SBOM Projection Read API (LNM v1)

• Endpoint: GET /sboms/{snapshotId}/projection?tenant={tenantId} (tenant is optional)
• Purpose: Serve immutable SBOM projections (Link-Not-Merge v1) for a given snapshot and tenant without merge/deduplication.
• Response 200:

{
  "snapshotId": "snap-001",
  "tenantId": "tenant-a",
  "schemaVersion": "1.0.0",
  "hash": "<sha256 of projection payload>",
  "projection": { /* LNM v1 projection payload */ }
}

• Errors:

  • 400 when snapshotId is blank or a supplied tenant differs from the authenticated tenant.
  • 401/403 when authentication or sbom:read is missing.
  • 404 when no projection exists for the given snapshot/tenant.
  • 500 with error: projection_integrity_failed when a durable projection has a malformed SHA-256 or its stored hash does not match the canonical payload. No projection payload is returned.

• Determinism & integrity:

  • Fixture-backed projections compute their hash over the canonical JSON.
  • PostgreSQL-backed projections are canonicalized with CanonJson on every read. The service validates the stored SHA-256 against those canonical bytes with a fixed-time comparison before returning the payload; malformed or mismatched hashes fail closed.
  • No mutation/merge logic applied.

• Auth/tenant: the service validates an Authority bearer token or Router-signed identity envelope and requires sbom:read. The canonical stellaops:tenant claim selects storage; tenant, when present, is only a matching assertion.

• Fixtures: docs/modules/sbom-service/fixtures/lnm-v1/projections.json (hashes in SHA256SUMS).

• Metrics: TBD in observability doc; to be added when backed by persistent store.