App and module tokens act only for their on_behalf_of person; sandbox tokens refused

ddiff --git a/server/auth/viewer.js b/server/auth/viewer.js
iindex c83fc5b..649193c 100644
---- a/server/auth/viewer.js
++++ b/server/auth/viewer.js
@@@ -15,7 +15,9 @@
   *   { kind: 'service', service, claims, subject, origin } Bearer Network client-credentials token for
   *                                                         audience openvibe.coupons; X-OV-Subject names
   *                                                         the person it acts for, X-OV-Origin: ai marks
-- *                                                         model output (OpenVibe.AI coupons.extract_coupon)
++ *                                                         model output (OpenVibe.AI coupons.extract_coupon).
++ *                                                         Apps (app:…) and modules (mod:…) act only for
++ *                                                         their on_behalf_of person; sandbox tokens: 401
   *   { kind: 'user', subject, staff, user }                Bearer Network user JWT (apps)
   * A presented credential that does not verify is refused (401), never downgraded to anonymous.
   *
@@@ -47,15 +49,28 @@ function createViewerResolver({ auth, config, installs }) {
          if (!publicKey) throw new ApiError(503, 'identity.unavailable', 'the Network signing key is not loaded yet');
          const r = serviceAuth.verifyServiceToken(token, { publicKey, issuer: config.networkUrl, audience: AUDIENCE });
          if (!r.ok) throw new ApiError(401, r.code, r.reason);
++        // Developer apps (app:…) and modules (mod:…) are third parties: they act only for the person
++        // who authorized them (on_behalf_of), never for whoever X-OV-Subject names. Only first-party
++        // service principals (svc:…) are trusted to name the acting person.
++        const claims = r.claims;
++        const firstParty = claims.actor_type === 'service' && String(claims.sub).startsWith('svc:');
++        if (!firstParty && claims.env !== undefined && claims.env !== 'production') {
++            throw new ApiError(401, 'token.sandbox_refused', 'sandbox tokens are not accepted by openvibe.coupons');
++        }
          const originHeader = req.get('x-ov-origin');
          if (originHeader && originHeader !== 'ai' && originHeader !== 'user') throw new ApiError(400, 'request.invalid_origin', 'X-OV-Origin must be "ai" or "user"');
          const subjectHeader = req.get('x-ov-subject');
          let subject = null;
          if (subjectHeader) {
              if (!ids.isSubjectId('user', subjectHeader)) throw new ApiError(400, 'subject.invalid', 'X-OV-Subject must be a usr_… subject id');
++            if (!firstParty && subjectHeader !== claims.on_behalf_of) {
++                throw new ApiError(403, 'subject.not_delegated', 'an app acts only for the person who authorized it (on_behalf_of)');
++            }
              subject = subjectHeader;
++        } else if (!firstParty && ids.isSubjectId('user', claims.on_behalf_of)) {
++            subject = claims.on_behalf_of;
          }
--        return { kind: 'service', service: r.claims.sub, claims: r.claims, subject, origin: originHeader === 'ai' ? 'ai' : 'user', staff: false };
++        return { kind: 'service', service: claims.sub, claims, subject, origin: originHeader === 'ai' ? 'ai' : 'user', staff: false };
      }
  
      /** API callers: the Authorization header only. */
ddiff --git a/test/delegation.test.js b/test/delegation.test.js
nnew file mode 100644
iindex 0000000..1956855
---- /dev/null
++++ b/test/delegation.test.js
@@@ -0,0 +1,58 @@
++'use strict';
++/**
++ * Third-party principals: a developer app (app:…) or module (mod:…) token acts only for the person
++ * in its on_behalf_of claim. X-OV-Subject naming anyone else is refused, and so are sandbox tokens.
++ * First-party services (svc:…) still name the person they act for.
++ */
++const assert = require('assert');
++const { boot, check, done } = require('./helpers/boot');
++
++const APP = 'app:app_01J8ZQ4Y7N3M2K1H0G9F8E7D6C';
++const MOD = 'mod:mod_01J8ZQ4Y7N3M2K1H0G9F8E7D6C';
++
++(async () => {
++    const t = await boot();
++    const alice = t.network.addUser('alice');
++    const victim = t.network.addUser('victim');
++    const appUser = t.network.addUser('appuser');
++    await t.merchant({ name: 'Tin Robot', host: 'tinrobot.shop' });
++    const code = (await t.submit(alice, { host: 'tinrobot.shop', code: 'BEEP10', title: 'Ten off robots' })).json().coupon;
++    const caps = ['coupons.report.create', 'coupons.coupon.submit'];
++    const appToken = (sub, actorType, extra) => t.network.signService({ sub, actorType, aud: ['openvibe.coupons'], cap: caps, extra });
++    const report = (token, headers) => t.get(`/api/v1/coupons/${code.id}/report`, { as: token, headers, json: { outcome: 'failed', reason: 'invalid' } });
++    const reportsOf = (subject) => t.ctx.store.db.prepare('SELECT COUNT(*) AS n FROM coupon_validation_reports WHERE reporter_key = ?').get(t.ctx.reports.reporterKey(subject)).n;
++
++    await check('an app token cannot act for someone else by naming them in X-OV-Subject', async () => {
++        for (const [sub, type] of [[APP, 'app'], [MOD, 'mod']]) {
++            const r = await report(appToken(sub, type, { on_behalf_of: appUser.subject }), { 'x-ov-subject': victim.subject });
++            assert.strictEqual(r.status, 403, `${type}: ${r.text}`);
++            assert.strictEqual(r.json().code, 'subject.not_delegated');
++            const noDelegation = await report(appToken(sub, type, {}), { 'x-ov-subject': victim.subject });
++            assert.strictEqual(noDelegation.status, 403, `${type} without on_behalf_of`);
++        }
++        const sub = await t.get('/api/v1/coupons/submit', { as: appToken(APP, 'app', {}), headers: { 'x-ov-subject': victim.subject }, json: { host: 'tinrobot.shop', code: 'FAKE99', title: 'Made up' } });
++        assert.strictEqual(sub.status, 403);
++        assert.strictEqual(reportsOf(victim.subject), 0);
++    });
++
++    await check('an app token acts for its on_behalf_of person (header optional, must match)', async () => {
++        const token = appToken(APP, 'app', { on_behalf_of: appUser.subject });
++        assert.strictEqual((await report(token)).status, 201);
++        assert.strictEqual((await report(token, { 'x-ov-subject': appUser.subject })).status, 200, 'same person, same day: deduplicated');
++        assert.strictEqual(reportsOf(appUser.subject), 1);
++    });
++
++    await check('sandbox app tokens are refused', async () => {
++        const r = await report(appToken(APP, 'app', { on_behalf_of: appUser.subject, env: 'sandbox' }));
++        assert.strictEqual(r.status, 401);
++        assert.strictEqual(r.json().code, 'token.sandbox_refused');
++    });
++
++    await check('first-party services still name the person they act for', async () => {
++        const svc = t.network.serviceToken('live', caps);
++        assert.strictEqual((await report(svc, { 'x-ov-subject': victim.subject })).status, 201);
++    });
++
++    await t.close();
++    done();
++})();
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex da2e88f..0e0c728 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -52,8 +52,8 @@ async function startNetwork() {
          return json(404, { error: 'not found' });
      });
      issuer = srv.url;
--    function signService({ sub, aud, cap }) {
--        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: 'service', aud, cap, iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID() }, privatePem);
++    function signService({ sub, aud, cap, actorType = 'service', extra = {} }) {
++        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...extra }, privatePem);
      }
      function addUser(username, extra = {}) {
          return { subject: ids.newId('user'), username, display_name: extra.display_name || username, role: extra.role || 'user' };