.authenticate(
+        _Request(headers={"authorization": "Bearer public-secret"})
+    )
+
+    assert principal is not None
+    with pytest.raises(HostPrincipalRequiredError):
+        principal.require_host("host-a")