feat: add Responses API compatibility

apps/api/internal/store/response_chains_test.go

@@ -0,0 +1,36 @@
+package store
+
+import "testing"
+
+func TestSameResponseChainOwnerIsolatesUserAndTenant(t *testing.T) {
+	chain := ResponseChain{
+		GatewayUserID: "user-1", GatewayTenantID: "tenant-1", TenantID: "external-tenant", TenantKey: "tenant-key",
+	}
+	owner := GatewayTask{
+		GatewayUserID: "user-1", GatewayTenantID: "tenant-1", TenantID: "external-tenant", TenantKey: "tenant-key",
+	}
+	if !sameResponseChainOwner(chain, owner) {
+		t.Fatal("matching user and tenant should own the response chain")
+	}
+	owner.GatewayUserID = "user-2"
+	if sameResponseChainOwner(chain, owner) {
+		t.Fatal("another user must not access the response chain")
+	}
+	owner.GatewayUserID = "user-1"
+	owner.GatewayTenantID = "tenant-2"
+	if sameResponseChainOwner(chain, owner) {
+		t.Fatal("another tenant must not access the response chain")
+	}
+}
+
+func TestSameResponseChainOwnerSupportsExternalIdentityFallback(t *testing.T) {
+	chain := ResponseChain{UserID: "external-user", UserSource: "server-main", TenantID: "tenant-a"}
+	owner := GatewayTask{UserID: "external-user", UserSource: "server-main", TenantID: "tenant-a"}
+	if !sameResponseChainOwner(chain, owner) {
+		t.Fatal("matching external identity should own the response chain")
+	}
+	owner.UserSource = "gateway"
+	if sameResponseChainOwner(chain, owner) {
+		t.Fatal("identity source must participate in isolation")
+	}
+}