union-ark-web 1.0.1

package/ark-control-facade/src/main/java/com/union/control/service/ScheduledTaskService.java

@@ -0,0 +1,40 @@
+package com.union.control.service;
+
+import java.util.List;
+import java.util.Map;
+
+public interface ScheduledTaskService {
+    Map<String, Object> create(String input);
+    Map<String, Object> update(String input);
+    Map<String, Object> list(String input);
+    Map<String, Object> detail(String input);
+    Map<String, Object> runs(String input);
+    Map<String, Object> runDetail(String input);
+    Map<String, Object> unread(String input);
+    Map<String, Object> start(String input);
+    Map<String, Object> pause(String input);
+    Map<String, Object> discard(String input);
+    Map<String, Object> open(String input);
+    Long claimDueRun();
+    List<Long> pendingRunIds(int limit);
+    boolean beginRun(long runId, String tokenHash, String expiresAt);
+    void completeFromProxy(long runId, Map<String, Object> result);
+    void failRun(long runId, String errorCode, String errorMessage);
+    int failStaleRuns(int maxRunSeconds);
+    /** Resolves an active run from the raw one-time token; the provider hashes it internally. */
+    Map<String, Object> resolveScheduledToken(String rawToken);
+
+    class NotFoundException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+        public NotFoundException() {}
+        public NotFoundException(String message) { super(message); }
+    }
+    class ConflictException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+        public ConflictException() {}
+        public ConflictException(String message) { super(message); }
+    }
+    class DataCorruptionException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+    }
+}

package/ark-control-facade/src/main/java/com/union/control/service/SensitiveDataDemoService.java

@@ -0,0 +1,13 @@
+package com.union.control.service;
+
+import java.util.List;
+import java.util.Map;
+
+public interface SensitiveDataDemoService {
+    int insert(String input);
+    Map<String, Object> save(String input);
+    Map<String, Object> saveAddressBook(String input);
+    List<Map<String, Object>> query(String input);
+    int insertAddressBook(String input);
+    List<Map<String, Object>> queryAddressBook(String input);
+}

package/ark-control-facade/src/main/java/com/union/control/service/sensitive/SensitiveRevealService.java

@@ -0,0 +1,18 @@
+package com.union.control.service.sensitive;
+
+public interface SensitiveRevealService {
+    String reveal(String input);
+
+    class InvalidTokenException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+    }
+    class ExpiredTokenException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+    }
+    class RevealDecryptionException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+    }
+    class StoreUnavailableException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+    }
+}

package/ark-web/README.md

@@ -0,0 +1,80 @@
+# ark-web
+
+This is the browser-facing module merged into the existing production Web
+application. It owns the new HTTP controllers and final SSE response while
+reusing the production Shiro Realm and Filter implementations.
+Its standalone startup uses the production class and bean names
+`ShiroConfig`, `Realm`, `LoginFormFilter`, and `InterceptorConfig`, and follows
+the same Shiro Filter -> Realm -> Subject -> permission path. Production uses
+the host application's existing implementations.
+Business and persistence services are consumed from
+`ark-control` through `ark-control-facade` Dubbo references.
+
+The production Web application remains Shiro authenticated. Task persistence,
+due-run claiming, execution tokens, workers and model calls stay in the control
+provider. There is no Web-only scheduled facade or local scheduled-service
+adapter:
+
+```text
+ark-web/src/main/java/com/epcc/arkweb/
+  vo/llm/ScheduledTaskCommandVO.java
+  vo/llm/ScheduledTaskQueryVO.java
+  web/llm/ScheduledTaskController.java
+```
+
+`ScheduledTaskController` uses
+`com.union.control.service.ScheduledTaskService` from the shared facade. Its
+implementation is published by `ark-control`.
+
+`AgentController` keeps the production CAS path for interactive py calls. Its
+scheduled authorization endpoint validates a Control-issued token and performs
+the real-time role-resource check. Agent tools use a non-Shiro
+`@AgentPermission` guard and a Control-backed trusted context; only the
+`X-Agent-Trusted-Context` value returned by that endpoint is accepted for tool
+calls. No scheduled Realm or synthetic Subject is created.
+The controller lives under `/agent/**`; it must not use production's anonymous
+`/api/**` namespace. Both production filter-chain maps place `/agent/** -> anon`
+before `/** -> authc`, delegating this exact namespace to the fail-closed Agent
+guard. No scheduled Shiro Filter or Realm is introduced.
+
+The copy-ready production files live under `src/production-overlay/java` and
+are not part of the standalone module's compilation source set. The two Shiro
+files differ from production only by the `/agent/**` whitelist line; the
+`InterceptorConfig` copy registers the Agent guard first and excludes
+`/agent/**` from the production browser-only interceptors. During production
+merge, copy these over the three matching files rather than adding parallel
+configuration classes.
+
+For local authentication testing, activate `local-auth-mock`. It establishes a
+normal Shiro Subject automatically, so no login page or manual cookie is needed.
+Scheduled headers skip auto-login and continue through the non-Shiro Agent
+guard. The only local replacement is the external `arkAuthService` bean at
+`src/local-mock/java/com/epcc/arkweb/mock/ArkAuthServiceMock.java`; configure it
+with `LOCAL_USER_ID`, `LOCAL_PASSWORD`, `LOCAL_ORG_CODE`, and
+`LOCAL_AUTHORIZED_ROLE_ID`.
+
+`ShiroUser`, `AuthContextHolder` and `ResultMsg` remain Web-owned types and do
+not cross the Dubbo boundary.
+
+The controller deliberately:
+
+- follows the existing `web/llm`, `vo` and `service` package layout;
+- exposes both `/llm/**` and `/union-op/llm/**` like the current production
+  `LLMController`;
+- uses the existing `/assistantManager/page` Shiro permission;
+- gets `loginName`, `orgCode`, and the selected `roleId` only from the
+  production Shiro identity exposed by `AuthContextHolder`;
+- browser-facing methods never accept user identity, permissions or an
+  execution token from the browser. The internal scheduled authorization method
+  accepts only the Control-issued token from py-app.
+
+Before enabling scheduling, verify the production `arkAuthService` bean is
+available and fails closed when its backing service cannot be reached. The local
+build has no proprietary auth-facade dependency, so the Agent-only guard invokes the unchanged production
+`queryResource(roleId, userName, traceNo)` contract reflectively.
+
+`LlmController#chatMessage` posts directly to py-app and writes and flushes each
+upstream chunk to `HttpServletResponse`. The streaming path does not use Dubbo.
+
+Production HTTP and Dubbo filters must not log Agent cookies, request payloads,
+responses, or SSE chunks.

package/ark-web/pom.xml

@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-starter-parent</artifactId>
+        <version>1.5.22.RELEASE</version>
+        <relativePath/>
+    </parent>
+    <groupId>com.nucc.channel.ark</groupId>
+    <artifactId>ark-web</artifactId>
+    <version>1.1-local</version>
+    <packaging>jar</packaging>
+
+    <properties>
+        <java.version>1.8</java.version>
+        <shiro.version>1.12.0</shiro.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>com.union</groupId>
+            <artifactId>ark-control-facade</artifactId>
+            <version>1.0.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.alibaba</groupId>
+            <artifactId>dubbo</artifactId>
+            <version>2.6.9</version>
+            <exclusions>
+                <exclusion><groupId>org.jboss.netty</groupId><artifactId>netty</artifactId></exclusion>
+                <exclusion><groupId>org.springframework</groupId><artifactId>spring</artifactId></exclusion>
+                <exclusion><groupId>org.slf4j</groupId><artifactId>slf4j-log4j12</artifactId></exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId><artifactId>netty-all</artifactId><version>4.1.25.Final</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.curator</groupId><artifactId>curator-framework</artifactId><version>2.12.0</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.zookeeper</groupId><artifactId>zookeeper</artifactId><version>3.4.13</version>
+            <exclusions>
+                <exclusion><groupId>io.netty</groupId><artifactId>netty</artifactId></exclusion>
+                <exclusion><groupId>org.slf4j</groupId><artifactId>slf4j-log4j12</artifactId></exclusion>
+                <exclusion><groupId>log4j</groupId><artifactId>log4j</artifactId></exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.shiro</groupId>
+            <artifactId>shiro-spring</artifactId>
+            <version>${shiro.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.3</version>
+        </dependency>
+        <!-- Already supplied by the production Web parent. -->
+        <dependency>
+            <groupId>com.github.penggle</groupId>
+            <artifactId>kaptcha</artifactId>
+            <version>2.3.2</version>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>build-helper-maven-plugin</artifactId>
+                <version>3.2.0</version>
+                <executions>
+                    <execution>
+                        <id>add-local-mock-source</id>
+                        <phase>generate-sources</phase>
+                        <goals><goal>add-source</goal></goals>
+                        <configuration>
+                            <sources><source>src/local-mock/java</source></sources>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+                <configuration>
+                    <mainClass>com.epcc.arkweb.Application</mainClass>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

package/ark-web/src/local-mock/java/com/epcc/arkweb/mock/ArkAuthServiceMock.java

@@ -0,0 +1,105 @@
+package com.epcc.arkweb.mock;
+
+import com.epcc.arkweb.model.ShiroUser;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.web.servlet.AdviceFilter;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.web.servlet.FilterRegistrationBean;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Profile;
+import org.springframework.stereotype.Component;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+
+/** Local replacement for the external arkAuthService bean. */
+@Component("arkAuthService")
+@Profile("local-auth-mock")
+public final class ArkAuthServiceMock {
+    private final String userId;
+    private final String password;
+    private final String orgCode;
+    private final String authorizedRoleId;
+
+    public ArkAuthServiceMock(
+            @Value("${agent.local-user-id:user-1}") String userId,
+            @Value("${agent.local-password:local-only}") String password,
+            @Value("${agent.local-org-code:104100000004}") String orgCode,
+            @Value("${agent.local-authorized-role-id:role-1}") String authorizedRoleId) {
+        this.userId = userId;
+        this.password = password;
+        this.orgCode = orgCode;
+        this.authorizedRoleId = authorizedRoleId;
+    }
+
+    public ShiroUser authenticate(String userName, char[] suppliedPassword) {
+        if (!userId.equals(userName)
+                || !Arrays.equals(password.toCharArray(), suppliedPassword)) return null;
+        ShiroUser user = new ShiroUser();
+        user.setLoginName(userId);
+        user.setOrgCode(orgCode);
+        user.setRoleId(authorizedRoleId);
+        return user;
+    }
+
+    public Set<String> queryPermissions(String roleId, String userName) {
+        if (!authorizedRoleId.equals(roleId) || !userId.equals(userName))
+            return Collections.emptySet();
+        return Collections.unmodifiableSet(new LinkedHashSet<>(
+                Collections.singletonList("/assistantManager/page")));
+    }
+
+    /** Local requests get a normal Shiro Subject without a login page. */
+    @Bean("localAuthFilter")
+    public AdviceFilter localAuthFilter() {
+        return new AdviceFilter() {
+            @Override
+            protected boolean preHandle(ServletRequest request, ServletResponse response) {
+                HttpServletRequest http = (HttpServletRequest) request;
+                String authorization = http.getHeader("Authorization");
+                if ((authorization != null && authorization.startsWith("Scheduled "))
+                        || http.getHeader("X-Agent-Trusted-Context") != null)
+                    return true;
+                if (!SecurityUtils.getSubject().isAuthenticated())
+                    SecurityUtils.getSubject().login(
+                            new UsernamePasswordToken(userId, password));
+                return true;
+            }
+        };
+    }
+
+    /** The filter belongs only to Shiro's chain, not the servlet container's global chain. */
+    @Bean
+    public FilterRegistrationBean localAuthFilterRegistration(AdviceFilter localAuthFilter) {
+        FilterRegistrationBean registration = new FilterRegistrationBean(localAuthFilter);
+        registration.setEnabled(false);
+        return registration;
+    }
+
+    public Result queryResource(String roleId, String userName, String traceNo) {
+        List<Resource> resources = authorizedRoleId.equals(roleId) && userId.equals(userName)
+                ? Collections.singletonList(new Resource("/assistantManager/page"))
+                : Collections.<Resource>emptyList();
+        return new Result(resources);
+    }
+
+    public static final class Result {
+        private final List<Resource> result;
+        Result(List<Resource> result) { this.result = result; }
+        public boolean isSuccess() { return true; }
+        public List<Resource> getResult() { return result; }
+    }
+
+    public static final class Resource {
+        private final String resourceUrl;
+        Resource(String resourceUrl) { this.resourceUrl = resourceUrl; }
+        public String getResourceUrl() { return resourceUrl; }
+    }
+}

package/ark-web/src/local-mock/java/com/epcc/arkweb/mock/LocalKaptchaConfiguration.java

@@ -0,0 +1,26 @@
+package com.epcc.arkweb.mock;
+
+import com.google.code.kaptcha.Producer;
+import com.google.code.kaptcha.impl.DefaultKaptcha;
+import com.google.code.kaptcha.util.Config;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+
+import java.util.Properties;
+
+/** Local wiring only. Production supplies its existing KaptchaConfig / Producer bean. */
+@Configuration
+public class LocalKaptchaConfiguration {
+    @Bean
+    public Producer captchaProducer() {
+        Properties properties = new Properties();
+        properties.setProperty("kaptcha.image.width", "110");
+        properties.setProperty("kaptcha.image.height", "40");
+        properties.setProperty("kaptcha.textproducer.char.length", "4");
+        properties.setProperty("kaptcha.textproducer.font.size", "30");
+        properties.setProperty("kaptcha.textproducer.font.names", "SansSerif");
+        DefaultKaptcha producer = new DefaultKaptcha();
+        producer.setConfig(new Config(properties));
+        return producer;
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/Application.java

@@ -0,0 +1,13 @@
+package com.epcc.arkweb;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+import org.springframework.context.annotation.ImportResource;
+
+@SpringBootApplication
+@ImportResource("classpath:dubbo-consumer.xml")
+public class Application {
+    public static void main(String[] args) {
+        SpringApplication.run(Application.class, args);
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/config/InterceptorConfig.java

@@ -0,0 +1,20 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.web.llm.AgentAuthorizationInterceptor;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+
+/** Uses the production configuration entry point for the Agent-only guard. */
+@Configuration
+public class InterceptorConfig extends WebMvcConfigurerAdapter {
+    @Autowired
+    private AgentAuthorizationInterceptor agentAuthorizationInterceptor;
+
+    @Override
+    public void addInterceptors(InterceptorRegistry registry) {
+        registry.addInterceptor(agentAuthorizationInterceptor)
+                .addPathPatterns("/agent/**");
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/config/Realm.java

@@ -0,0 +1,64 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.model.ShiroUser;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.AuthenticationException;
+import org.apache.shiro.authc.AuthenticationInfo;
+import org.apache.shiro.authc.AuthenticationToken;
+import org.apache.shiro.authc.SimpleAuthenticationInfo;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.authz.AuthorizationInfo;
+import org.apache.shiro.authz.SimpleAuthorizationInfo;
+import org.apache.shiro.realm.AuthorizingRealm;
+import org.apache.shiro.subject.PrincipalCollection;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.Set;
+
+/** Local build of the production-named Realm; only its auth-service call is mocked. */
+public class Realm extends AuthorizingRealm {
+    private Object arkAuthService;
+
+    @Autowired
+    public void setArkAuthService(@Qualifier("arkAuthService") Object arkAuthService) {
+        this.arkAuthService = arkAuthService;
+    }
+
+    @Override
+    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
+        UsernamePasswordToken login = (UsernamePasswordToken) token;
+        ShiroUser user = invoke("authenticate",
+                new Class<?>[]{String.class, char[].class},
+                new Object[]{login.getUsername(), login.getPassword()}, ShiroUser.class);
+        if (user == null) throw new AuthenticationException("用户名或密码错误");
+        SecurityUtils.getSubject().getSession().setAttribute("wl_session_user_key", user);
+        return new SimpleAuthenticationInfo(user, login.getCredentials(), getName());
+    }
+
+    @Override
+    @SuppressWarnings("unchecked")
+    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
+        ShiroUser user = principals.oneByType(ShiroUser.class);
+        if (user == null) return null;
+        Set<String> permissions = invoke("queryPermissions",
+                new Class<?>[]{String.class, String.class},
+                new Object[]{user.getRoleId(), user.getLoginName()}, Set.class);
+        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
+        info.setStringPermissions(permissions);
+        return info;
+    }
+
+    private <T> T invoke(String name, Class<?>[] types, Object[] args, Class<T> resultType) {
+        try {
+            Method method = arkAuthService.getClass().getMethod(name, types);
+            return resultType.cast(method.invoke(arkAuthService, args));
+        } catch (InvocationTargetException error) {
+            throw new AuthenticationException("鉴权服务调用失败", error.getCause());
+        } catch (Exception error) {
+            throw new AuthenticationException("鉴权服务调用失败", error);
+        }
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/config/ShiroConfig.java

@@ -0,0 +1,129 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.filter.LoginFormFilter;
+import org.apache.shiro.authc.pam.FirstSuccessfulStrategy;
+import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.spring.LifecycleBeanPostProcessor;
+import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
+import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
+import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
+import org.apache.shiro.web.servlet.SimpleCookie;
+import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.DependsOn;
+
+import javax.servlet.Filter;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/** Standalone wiring with the same class, bean and filter names as production. */
+@Configuration
+@ConditionalOnProperty(prefix = "arkshiro", name = "sso", havingValue = "false")
+public class ShiroConfig {
+    @Autowired(required = false)
+    @Qualifier("localAuthFilter")
+    private Filter localAuthFilter;
+
+    @Bean
+    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
+        ShiroFilterFactoryBean factory = new ShiroFilterFactoryBean();
+        factory.setSecurityManager(securityManager);
+        factory.setLoginUrl("/login.html");
+        factory.setUnauthorizedUrl("/403.html");
+        factory.setSuccessUrl("/index.html");
+
+        Map<String, String> filterMap = new LinkedHashMap<>();
+        filterMap.put("/error", "anon");
+        filterMap.put("/css/**", "anon");
+        filterMap.put("/images/**", "anon");
+        filterMap.put("/script/**", "anon");
+        filterMap.put("/static/**", "anon");
+        filterMap.put("/plugins/**", "anon");
+        filterMap.put("/.ico", "anon");
+        filterMap.put("/healthcheck.html", "anon");
+        filterMap.put("/SSL/healthcheck.html", "anon");
+        filterMap.put("/agent/**", localAuthFilter == null ? "anon" : "localAuth,anon");
+        filterMap.put("/**", localAuthFilter == null ? "authc" : "localAuth,authc");
+        filterMap.put("/union-op/**", "authc");
+        factory.setFilterChainDefinitionMap(filterMap);
+
+        Map<String, Filter> filters = new HashMap<>();
+        filters.put("authc", new LoginFormFilter("LOCAL"));
+        if (localAuthFilter != null) filters.put("localAuth", localAuthFilter);
+        factory.setFilters(filters);
+        return factory;
+    }
+
+    @Bean
+    public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
+        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
+        creator.setUsePrefix(true);
+        return creator;
+    }
+
+    @Bean
+    public ModularRealmAuthenticator modularRealmAuthenticator() {
+        ModularRealmAuthenticator authenticator = new ModularRealmAuthenticator();
+        authenticator.setAuthenticationStrategy(new FirstSuccessfulStrategy());
+        return authenticator;
+    }
+
+    @Bean
+    public DefaultWebSessionManager defaultWebSessionManager() {
+        DefaultWebSessionManager sessions = new DefaultWebSessionManager();
+        sessions.setGlobalSessionTimeout(1800000);
+        sessions.setDeleteInvalidSessions(true);
+        sessions.setSessionValidationSchedulerEnabled(true);
+        sessions.setSessionValidationInterval(900000);
+        SimpleCookie cookie = new SimpleCookie("SHRIOSESSIONID");
+        cookie.setHttpOnly(true);
+        sessions.setSessionIdCookie(new SimpleCookie(cookie));
+        sessions.setSessionIdUrlRewritingEnabled(false);
+        return sessions;
+    }
+
+    @Bean
+    public DefaultWebSecurityManager defaultWebSecurityManager(
+            DefaultWebSessionManager sessions,
+            ModularRealmAuthenticator authenticator,
+            Realm realm) {
+        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
+        manager.setAuthenticator(authenticator);
+        manager.setRealm(realm);
+        manager.setSessionManager(sessions);
+        return manager;
+    }
+
+    @Bean
+    public Realm arkRealm() {
+        return new Realm();
+    }
+
+    @Bean
+    public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
+        return new LifecycleBeanPostProcessor();
+    }
+
+    @Bean
+    @DependsOn("lifecycleBeanPostProcessor")
+    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
+        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
+        creator.setProxyTargetClass(true);
+        return creator;
+    }
+
+    @Bean
+    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(
+            SecurityManager securityManager) {
+        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
+        advisor.setSecurityManager(securityManager);
+        return advisor;
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/filter/LoginFormFilter.java

@@ -0,0 +1,43 @@
+package com.epcc.arkweb.filter;
+
+import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
+import org.apache.shiro.web.util.WebUtils;
+
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.util.Map;
+
+/** Production-named form filter; proprietary session telemetry is outside the local build. */
+public class LoginFormFilter extends FormAuthenticationFilter {
+    private final String propFlag;
+
+    public LoginFormFilter(String propFlag) {
+        this.propFlag = propFlag;
+    }
+
+    @Override
+    protected boolean onAccessDenied(ServletRequest request, ServletResponse response)
+            throws Exception {
+        HttpServletResponse httpResponse = (HttpServletResponse) response;
+        if (isLoginRequest(request, response)) {
+            return !isLoginSubmission(request, response) || executeLogin(request, response);
+        }
+        httpResponse.setStatus(401);
+        if (!isAjax((HttpServletRequest) request))
+            WebUtils.issueRedirect(request, response,
+                    wrapperUrl((HttpServletRequest) request), (Map) null, true, false);
+        return false;
+    }
+
+    private boolean isAjax(HttpServletRequest request) {
+        return "XMLHttpRequest".equals(request.getHeader("X-Requested-With"));
+    }
+
+    private String wrapperUrl(HttpServletRequest request) {
+        if (propFlag.contains("DMZ")) return "/union-op/login.html";
+        return request.getServletPath().contains("/union-op")
+                ? "/union-op/login.html" : "/login.html";
+    }
+}