union-ark-web 1.0.1

package/ark-web/src/main/java/com/epcc/arkweb/helper/AuthContextHolder.java

@@ -0,0 +1,39 @@
+package com.epcc.arkweb.helper;
+
+import com.epcc.arkweb.model.ShiroUser;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.session.InvalidSessionException;
+import org.apache.shiro.subject.Subject;
+import org.springframework.beans.BeanUtils;
+
+/** Uses the same Shiro Subject access pattern as production ark-web. */
+public final class AuthContextHolder {
+    private static final String SESSION_USER = "wl_session_user_key";
+
+    private AuthContextHolder() {}
+
+    public static ShiroUser getAuthUserDetails() {
+        Subject subject;
+        try {
+            subject = SecurityUtils.getSubject();
+        } catch (RuntimeException error) {
+            return null;
+        }
+        if (subject == null) return null;
+        try {
+            ShiroUser user = copy(subject.getSession(false) == null ? null
+                    : subject.getSession(false).getAttribute(SESSION_USER));
+            return user == null ? copy(subject.getPrincipal()) : user;
+        } catch (InvalidSessionException error) {
+            return null;
+        }
+    }
+
+    private static ShiroUser copy(Object source) {
+        if (source == null) return null;
+        if (source instanceof ShiroUser) return (ShiroUser) source;
+        ShiroUser target = new ShiroUser();
+        BeanUtils.copyProperties(source, target);
+        return target;
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/helper/AuthenticatedRequest.java

@@ -0,0 +1,91 @@
+package com.epcc.arkweb.helper;
+
+import com.epcc.arkweb.model.ShiroUser;
+import com.epcc.arkweb.web.llm.AgentAuthorizationInterceptor;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.shiro.authz.UnauthenticatedException;
+import org.springframework.stereotype.Component;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/** Converts an authenticated Web request into the JSON-only service contract. */
+@Component
+public class AuthenticatedRequest {
+    private final ObjectMapper json;
+
+    public AuthenticatedRequest(ObjectMapper json) {
+        this.json = json;
+    }
+
+    public String json() {
+        return json(new LinkedHashMap<String, Object>());
+    }
+
+    public String json(Map<String, ?> payload) {
+        Map<String, Object> input = new LinkedHashMap<>();
+        if (payload != null) input.putAll(payload);
+        Map<String, Object> scheduled = AgentAuthorizationInterceptor.currentContext();
+        if (scheduled != null) {
+            input.put("userId", scheduled.get("userId"));
+            input.put("orgCode", scheduled.get("orgCode"));
+            input.put("roleId", scheduled.get("roleId"));
+        } else {
+            ShiroUser actor = actor();
+            input.put("userId", actor.getLoginName());
+            input.put("orgCode", actor.getOrgCode());
+            input.put("roleId", actor.getRoleId());
+        }
+        return write(input);
+    }
+
+    public String json(Object... entries) {
+        if (entries.length % 2 != 0) throw new IllegalArgumentException("请求参数非法");
+        Map<String, Object> input = new LinkedHashMap<>();
+        for (int index = 0; index < entries.length; index += 2)
+            input.put(String.valueOf(entries[index]), entries[index + 1]);
+        return json(input);
+    }
+
+    public String json(byte[] payload) {
+        try {
+            Map<String, Object> input = json.readValue(
+                    payload, new TypeReference<Map<String, Object>>() {});
+            return json(input);
+        } catch (Exception error) {
+            throw new IllegalArgumentException("请求参数不是合法 JSON", error);
+        }
+    }
+
+    public byte[] clientPayload(byte[] payload) {
+        try {
+            Map<String, Object> input = json.readValue(
+                    payload, new TypeReference<Map<String, Object>>() {});
+            input.remove("userId");
+            input.remove("orgCode");
+            input.remove("roleId");
+            return json.writeValueAsBytes(input);
+        } catch (Exception error) {
+            throw new IllegalArgumentException("请求参数不是合法 JSON", error);
+        }
+    }
+
+    public ShiroUser actor() {
+        ShiroUser actor = AuthContextHolder.getAuthUserDetails();
+        if (actor == null || blank(actor.getLoginName())) throw new UnauthenticatedException();
+        return actor;
+    }
+
+    private String write(Map<String, Object> input) {
+        try {
+            return json.writeValueAsString(input);
+        } catch (Exception error) {
+            throw new IllegalArgumentException("请求参数无法序列化", error);
+        }
+    }
+
+    private static boolean blank(String value) {
+        return value == null || value.trim().isEmpty() || value.length() > 64;
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/model/ShiroUser.java

@@ -0,0 +1,21 @@
+package com.epcc.arkweb.model;
+
+import java.io.Serializable;
+
+/**
+ * Local source-compatible subset of production ShiroUser.
+ * Production keeps its existing richer model.
+ */
+public class ShiroUser implements Serializable {
+    private static final long serialVersionUID = 1L;
+    private String loginName;
+    private String orgCode;
+    private String roleId;
+
+    public String getLoginName() { return loginName; }
+    public void setLoginName(String loginName) { this.loginName = loginName; }
+    public String getOrgCode() { return orgCode; }
+    public void setOrgCode(String orgCode) { this.orgCode = orgCode; }
+    public String getRoleId() { return roleId; }
+    public void setRoleId(String roleId) { this.roleId = roleId; }
+}

package/ark-web/src/main/java/com/epcc/arkweb/utils/ResultMsg.java

@@ -0,0 +1,19 @@
+package com.epcc.arkweb.utils;
+
+public final class ResultMsg {
+    private final boolean success;
+    private final Object data;
+    private final String message;
+
+    private ResultMsg(boolean success, Object data, String message) {
+        this.success = success;
+        this.data = data;
+        this.message = message;
+    }
+
+    public static ResultMsg ok(Object data) { return new ResultMsg(true, data, null); }
+    public static ResultMsg fail(String message) { return new ResultMsg(false, null, message); }
+    public boolean isSuccess() { return success; }
+    public Object getData() { return data; }
+    public String getMessage() { return message; }
+}

package/ark-web/src/main/java/com/epcc/arkweb/vo/llm/ScheduledTaskCommandVO.java

@@ -0,0 +1,30 @@
+package com.epcc.arkweb.vo.llm;
+
+/** Browser-editable task fields. Identity fields intentionally do not exist. */
+public class ScheduledTaskCommandVO {
+    private Long taskId;
+    private String title;
+    private String prompt;
+    private String scheduleType;
+    private String runAt;
+    private String cronExpression;
+    private Long intervalSeconds;
+    private String timezone;
+
+    public Long getTaskId() { return taskId; }
+    public void setTaskId(Long taskId) { this.taskId = taskId; }
+    public String getTitle() { return title; }
+    public void setTitle(String title) { this.title = title; }
+    public String getPrompt() { return prompt; }
+    public void setPrompt(String prompt) { this.prompt = prompt; }
+    public String getScheduleType() { return scheduleType; }
+    public void setScheduleType(String scheduleType) { this.scheduleType = scheduleType; }
+    public String getRunAt() { return runAt; }
+    public void setRunAt(String runAt) { this.runAt = runAt; }
+    public String getCronExpression() { return cronExpression; }
+    public void setCronExpression(String cronExpression) { this.cronExpression = cronExpression; }
+    public Long getIntervalSeconds() { return intervalSeconds; }
+    public void setIntervalSeconds(Long intervalSeconds) { this.intervalSeconds = intervalSeconds; }
+    public String getTimezone() { return timezone; }
+    public void setTimezone(String timezone) { this.timezone = timezone; }
+}

package/ark-web/src/main/java/com/epcc/arkweb/vo/llm/ScheduledTaskQueryVO.java

@@ -0,0 +1,20 @@
+package com.epcc.arkweb.vo.llm;
+
+public class ScheduledTaskQueryVO {
+    private Long taskId;
+    private String keyword;
+    private String status;
+    private Integer page = 1;
+    private Integer pageSize = 20;
+
+    public Long getTaskId() { return taskId; }
+    public void setTaskId(Long taskId) { this.taskId = taskId; }
+    public String getKeyword() { return keyword; }
+    public void setKeyword(String keyword) { this.keyword = keyword; }
+    public String getStatus() { return status; }
+    public void setStatus(String status) { this.status = status; }
+    public Integer getPage() { return page; }
+    public void setPage(Integer page) { this.page = page; }
+    public Integer getPageSize() { return pageSize; }
+    public void setPageSize(Integer pageSize) { this.pageSize = pageSize; }
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/CommonController.java

@@ -0,0 +1,25 @@
+package com.epcc.arkweb.web;
+
+import com.union.control.service.ConversationService;
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+/** Production-style authenticated user-info endpoint. */
+@RestController
+public class CommonController {
+    private final ConversationService service;
+    private final AuthenticatedRequest request;
+
+    public CommonController(ConversationService service, AuthenticatedRequest request) {
+        this.service = service;
+        this.request = request;
+    }
+
+    @GetMapping("/common/getUserInfo")
+    public Map<String, Object> getUserInfo() {
+        return service.userInfo(request.json());
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/llm/AgentAuthorizationInterceptor.java

@@ -0,0 +1,229 @@
+package com.epcc.arkweb.web.llm;
+
+import com.union.control.service.ScheduledTaskService;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.subject.Subject;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.http.HttpHeaders;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestAttributes;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.method.HandlerMethod;
+import org.springframework.web.servlet.handler.HandlerInterceptorAdapter;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.time.Instant;
+import java.util.Collections;
+import java.util.Enumeration;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+
+/** Agent-only guard. Scheduled requests never create a Shiro Subject. */
+@Component
+public final class AgentAuthorizationInterceptor extends HandlerInterceptorAdapter {
+    public static final String TRUSTED_CONTEXT_HEADER = "X-Agent-Trusted-Context";
+    private static final String AUTHORIZATION_PREFIX = "Scheduled ";
+    public static final String CONTEXT_ATTRIBUTE =
+            AgentAuthorizationInterceptor.class.getName() + ".scheduledContext";
+    private static final Logger LOG = LoggerFactory.getLogger(AgentAuthorizationInterceptor.class);
+
+    private final ScheduledTaskService scheduledTasks;
+    private volatile Object arkAuthService;
+
+    @Autowired
+    public AgentAuthorizationInterceptor(ScheduledTaskService scheduledTasks) {
+        this.scheduledTasks = scheduledTasks;
+    }
+
+    /** Production supplies its existing bean; absence deliberately fails closed. */
+    @Autowired(required = false)
+    public void setArkAuthService(@Qualifier("arkAuthService") Object arkAuthService) {
+        this.arkAuthService = arkAuthService;
+    }
+
+    public Map<String, Object> authorize(String authorization, String permission) {
+        String token = token(authorization);
+        if (token == null) throw new IllegalArgumentException("scheduled token invalid");
+        Map<String, Object> context = context(scheduledTasks.resolveScheduledToken(token));
+        if (!hasPermission((String) context.get("roleId"),
+                (String) context.get("userId"), permission))
+            throw new SecurityException("scheduled permission denied");
+        return context;
+    }
+
+    @Override
+    public boolean preHandle(HttpServletRequest request, HttpServletResponse response,
+            Object handler) {
+        if (!(handler instanceof HandlerMethod)) return true;
+        AgentPermission permission = ((HandlerMethod) handler)
+                .getMethodAnnotation(AgentPermission.class);
+        String path = request.getRequestURI().substring(request.getContextPath().length());
+        if (permission == null) {
+            if ("/agent/scheduledTaskAuthorize".equals(path))
+                return validAuthorizationRequest(request, response);
+            return deny(response, 403, "agent_permission_denied");
+        }
+
+        List<String> authorization = headers(request, HttpHeaders.AUTHORIZATION);
+        List<String> trusted = headers(request, TRUSTED_CONTEXT_HEADER);
+        boolean cookie = present(request.getHeader(HttpHeaders.COOKIE));
+        if (authorization.size() > 1 || trusted.size() > 1
+                || (!authorization.isEmpty() && !trusted.isEmpty())
+                || (!trusted.isEmpty() && cookie))
+            return deny(response, 400, "mixed_authentication");
+
+        if (!trusted.isEmpty()) {
+            String rawToken = token(trusted.get(0));
+            if (rawToken == null) return deny(response, 401, "scheduled_auth_error");
+            try {
+                Map<String, Object> context = context(
+                        scheduledTasks.resolveScheduledToken(rawToken));
+                if (!hasPermission((String) context.get("roleId"),
+                        (String) context.get("userId"), permission.value()))
+                    return deny(response, 403, "agent_permission_denied");
+                request.setAttribute(CONTEXT_ATTRIBUTE, context);
+                return true;
+            } catch (RuntimeException error) {
+                return deny(response, 401, "scheduled_auth_error");
+            }
+        }
+
+        // Raw scheduled credentials are accepted only by the exchange endpoint.
+        if (!authorization.isEmpty()) return deny(response, 401, "scheduled_auth_error");
+        try {
+            Subject subject = SecurityUtils.getSubject();
+            if (!subject.isAuthenticated() || !subject.isPermitted(permission.value()))
+                return deny(response, 403, "agent_permission_denied");
+            return true;
+        } catch (RuntimeException error) {
+            return deny(response, 401, "cas_auth_error");
+        }
+    }
+
+    @SuppressWarnings("unchecked")
+    public static Map<String, Object> currentContext() {
+        RequestAttributes request = RequestContextHolder.getRequestAttributes();
+        if (request == null) return null;
+        Object context = request.getAttribute(CONTEXT_ATTRIBUTE, RequestAttributes.SCOPE_REQUEST);
+        return context instanceof Map ? (Map<String, Object>) context : null;
+    }
+
+    private boolean hasPermission(String roleId, String userName, String permission) {
+        if (!identity(roleId) || !identity(userName) || !identity(permission)) return false;
+        Object service = arkAuthService;
+        if (service == null) return false;
+        try {
+            Object result = service.getClass()
+                    .getMethod("queryResource", String.class, String.class, String.class)
+                    .invoke(service, roleId, userName, UUID.randomUUID().toString());
+            if (result == null || !Boolean.TRUE.equals(noArg(result, "isSuccess").invoke(result)))
+                return false;
+            Object values = noArg(result, "getResult").invoke(result);
+            if (!(values instanceof Iterable)) return false;
+            for (Object value : (Iterable<?>) values) {
+                if (value == null) continue;
+                Object url = noArg(value, "getResourceUrl").invoke(value);
+                if (permission.equals(url)) return true;
+            }
+            return false;
+        } catch (InvocationTargetException error) {
+            LOG.warn("scheduled role resource lookup failed error_type={}",
+                    error.getCause() == null ? error.getClass().getSimpleName()
+                            : error.getCause().getClass().getSimpleName());
+            return false;
+        } catch (Exception error) {
+            LOG.warn("scheduled role resource lookup failed error_type={}",
+                    error.getClass().getSimpleName());
+            return false;
+        }
+    }
+
+    private static boolean validAuthorizationRequest(
+            HttpServletRequest request, HttpServletResponse response) {
+        List<String> authorization = headers(request, HttpHeaders.AUTHORIZATION);
+        if (authorization.size() != 1
+                || token(authorization.get(0)) == null
+                || present(request.getHeader(TRUSTED_CONTEXT_HEADER))
+                || present(request.getHeader(HttpHeaders.COOKIE)))
+            return deny(response, 401, "scheduled_auth_error");
+        return true;
+    }
+
+    private static List<String> headers(HttpServletRequest request, String name) {
+        Enumeration<String> values = request.getHeaders(name);
+        return values == null ? Collections.<String>emptyList() : Collections.list(values);
+    }
+
+    private static String token(String value) {
+        if (value == null || !value.startsWith(AUTHORIZATION_PREFIX)) return null;
+        String token = value.substring(AUTHORIZATION_PREFIX.length());
+        return token.length() == 43 && token.matches("[A-Za-z0-9_-]{43}") ? token : null;
+    }
+
+    private static Method noArg(Object target, String name) throws NoSuchMethodException {
+        return target.getClass().getMethod(name);
+    }
+
+    private static boolean identity(String value) {
+        return value != null && !value.trim().isEmpty() && value.length() <= 64;
+    }
+
+    private static boolean present(String value) {
+        return value != null && !value.trim().isEmpty();
+    }
+
+    private static Map<String, Object> context(Map<String, Object> row) {
+        if (row == null) throw new IllegalArgumentException("scheduled context missing");
+        Map<String, Object> context = new LinkedHashMap<>();
+        context.put("authenticationType", "SCHEDULED");
+        context.put("runId", positiveNumber(row, "runId"));
+        context.put("taskId", positiveNumber(row, "taskId"));
+        context.put("userId", text(row, "userId", 64));
+        context.put("orgCode", text(row, "orgCode", 64));
+        context.put("roleId", text(row, "roleId", 64));
+        context.put("prompt", text(row, "prompt", 4096));
+        context.put("scheduledAt", text(row, "scheduledAt", 64));
+        context.put("timezone", text(row, "timezone", 64));
+        String expiresAt = text(row, "expiresAt", 64);
+        if (!Instant.parse(expiresAt).isAfter(Instant.now()))
+            throw new IllegalArgumentException("scheduled context expired");
+        context.put("expiresAt", expiresAt);
+        return Collections.unmodifiableMap(context);
+    }
+
+    private static long positiveNumber(Map<String, Object> row, String key) {
+        Object value = row.get(key);
+        if (!(value instanceof Number) || ((Number) value).longValue() <= 0)
+            throw new IllegalArgumentException(key + " invalid");
+        return ((Number) value).longValue();
+    }
+
+    private static String text(Map<String, Object> row, String key, int max) {
+        Object raw = row.get(key);
+        if (!(raw instanceof String)) throw new IllegalArgumentException(key + " invalid");
+        String value = (String) raw;
+        if (value.trim().isEmpty() || value.length() > max)
+            throw new IllegalArgumentException(key + " invalid");
+        return value;
+    }
+
+    private static boolean deny(HttpServletResponse response, int status, String code) {
+        response.setStatus(status);
+        response.setContentType("application/json;charset=UTF-8");
+        response.setHeader(HttpHeaders.CACHE_CONTROL, "no-store");
+        try {
+            response.getWriter().write("{\"error\":\"" + code + "\"}");
+        } catch (IOException ignored) {}
+        return false;
+    }
+
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/llm/AgentController.java

@@ -0,0 +1,165 @@
+package com.epcc.arkweb.web.llm;
+
+import com.union.control.service.AgentExecutionService;
+import com.union.control.service.ConversationService;
+import com.union.control.service.MemoryStoreService;
+import com.union.control.service.RunningAnalysisMockService;
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+import java.util.LinkedHashMap;
+
+/** Internal Agent API used by py-app; CAS and scheduled requests use separate guards. */
+@RestController
+@RequestMapping("/agent")
+public class AgentController {
+    private static final String EXECUTE_PERMISSION = "/assistantManager/page";
+    private final ConversationService conversations;
+    private final AgentExecutionService executions;
+    private final MemoryStoreService memoryStore;
+    private final RunningAnalysisMockService runningAnalysis;
+    private final AuthenticatedRequest request;
+    private final AgentAuthorizationInterceptor authorization;
+
+    @Autowired
+    public AgentController(
+            ConversationService conversations,
+            AgentExecutionService executions,
+            MemoryStoreService memoryStore,
+            RunningAnalysisMockService runningAnalysis,
+            AuthenticatedRequest request,
+            AgentAuthorizationInterceptor authorization) {
+        this.conversations = conversations;
+        this.executions = executions;
+        this.memoryStore = memoryStore;
+        this.runningAnalysis = runningAnalysis;
+        this.request = request;
+        this.authorization = authorization;
+    }
+
+    /** Validates the run-scoped token and performs the real-time role-resource check. */
+    @PostMapping("/scheduledTaskAuthorize")
+    public ResponseEntity<Map<String, Object>> scheduledTaskAuthorize(
+            @org.springframework.web.bind.annotation.RequestHeader(
+                    value = HttpHeaders.AUTHORIZATION, required = false) String authorization,
+            @RequestBody(required = false) Object payload) {
+        if (payload != null && (!(payload instanceof Map) || !((Map<?, ?>) payload).isEmpty()))
+            return unauthorized();
+        try {
+            Map<String, Object> context = this.authorization.authorize(
+                    authorization, EXECUTE_PERMISSION);
+            Map<String, Object> data = new LinkedHashMap<>(context);
+            // The value is an opaque, database-backed capability for subsequent tool calls.
+            data.put("trustedContext", authorization);
+            return ResponseEntity.ok().header(HttpHeaders.CACHE_CONTROL, "no-store")
+                    .body(success(data));
+        } catch (RuntimeException error) {
+            return unauthorized();
+        }
+    }
+
+    private static ResponseEntity<Map<String, Object>> unauthorized() {
+        return ResponseEntity.status(401).header(HttpHeaders.CACHE_CONTROL, "no-store")
+                .body(java.util.Collections.<String, Object>singletonMap(
+                        "error", "scheduled_auth_error"));
+    }
+
+    private static Map<String, Object> success(Map<String, Object> data) {
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("success", true);
+        body.put("data", data);
+        return body;
+    }
+
+    @PostMapping("/getConversationMessages")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> messages(
+            @RequestBody Map<String, Object> payload) {
+        return conversations.conversationMessages(request.json(payload));
+    }
+
+    @PostMapping("/completeRun")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> completeRun(
+            @RequestBody Map<String, Object> payload) {
+        return executions.completeRun(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/read")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memoryRead(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memoryRead(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/list")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memoryList(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memoryList(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/operation")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memoryOperation(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memoryOperation(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/write")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memoryWrite(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memoryWrite(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/delete")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memoryDelete(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memoryDelete(request.json(payload));
+    }
+
+    @PostMapping("/memoryStore/search")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> memorySearch(
+            @RequestBody Map<String, Object> payload) {
+        return memoryStore.memorySearch(request.json(payload));
+    }
+
+    @PostMapping("/getOrgInfo")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> getOrgInfo(
+            @RequestBody Map<String, Object> payload) {
+        return runningAnalysis.getOrgInfo(request.json(payload));
+    }
+
+    @PostMapping("/queryBigData")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> queryBigData(
+            @RequestBody Map<String, Object> payload) {
+        return runningAnalysis.queryBigData(request.json(payload));
+    }
+
+    @PostMapping("/announceList")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> announceList(
+            @RequestBody Map<String, Object> payload) {
+        return runningAnalysis.announceList(request.json(payload));
+    }
+
+    @PostMapping("/getJiraInfo")
+    @AgentPermission("/assistantManager/page")
+    public Map<String, Object> getJiraInfo(
+            @RequestBody Map<String, Object> payload) {
+        return runningAnalysis.getJiraInfo(request.json(payload));
+    }
+
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/llm/AgentPermission.java

@@ -0,0 +1,13 @@
+package com.epcc.arkweb.web.llm;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/** Permission required by one py-app tool endpoint. */
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface AgentPermission {
+    String value();
+}