Enforce scoped permissions (ODRL data windows) from dauth tokens

[elffjs]

What

Companion to DIMO-Network/dauth#17. dauth's exchange can now mint permissions granted only for data recorded within a time window (DIMO ODRL profile v1, dimo:recordedAt). Those arrive in a new scoped_permissions claim:

"permissions": ["privilege:GetNonLocationHistory"],
"scoped_permissions": [
  { "name": "privilege:GetLocationHistory",
    "constraint": [
      { "leftOperand": "dimo:recordedAt", "operator": "gteq", "rightOperand": "2026-04-01T00:00:00Z" },
      { "leftOperand": "dimo:recordedAt", "operator": "lt",   "rightOperand": "2026-07-01T00:00:00Z" } ] } ]

The encoding is fail-closed by construction: windowed permissions are deliberately absent from the flat permissions array, so dq as deployed today already refuses windowed tokens everywhere with zero changes. This PR opens each surface deliberately, with the window enforced. The new internal/scope package is the one place that reads scoped_permissions — always alongside its constraints — and a constraint dq cannot interpret grants nothing.

Enforcement model

Ranged queries reject; point queries window-evaluate. The dividing line is whether the response could misrepresent what was computed:

• Ranged queries — signals, events, segments, dailyActivity, and cloud-event reads (after/before) — are rejected when the requested range exceeds the window, with the window named in the error. Silent clamping would return an aggregate computed over a narrower range than requested, labeled as the full range — a wrong answer presented as right. An absent range means "all time" and only an unbounded grant passes, so integrators must state ranges inside their window.
• Latest-value queries — signalsLatest, signalsSnapshot — are evaluated within the window: a value recorded outside it is withheld, which is indistinguishable from the vehicle not having transmitted then, and every returned value carries its timestamp, keeping results self-describing. The derived approximate location is gated separately from the raw coordinates row (either qualifying permission may allow a timestamp the other does not).
• Possession checks (schema directives, per-signal privilege filter) count scoped permissions as held; the window is enforced at the layers above.

Surfaces that stay closed for scoped grants (all-time facts that can't be windowed post hoc; follow-up work to teach them window-bounded queries):

• availableSignals / dataSummary exclude signals behind scoped permissions — listing a name or a count/first-seen asserts all-time facts. The summary's top-level first/last-seen fold is recomputed from surviving entries so it can't leak filtered timestamps.
• lastSeen (computed across every signal) is suppressed for scoped tokens.
• The gRPC fetch surface still reads only the flat claim — scoped grants don't open it.

Files

• internal/scope/ — possession + window evaluation over the token (Holds, Unscoped, AllowsRange, AllowsAt, Describe), fail-closed on unknown constraint vocabulary
• internal/auth/directives.go — directives accept scoped possession
• internal/graph/privilege_filter.go — token-aware per-signal checks: possession, unscoped-only, range, per-value visibility
• internal/graph/arguments.go — per-signal range rejection for signals; latest-args window hooks + lastSeen suppression
• internal/graph/base.resolvers.go, events.resolvers.go, segments.resolvers.go — surface wiring
• internal/graph/auth_helpers.go — cloud-event raw-data path: unscoped fast path, windowed path requires in-window after/before
• internal/repositories/signals.go + internal/graph/model/signalArgs.go — latest-row window filter; approximate location derived from the raw row so it can be served when the raw coordinates are withheld
• internal/auth/grpc.go — comment documenting the (already fail-closed) scoped behavior

⚠️ Before merge

go.mod temporarily carries replace github.com/DIMO-Network/dauth => ../dauth so CI here will fail until DIMO-Network/dauth#17 merges and a dauth version is tagged; then the replace is dropped and the requirement bumped.

Testing

• internal/scope: possession/window semantics, exclusive vs inclusive bounds, fail-closed on uninterpretable constraints (a geofence-constrained grant is "held" but allows no data).
• internal/graph/scoped_windows_test.go: per-signal range checks (windowed location vs unconditional non-location, derived approximate location), per-value visibility, unscoped-only filtering for the all-time surfaces, and the cloud-event path (in-window bounds pass; exceeding or absent bounds rejected; unconditional raw-data unaffected).
• Full build, vet, and test suite pass (with the local replace).

🤖 Generated with Claude Code