fix(auth): enforce marketplace permission constraints

[cristim]

Marketplace list and cancel could ignore permission constraints, let sell-any bypass account scope, and use a bearer session's broader permissions despite a narrower API key. Both routes now select the effective principal's sell action and check the stored purchase's account, provider, service, and region before provider calls or listing writes.

Mixed key and bearer credentials must have the same owner. Existing session-only eligibility remains, and a selected action's constraint denial cannot fall back to a broader identity or another action. Missing record metadata requires an unrestricted grant for that dimension. No sale-price limit is inferred from purchase-amount constraints.

Validation:

• Real HTTP into HandleRequest and the production router, backed by real auth service and PostgreSQL stores. The baseline reproduced 34 unauthorized successful mutations across both routes; positive controls passed. The fixed matrix verifies persisted success, unchanged denied rows, and zero provider-factory calls on denial.
• Covers constrained admins, independent account scope, key-owner intersection, same-owner key-own grants, mixed-owner rejection, missing metadata, legacy unrestricted records, credential eligibility, and terminal any-action denial.
• Focused tests cover sell/revoke action selection and permission/account/constraint lookup errors. Existing marketplace pricing, claims, and provider-error regressions pass.
• HTTP/auth forwarding adapters, cached AWS configuration, and the EC2 client are fixtures. Authorization and persistence are real. Local PostgreSQL 17 substitutes only the testcontainers bootstrap; no SDK or cloud mutation runs.
• Go 1.26.6 race checks, build, pinned golangci-lint 2.10.1, and all normal commit hooks passed.
• Independent gpt-6-astra review approved exact commit a3ec6f6c7ed2858403ce52500cebc3bfb0f0b3f1 with no actionable findings. The reviewer independently reproduced all 34 baseline violations, then passed the committed HTTP, lookup-error, and action-selection tests with the race detector in 3.844s on a fresh PostgreSQL database.

Refs #404. Depends on merged #456. This is part 2: scheduled/completed revoke and Azure refund quote enforcement remain required, so #404 stays open.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 5 billable files and costs up to $1.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 23 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 70 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: f63d0e63-4d7c-4346-98ac-d71572b8a95d

📥 Commits

Reviewing files that changed from the base of the PR and between 82b251c and a3ec6f6.

📒 Files selected for processing (5)

• internal/api/handler_marketplace.go
• internal/api/handler_marketplace_test.go
• internal/api/handler_purchase_action.go
• internal/api/handler_purchase_action_test.go
• internal/api/permission_constraints_marketplace_integration_test.go

---

_{Comment @coderabbitai help to get the list of available commands.}