App and module tokens act only for their on_behalf_of person; sandbox tokens refused

ddiff --git a/server/auth/viewer.js b/server/auth/viewer.js
iindex b5c8b9e..b08301f 100644
---- a/server/auth/viewer.js
++++ b/server/auth/viewer.js
@@@ -12,6 +12,8 @@
   *       X-OV-Subject names the editor it acts for; X-OV-Origin: ai marks OpenVibe.AI output
   *       (news.summarize_story, news.compare_perspectives), which is never attributed to a person:
   *       it is an AI-generated draft revision that needs a person's review before publication.
++ *       Developer-app (app:…) and module (mod:…) tokens act only for the person in their
++ *       on_behalf_of claim: X-OV-Subject naming anyone else is 403, and sandbox tokens are 401.
   *
   * Identity never comes from a request body or query. A request presenting a service token is judged
   * on that token alone: a bad one is refused (problem+json), never downgraded to anonymous.
@@@ -37,15 +39,28 @@ function createViewerResolver({ auth, config, people }) {
          if (!publicKey) throw new ViewerError(503, 'identity.unavailable', 'the Network signing key is not loaded yet');
          const r = serviceAuth.verifyServiceToken(token, { publicKey, issuer: config.networkUrl, audience: AUDIENCE });
          if (!r.ok) throw new ViewerError(401, r.code, r.reason);
++        // Developer apps (app:…) and modules (mod:…) are third parties: they act only for the person
++        // who authorized them (on_behalf_of), never for whoever X-OV-Subject names. Only first-party
++        // service principals (svc:…) are trusted to name the acting person.
++        const claims = r.claims;
++        const firstParty = claims.actor_type === 'service' && String(claims.sub).startsWith('svc:');
++        if (!firstParty && claims.env !== undefined && claims.env !== 'production') {
++            throw new ViewerError(401, 'token.sandbox_refused', 'sandbox tokens are not accepted by openvibe.news');
++        }
          const originHeader = req.get('x-ov-origin');
          if (originHeader && originHeader !== 'ai' && originHeader !== 'user') throw new ViewerError(400, 'request.invalid_origin', 'X-OV-Origin must be "ai" or "user"');
          const subjectHeader = req.get('x-ov-subject');
          let subject = null;
          if (subjectHeader) {
              if (!ids.isSubjectId('user', subjectHeader)) throw new ViewerError(400, 'subject.invalid', 'X-OV-Subject must be a usr_… subject id');
++            if (!firstParty && subjectHeader !== claims.on_behalf_of) {
++                throw new ViewerError(403, 'subject.not_delegated', 'an app acts only for the person who authorized it (on_behalf_of)');
++            }
              subject = subjectHeader;
++        } else if (!firstParty && ids.isSubjectId('user', claims.on_behalf_of)) {
++            subject = claims.on_behalf_of;
          }
--        return { kind: 'service', service: r.claims.sub, claims: r.claims, subject, origin: originHeader === 'ai' ? 'ai' : 'user', staff: false };
++        return { kind: 'service', service: claims.sub, claims, subject, origin: originHeader === 'ai' ? 'ai' : 'user', staff: false };
      }
  
      async function fromUserToken(token) {
ddiff --git a/test/delegation.test.js b/test/delegation.test.js
nnew file mode 100644
iindex 0000000..d29bf69
---- /dev/null
++++ b/test/delegation.test.js
@@@ -0,0 +1,54 @@
++'use strict';
++/**
++ * Third-party principals: a developer app (app:…) or module (mod:…) token acts only for the person
++ * in its on_behalf_of claim. X-OV-Subject naming anyone else (here: a News editor) is refused
++ * (403 subject.not_delegated), and so are sandbox tokens (401 token.sandbox_refused). First-party
++ * services (svc:…) still name the person they act for.
++ */
++const assert = require('assert');
++const { boot, check, done } = require('./helpers/boot');
++
++const APP = 'app:app_01J8ZQ4Y7N3M2K1H0G9F8E7D6C';
++const MOD = 'mod:mod_01J8ZQ4Y7N3M2K1H0G9F8E7D6C';
++
++(async () => {
++    const t = await boot();
++    const reader = t.network.addUser('reader');
++    const caps = ['news.topic.manage', 'news.story.create'];
++    const token = (sub, actorType, extra) => t.network.signService({ sub, actorType, aud: ['openvibe.news'], cap: caps, extra });
++    const topicsNamed = (name) => t.ctx.store.db.prepare('SELECT COUNT(*) AS n FROM news_topics WHERE name = ?').get(name).n;
++    const newTopic = (as, name, headers) => t.get('/api/v1/topics', { as, headers, json: { name } });
++
++    await check('an app or module cannot act as an editor by naming them in X-OV-Subject', async () => {
++        for (const [sub, type] of [[APP, 'app'], [MOD, 'mod']]) {
++            for (const extra of [{ on_behalf_of: reader.subject }, {}]) {
++                const r = await newTopic(token(sub, type, extra), `Planted by ${type}`, { 'x-ov-subject': t.editor.subject });
++                assert.strictEqual(r.status, 403, `${type} ${JSON.stringify(extra)}: ${r.text}`);
++                assert.strictEqual(r.json().code, 'subject.not_delegated');
++                assert.strictEqual(topicsNamed(`Planted by ${type}`), 0);
++            }
++        }
++    });
++
++    await check('an app acts for its on_behalf_of person, with that person\'s rights', async () => {
++        let r = await newTopic(token(APP, 'app', { on_behalf_of: reader.subject }), 'Reader topic');
++        assert.strictEqual(r.status, 403, r.text);
++        assert.strictEqual(r.json().code, 'news.editor_required', 'acts as the reader, who is no editor');
++        r = await newTopic(token(APP, 'app', { on_behalf_of: t.editor.subject }), 'Editor topic via app', { 'x-ov-subject': t.editor.subject });
++        assert.strictEqual(r.status, 201, r.text);
++    });
++
++    await check('sandbox app tokens are refused', async () => {
++        const r = await newTopic(token(APP, 'app', { on_behalf_of: t.editor.subject, env: 'sandbox' }), 'Sandbox topic');
++        assert.strictEqual(r.status, 401);
++        assert.strictEqual(r.json().code, 'token.sandbox_refused');
++    });
++
++    await check('first-party services still name the person they act for', async () => {
++        const r = await newTopic(t.network.serviceToken('tools', caps), 'Editor topic via svc', { 'x-ov-subject': t.editor.subject });
++        assert.strictEqual(r.status, 201, r.text);
++    });
++
++    await t.close();
++    done();
++})();
ddiff --git a/test/helpers/mocks.js b/test/helpers/mocks.js
iindex 53a26f7..c14c1b8 100644
---- a/test/helpers/mocks.js
++++ b/test/helpers/mocks.js
@@@ -67,8 +67,8 @@ async function startNetwork() {
          return json(404, { error: 'not found' });
      });
      issuer = srv.url;
--    function signService({ sub, aud, cap, ns }) {
--        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: 'service', aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID() }, privatePem);
++    function signService({ sub, aud, cap, ns, actorType = 'service', extra = {} }) {
++        return serviceAuth.signServiceToken({ iss: issuer, sub, actor_type: actorType, aud, cap, ...(ns ? { ns } : {}), iat: Math.floor(Date.now() / 1000), exp: Math.floor(Date.now() / 1000) + 300, jti: crypto.randomUUID(), ...extra }, privatePem);
      }
      function addUser(username, extra = {}) {
          const subject = ids.newId('user');