fix: address PR #6 review (auth policy, gitleaks, events, SDK redaction, tests)

- PolicyAuthenticator: api_key_sso with nil Remote returns api_key_sso_misconfigured
- Widen gitleaks testdata allowlist; gitleaks git pre-commit; Windows hooks-install.ps1
- Reject BuildOptions.AuthEventSink when event_delivery is not custom
- Move auth leak fixtures to testkit; opaque subtest names; InboundCallMeta String/GoString
- archtest: lipsdk/auth closure uses go list -deps; listener ErrMalformedListenAddress
- auth_compose: lowercase renderer keys; local_noop OnOSIdentityFallback + bundle slog
- Config sentinels, accessmode kinds, challenge cap constant, osidentity/USER/USERNAME, execview
- pluginreg: authErrorRenderers init, RegisterAuthErrorRenderer id order; bootlog error wrap
- Minor: default listen constant, doc quotes, conformance lipAuthProvider rename

Made-with: Cursor

Author: Mateusz

.gitleaks.toml

@@ -7,7 +7,7 @@ title = "go-llm-interactive-proxy gitleaks config"
 useDefault = true
 
 [[allowlists]]
-description = "Test fixtures and golden files"
+description = "Test fixtures and golden files (any package testdata/ segment)"
 paths = [
-  '''^testdata/''',
+  '''(^|/)testdata/''',
 ]

Makefile

@@ -132,4 +132,8 @@ run:
 	$(GO) run ./cmd/lipstd --config ./config/config.yaml
 
 hooks-install:
+ifeq ($(OS),Windows_NT)
+	@powershell -NoProfile -ExecutionPolicy Bypass -File scripts/install-hooks.ps1
+else
 	@bash scripts/install-hooks.sh
+endif

cmd/lipstd/bootlog.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"context"
+	"fmt"
 	"log/slog"
 
 	"github.com/matdev83/go-llm-interactive-proxy/internal/core/config"
@@ -14,7 +15,7 @@ func logBootstrapAccessAuth(ctx context.Context, log *slog.Logger, cfg *config.C
 	accessMode, err := cfg.EffectiveAccessMode()
 	if err != nil {
 		log.ErrorContext(ctx, "lipstd: resolve effective access mode", "error", err)
-		return err
+		return fmt.Errorf("lipstd: bootstrap access/auth: %w", err)
 	}
 	effHandler, effLevel := cfg.EffectiveAuthForAudit()
 	log.InfoContext(ctx, "lipstd: effective access and authentication",

internal/archtest/contract_lipapi_auth_imports_test.go

@@ -21,20 +21,21 @@ func TestPkgLipapiDoesNotImportAuthSDKPackages(t *testing.T) {
 	assertGoListImportsExclude(t, "./pkg/lipapi", forbidden)
 }
 
+// lipsdkAuthImportClosureForbidden is matched against every ImportPath in `go list -deps` for
+// ./pkg/lipsdk/auth (transitive closure, same policy as the former direct-imports-only check).
+var lipsdkAuthImportClosureForbidden = []forbiddenDep{
+	{Substr: "/internal/core/", ErrMsg: "pkg/lipsdk/auth must not depend on internal/core (transitively)"},
+	{Substr: "/internal/plugins/", ErrMsg: "pkg/lipsdk/auth must not depend on internal/plugins (transitively)"},
+	{Substr: "github.com/openai/openai-go", ErrMsg: "pkg/lipsdk/auth must not depend on OpenAI Go SDK (transitively)"},
+	{Substr: "github.com/anthropics/anthropic-sdk-go", ErrMsg: "pkg/lipsdk/auth must not depend on Anthropic SDK (transitively)"},
+	{Substr: "github.com/aws/aws-sdk-go-v2", ErrMsg: "pkg/lipsdk/auth must not depend on AWS SDKs (transitively)"},
+}
+
 // TestPkgLipsdkAuthImportClosure_staysSDKLocal ensures public auth DTOs do not pull core, plugins,
 // or provider SDKs into the stable auth package (task 10.4, complements task 1.4).
 func TestPkgLipsdkAuthImportClosure_staysSDKLocal(t *testing.T) {
 	t.Parallel()
-	forbidden := []struct {
-		sub, msg string
-	}{
-		{"/internal/core/", "pkg/lipsdk/auth must not import internal/core"},
-		{"/internal/plugins/", "pkg/lipsdk/auth must not import concrete protocol plugins"},
-		{"github.com/openai/openai-go", "pkg/lipsdk/auth must not import OpenAI provider SDK"},
-		{"github.com/anthropics/anthropic-sdk-go", "pkg/lipsdk/auth must not import Anthropic SDK"},
-		{"github.com/aws/aws-sdk-go-v2", "pkg/lipsdk/auth must not import AWS SDKs"},
-	}
-	assertGoListImportsExclude(t, "./pkg/lipsdk/auth", forbidden)
+	assertDepsExcludeForbidden(t, []string{"./pkg/lipsdk/auth"}, lipsdkAuthImportClosureForbidden)
 }
 
 func assertGoListImportsExclude(t *testing.T, goListPattern string, forbidden []struct {

internal/core/accessmode/errors.go

@@ -19,3 +19,7 @@ var (
 	ErrMultiUserUnknownRequiredLevel = errors.New("access.mode: multi_user unknown auth.required_level")
 	ErrMultiUserInternalUnknownMode  = errors.New("access.mode: internal error, unknown mode")
 )
+
+// ErrMalformedListenAddress is returned by [ClassifyListenAddress] when the address is not
+// a usable host:port bind string (e.g. empty, missing port, or unparseable).
+var ErrMalformedListenAddress = errors.New("accessmode: malformed listen address")

internal/core/accessmode/listener.go

@@ -29,12 +29,14 @@ type ListenClassification struct {
 func ClassifyListenAddress(raw string) (ListenClassification, error) {
 	s := strings.TrimSpace(raw)
 	if s == "" {
-		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, nil
+		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, ErrMalformedListenAddress
 	}
 
 	host, port, err := net.SplitHostPort(s)
 	if err != nil {
-		// Bare IP or hostname without a port (legacy configs); treat like host-only.
+		// Bare IP or hostname without a port (legacy configs): classify surface with empty Port.
+		// Other validation may require an explicit port (host:port) and map port-less values to
+		// [SurfaceMalformed] with [ErrMalformedListenAddress] instead of this path.
 		h := strings.TrimSpace(s)
 		if ip := net.ParseIP(h); ip != nil {
 			switch {
@@ -49,13 +51,14 @@ func ClassifyListenAddress(raw string) (ListenClassification, error) {
 		if strings.EqualFold(h, "localhost") {
 			return ListenClassification{Raw: raw, Host: h, Port: port, Surface: SurfaceLoopback}, nil
 		}
-		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, nil
+		// Legacy bare host without port is supported above for IPs/localhost; other shapes are malformed.
+		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, ErrMalformedListenAddress
 	}
 
 	host = strings.TrimSpace(host)
 	port = strings.TrimSpace(port)
 	if port == "" {
-		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, nil
+		return ListenClassification{Raw: raw, Surface: SurfaceMalformed}, ErrMalformedListenAddress
 	}
 
 	// All IPv4 interfaces or IPv6 unspecified.

internal/core/accessmode/listener_test.go

@@ -1,6 +1,7 @@
 package accessmode
 
 import (
+	"errors"
 	"testing"
 )
 
@@ -25,8 +26,14 @@ func TestClassifyListenAddress(t *testing.T) {
 		{raw: ":::9", want: SurfaceMalformed},
 	} {
 		got, err := ClassifyListenAddress(tc.raw)
-		if err != nil && tc.want != SurfaceMalformed {
-			t.Fatalf("raw %q: unexpected err %v", tc.raw, err)
+		if tc.want == SurfaceMalformed {
+			if !errors.Is(err, ErrMalformedListenAddress) {
+				t.Fatalf("raw %q: want %v, got %v; surface %q", tc.raw, ErrMalformedListenAddress, err, got.Surface)
+			}
+		} else {
+			if err != nil {
+				t.Fatalf("raw %q: unexpected err %v", tc.raw, err)
+			}
 		}
 		if got.Surface != tc.want {
 			t.Fatalf("raw %q: want surface %q got %q (host=%q port=%q)", tc.raw, tc.want, got.Surface, got.Host, got.Port)

internal/core/accessmode/validate.go

@@ -3,6 +3,8 @@ package accessmode
 import (
 	"fmt"
 	"strings"
+
+	sdkauth "github.com/matdev83/go-llm-interactive-proxy/pkg/lipsdk/auth"
 )
 
 // PostureInput carries effective access, listener, and auth policy for startup validation.
@@ -69,27 +71,27 @@ func validateMultiUserAuth(in PostureInput) error {
 	if h == "" {
 		return fmt.Errorf("%w", ErrMultiUserHandlerRequired)
 	}
-	if h == "local_noop" {
+	if h == string(sdkauth.HandlerLocalNoop) {
 		return fmt.Errorf(
 			"%w (configure auth.handler local_api_key or remote)",
 			ErrMultiUserLocalNoopDisallowed,
 		)
 	}
-	if rl == "" || rl == "none" {
+	if rl == "" || rl == string(sdkauth.LevelNone) {
 		return fmt.Errorf(
 			"%w (e.g. api_key or api_key_sso)",
 			ErrMultiUserRequiredLevelTooWeak,
 		)
 	}
 
 	switch h {
-	case "local_api_key", "remote":
+	case string(sdkauth.HandlerLocalAPIKey), string(sdkauth.HandlerRemote):
 	default:
 		return fmt.Errorf("%w: %q", ErrMultiUserUnknownHandler, in.Handler)
 	}
 
 	switch rl {
-	case "api_key", "api_key_sso":
+	case string(sdkauth.LevelAPIKey), string(sdkauth.LevelAPIKeySSO):
 	default:
 		return fmt.Errorf("%w: %q", ErrMultiUserUnknownRequiredLevel, in.RequiredLevel)
 	}

internal/core/accessmode/validate_test.go

@@ -2,6 +2,7 @@ package accessmode
 
 import (
 	"errors"
+	"sort"
 	"testing"
 )
 
@@ -59,7 +60,7 @@ func TestValidatePosture_multiUserRequiresStrongAuth(t *testing.T) {
 	}); err != nil {
 		t.Fatal(err)
 	}
-	for name, tc := range map[string]struct {
+	cases := map[string]struct {
 		in   PostureInput
 		want error
 	}{
@@ -91,9 +92,20 @@ func TestValidatePosture_multiUserRequiresStrongAuth(t *testing.T) {
 			},
 			want: ErrMultiUserIncompatibleNoAuth,
 		},
-	} {
-		if err := ValidatePosture(tc.in); err == nil || !errors.Is(err, tc.want) {
-			t.Fatalf("%s: want %v, got %v", name, tc.want, err)
-		}
+	}
+	names := make([]string, 0, len(cases))
+	for n := range cases {
+		names = append(names, n)
+	}
+	sort.Strings(names)
+	for _, name := range names {
+		name := name
+		tc := cases[name]
+		t.Run(name, func(t *testing.T) {
+			t.Parallel()
+			if err := ValidatePosture(tc.in); err == nil || !errors.Is(err, tc.want) {
+				t.Fatalf("want %v, got %v", tc.want, err)
+			}
+		})
 	}
 }

internal/core/auth/errors.go

@@ -3,4 +3,8 @@ package auth
 import "errors"
 
 // ErrDuplicateLocalAPIKeyID is returned when two records share the same key_id.
-var ErrDuplicateLocalAPIKeyID = errors.New("auth.local_api_keys: duplicate key_id")
+var (
+	ErrDuplicateLocalAPIKeyID       = errors.New("auth.local_api_keys: duplicate key_id")
+	ErrDuplicateLocalAPIKeyMaterial = errors.New("auth.local_api_keys: duplicate key material")
+	ErrLocalAPIKeyEmpty             = errors.New("auth.local_api_keys: key is required")
+)