union-ark-web 1.0.1

package/ark-web/src/main/java/com/epcc/arkweb/web/llm/LlmController.java

@@ -0,0 +1,209 @@
+package com.epcc.arkweb.web.llm;
+
+import com.union.control.service.AgentProxyService;
+import com.union.control.service.AgentResponse;
+import com.union.control.service.AgentExecutionService;
+import com.union.control.service.ConversationService;
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.ResponseEntity;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.http.client.ClientHttpResponse;
+import org.springframework.http.client.SimpleClientHttpRequestFactory;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.client.ResponseErrorHandler;
+import org.springframework.web.client.RestTemplate;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RequestHeader;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.http.HttpHeaders;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+import java.util.Map;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/** Browser-facing LLM API. Only Agent runs cross the Python boundary. */
+@Controller
+@RequestMapping(value = {"llm", "union-op/llm"})
+public class LlmController {
+    private final ConversationService conversations;
+    private final AgentExecutionService executions;
+    private final AgentProxyService gateway;
+    private final AuthenticatedRequest request;
+    private final String pyAppBaseUrl;
+    private final RestTemplate http;
+
+    @Autowired
+    public LlmController(
+            ConversationService conversations,
+            AgentExecutionService executions,
+            AgentProxyService gateway,
+            AuthenticatedRequest request,
+            @Value("${agent.py-app-base-url}") String pyAppBaseUrl,
+            @Value("${AGENT_MAX_RUN_SECONDS:900}") double maxRunSeconds) {
+        this(conversations, executions, gateway, request, pyAppBaseUrl, new RestTemplate());
+        double millis = Math.ceil(maxRunSeconds * 1000);
+        if (!Double.isFinite(millis) || millis < 1 || millis > Integer.MAX_VALUE)
+            throw new IllegalArgumentException("AGENT_MAX_RUN_SECONDS is out of range");
+        SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
+        factory.setConnectTimeout((int) millis);
+        factory.setReadTimeout((int) millis);
+        http.setRequestFactory(factory);
+    }
+
+    LlmController(
+            ConversationService conversations,
+            AgentExecutionService executions,
+            AgentProxyService gateway,
+            AuthenticatedRequest request,
+            String pyAppBaseUrl,
+            RestTemplate http) {
+        this.conversations = conversations;
+        this.executions = executions;
+        this.gateway = gateway;
+        this.request = request;
+        this.pyAppBaseUrl = pyAppBaseUrl.replaceAll("/+$", "");
+        this.http = http;
+        this.http.setErrorHandler(new ResponseErrorHandler() {
+            @Override
+            public boolean hasError(ClientHttpResponse response) {
+                return false;
+            }
+
+            @Override
+            public void handleError(ClientHttpResponse response) {}
+        });
+    }
+
+    @GetMapping("/conversationList")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public Map<String, Object> conversationList(
+            @RequestParam(required = false, defaultValue = "100") int limit) {
+        return conversations.conversations(request.json("limit", limit));
+    }
+
+    @GetMapping("/conversationDetails")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public Map<String, Object> conversationDetails(
+            @RequestParam String conversationId) {
+        return conversations.conversation(request.json("conversationId", conversationId));
+    }
+
+    @PostMapping("/conversationTitle")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public Map<String, Object> conversationTitle(
+            @RequestBody Map<String, Object> payload) {
+        return conversations.rename(request.json(payload));
+    }
+
+    @PostMapping("/conversationDelete")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public Map<String, Object> conversationDelete(
+            @RequestBody Map<String, Object> payload) {
+        return conversations.deleteConversation(request.json(payload));
+    }
+
+    @PostMapping("/executionCancel")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResponseEntity<String> executionCancel(
+            @RequestHeader(value = HttpHeaders.COOKIE, required = false) String cookie,
+            @RequestBody Map<String, Object> payload) {
+        Object conversationId = payload.get("conversationId");
+        Object runId = payload.get("runId");
+        if (!(conversationId instanceof String) || !(runId instanceof String))
+            throw new IllegalArgumentException("缺少 execution 标识");
+        return response(gateway.cancel(cookie, (String) conversationId, (String) runId));
+    }
+
+    @PostMapping(value = "/chatMessage", produces = "text/event-stream")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public void chatMessage(
+            @RequestHeader(value = HttpHeaders.COOKIE, required = false) String cookie,
+            @RequestBody byte[] payload, HttpServletResponse response) {
+        byte[] clientPayload = request.clientPayload(payload);
+        Map<String, Object> claimed = executions.claimAguiRun(request.json(clientPayload));
+        @SuppressWarnings("unchecked")
+        Map<String, Object> execution = (Map<String, Object>) claimed.get("data");
+        String conversationId = String.valueOf(execution.get("conversationId"));
+        String runId = String.valueOf(execution.get("runId"));
+        AtomicBoolean disconnected = new AtomicBoolean();
+        try {
+            http.execute(pyAppBaseUrl + "/agent/v1/runs", HttpMethod.POST,
+                    upstreamRequest -> {
+                        upstreamRequest.getHeaders().setContentType(MediaType.APPLICATION_JSON);
+                        upstreamRequest.getHeaders().setAccept(
+                                java.util.Collections.singletonList(MediaType.TEXT_EVENT_STREAM));
+                        upstreamRequest.getHeaders().set(HttpHeaders.COOKIE, cookie);
+                        upstreamRequest.getBody().write(clientPayload);
+                    }, upstream -> {
+                        response.setStatus(upstream.getRawStatusCode());
+                        copyHeader(upstream, response, HttpHeaders.CONTENT_TYPE);
+                        copyHeader(upstream, response, HttpHeaders.CACHE_CONTROL);
+                        response.setHeader("X-Accel-Buffering", "no");
+                        InputStream input = upstream.getBody();
+                        byte[] buffer = new byte[4096];
+                        int read;
+                        while ((read = input.read(buffer)) != -1) {
+                            try {
+                                response.getOutputStream().write(buffer, 0, read);
+                                response.getOutputStream().flush();
+                            } catch (IOException error) {
+                                disconnected.set(true);
+                                throw error;
+                            }
+                        }
+                        try {
+                            response.flushBuffer();
+                        } catch (IOException error) {
+                            disconnected.set(true);
+                            throw error;
+                        }
+                        return null;
+                    }
+            );
+        } catch (RuntimeException error) {
+            if (!disconnected.get()) throw error;
+            gateway.cancel(cookie, conversationId, runId);
+        }
+    }
+
+    @PostMapping("/chatMessageSync")
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResponseEntity<String> chatMessageSync(
+            @RequestHeader(value = HttpHeaders.COOKIE, required = false) String cookie,
+            @RequestBody byte[] payload) {
+        return response(gateway.sync(cookie,
+                new String(request.clientPayload(payload), StandardCharsets.UTF_8)));
+    }
+
+    private static ResponseEntity<String> response(AgentResponse response) {
+        return ResponseEntity.status(HttpStatus.valueOf(response.getStatus()))
+                .contentType(MediaType.APPLICATION_JSON)
+                .body(response.getBody());
+    }
+
+    private static void copyHeader(
+            ClientHttpResponse upstream, HttpServletResponse response, String name) {
+        String value = upstream.getHeaders().getFirst(name);
+        if (value != null) response.setHeader(name, value);
+    }
+
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/llm/ScheduledTaskController.java

@@ -0,0 +1,160 @@
+package com.epcc.arkweb.web.llm;
+
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.union.control.service.ScheduledTaskService;
+import com.epcc.arkweb.utils.ResultMsg;
+import com.epcc.arkweb.vo.llm.ScheduledTaskCommandVO;
+import com.epcc.arkweb.vo.llm.ScheduledTaskQueryVO;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+@Controller
+@RequestMapping(value = {"llm", "union-op/llm"})
+public class ScheduledTaskController {
+
+    @Autowired
+    private ScheduledTaskService scheduledTaskService;
+
+    @Autowired
+    private AuthenticatedRequest request;
+
+    @RequestMapping(value = "/scheduledTaskCreate", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg create(@RequestBody ScheduledTaskCommandVO command) {
+        return response(scheduledTaskService.create(request.json(command(command))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskUpdate", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg update(@RequestBody ScheduledTaskCommandVO command) {
+        return response(scheduledTaskService.update(request.json(command(command))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskList", method = {RequestMethod.GET, RequestMethod.POST})
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg list(ScheduledTaskQueryVO query) {
+        return response(scheduledTaskService.list(request.json(
+                "keyword", query.getKeyword(), "status", query.getStatus(),
+                "page", page(query.getPage()), "pageSize", pageSize(query.getPageSize()))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskDetail", method = RequestMethod.GET)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg detail(@RequestParam Long taskId) {
+        return response(scheduledTaskService.detail(request.json(
+                "taskId", positive(taskId, "taskId"))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskRunList", method = {RequestMethod.GET, RequestMethod.POST})
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg runList(ScheduledTaskQueryVO query) {
+        query.setTaskId(positive(query.getTaskId(), "taskId"));
+        return response(scheduledTaskService.runs(request.json(
+                "taskId", query.getTaskId(), "page", page(query.getPage()),
+                "pageSize", pageSize(query.getPageSize()))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskRunDetail", method = RequestMethod.GET)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg runDetail(@RequestParam Long runId) {
+        return response(scheduledTaskService.runDetail(request.json(
+                "runId", positive(runId, "runId"))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskUnread", method = RequestMethod.GET)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg unread() {
+        return response(scheduledTaskService.unread(request.json()));
+    }
+
+    @RequestMapping(value = "/scheduledTaskStart", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg start(@RequestBody IdCommand command) {
+        return response(scheduledTaskService.start(request.json(
+                "taskId", positive(command.getTaskId(), "taskId"))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskPause", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg pause(@RequestBody IdCommand command) {
+        return response(scheduledTaskService.pause(request.json(
+                "taskId", positive(command.getTaskId(), "taskId"))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskDiscard", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg discard(@RequestBody IdCommand command) {
+        return response(scheduledTaskService.discard(request.json(
+                "taskId", positive(command.getTaskId(), "taskId"))));
+    }
+
+    @RequestMapping(value = "/scheduledTaskRunOpen", method = RequestMethod.POST)
+    @RequiresPermissions(value = "/assistantManager/page")
+    @ResponseBody
+    public ResultMsg open(@RequestBody IdCommand command) {
+        return response(scheduledTaskService.open(request.json(
+                "runId", positive(command.getRunId(), "runId"))));
+    }
+
+    private static Long positive(Long value, String name) {
+        if (value == null || value <= 0L) {
+            throw new IllegalArgumentException(name + " 非法");
+        }
+        return value;
+    }
+
+    private static int page(Integer value) { return value == null ? 1 : value; }
+    private static int pageSize(Integer value) { return value == null ? 20 : value; }
+
+    private static Map<String, Object> command(ScheduledTaskCommandVO value) {
+        if (value == null) throw new IllegalArgumentException("请求参数非法");
+        Map<String, Object> command = new LinkedHashMap<>();
+        command.put("taskId", value.getTaskId());
+        command.put("title", value.getTitle());
+        command.put("prompt", value.getPrompt());
+        command.put("scheduleType", value.getScheduleType());
+        command.put("runAt", value.getRunAt());
+        command.put("cronExpression", value.getCronExpression());
+        command.put("intervalSeconds", value.getIntervalSeconds());
+        command.put("timezone", value.getTimezone());
+        return command;
+    }
+
+    private static ResultMsg response(Map<String, Object> result) {
+        if (result == null || !Boolean.TRUE.equals(result.get("success"))) {
+            return ResultMsg.fail(result == null ? "定时任务服务不可用"
+                    : String.valueOf(result.get("errorMsg")));
+        }
+        return ResultMsg.ok(result.get("data"));
+    }
+
+    public static class IdCommand {
+        private Long taskId;
+        private Long runId;
+
+        public Long getTaskId() { return taskId; }
+        public void setTaskId(Long taskId) { this.taskId = taskId; }
+        public Long getRunId() { return runId; }
+        public void setRunId(Long runId) { this.runId = runId; }
+    }
+
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/sensitive/reveal/SensitiveCaptchaService.java

@@ -0,0 +1,146 @@
+package com.epcc.arkweb.web.sensitive.reveal;
+
+import com.google.code.kaptcha.Producer;
+import org.apache.shiro.session.Session;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.http.HttpStatus;
+import org.springframework.stereotype.Service;
+
+import javax.imageio.ImageIO;
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.Serializable;
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.time.Clock;
+import java.util.Base64;
+import java.util.UUID;
+import java.util.regex.Pattern;
+
+/** Web-only challenge; uses the existing login session, never the reveal token store. */
+@Service
+public class SensitiveCaptchaService {
+    private static final Logger LOG = LoggerFactory.getLogger(SensitiveCaptchaService.class);
+    private static final String SESSION_KEY = SensitiveCaptchaService.class.getName() + ".challenge";
+    private static final long TTL_MILLIS = 120000L;
+    private static final Pattern TOKEN = Pattern.compile("rt_[A-Za-z0-9_-]{43}");
+    private final Producer producer;
+    private final Clock clock;
+    // ponytail: short session updates share a JVM lock; multi-node one-use needs sticky sessions.
+    private final Object sessionLock = new Object();
+
+    @Autowired
+    public SensitiveCaptchaService(Producer producer) {
+        this(producer, Clock.systemUTC());
+    }
+
+    SensitiveCaptchaService(Producer producer, Clock clock) {
+        this.producer = producer;
+        this.clock = clock;
+    }
+
+    public byte[] generate(Session session, String userId, String token) {
+        long started = System.nanoTime();
+        String sessionRef = sessionRef(session);
+        if (token == null || !TOKEN.matcher(token).matches()) {
+            LOG.info("Sensitive captcha generation rejected session_ref={} reason=invalid_token", sessionRef);
+            throw new CaptchaException("INVALID_TOKEN", HttpStatus.BAD_REQUEST);
+        }
+        if (session == null) {
+            LOG.info("Sensitive captcha generation rejected session_ref=none reason=no_session");
+            throw new CaptchaException("CAPTCHA_REQUIRED", HttpStatus.FORBIDDEN);
+        }
+        synchronized (sessionLock) {
+            session.removeAttribute(SESSION_KEY);
+        }
+        String answer;
+        ByteArrayOutputStream output = new ByteArrayOutputStream();
+        try {
+            answer = producer.createText();
+            if (!ImageIO.write(producer.createImage(answer), "png", output)) {
+                throw new IOException("PNG encoder unavailable");
+            }
+        } catch (IOException | RuntimeException error) {
+            LOG.info("Sensitive captcha generation failed session_ref={} error_type={}",
+                    sessionRef, error.getClass().getSimpleName());
+            throw new CaptchaException("CAPTCHA_UNAVAILABLE", HttpStatus.SERVICE_UNAVAILABLE);
+        }
+        Challenge challenge = new Challenge(userId, token, answer, clock.millis() + TTL_MILLIS);
+        synchronized (sessionLock) {
+            session.setAttribute(SESSION_KEY, challenge);
+        }
+        LOG.info("Sensitive captcha generated session_ref={} challenge_ref={} ttl_seconds=120 elapsed_ms={}",
+                sessionRef, challenge.id, (System.nanoTime() - started) / 1000000);
+        return output.toByteArray();
+    }
+
+    public void verify(Session session, String userId, String token, String answer) {
+        String sessionRef = sessionRef(session);
+        Object stored;
+        synchronized (sessionLock) {
+            stored = session == null ? null : session.removeAttribute(SESSION_KEY);
+        }
+        if (!(stored instanceof Challenge)) {
+            LOG.info("Sensitive captcha verification rejected session_ref={} reason={}",
+                    sessionRef, session == null ? "no_session" : "challenge_missing");
+            throw new CaptchaException("CAPTCHA_REQUIRED", HttpStatus.FORBIDDEN);
+        }
+        Challenge challenge = (Challenge) stored;
+        if (clock.millis() >= challenge.expiresAt) {
+            LOG.info("Sensitive captcha verification rejected session_ref={} challenge_ref={} reason=expired",
+                    sessionRef, challenge.id);
+            throw new CaptchaException("CAPTCHA_EXPIRED", HttpStatus.FORBIDDEN);
+        }
+        String reason = !challenge.userId.equals(userId) ? "user_mismatch"
+                : !challenge.token.equals(token) ? "token_mismatch"
+                : answer == null || answer.trim().isEmpty() ? "answer_missing"
+                : answer.length() > 32 || !challenge.answer.equalsIgnoreCase(answer.trim()) ? "answer_incorrect" : null;
+        if (reason != null) {
+            LOG.info("Sensitive captcha verification rejected session_ref={} challenge_ref={} reason={}",
+                    sessionRef, challenge.id, reason);
+            throw new CaptchaException("CAPTCHA_INVALID", HttpStatus.FORBIDDEN);
+        }
+        LOG.info("Sensitive captcha verification passed session_ref={} challenge_ref={}", sessionRef, challenge.id);
+    }
+
+    /** A non-credential correlation value; never log the login session ID itself. */
+    static String sessionRef(Session session) {
+        if (session == null || session.getId() == null) return "none";
+        try {
+            byte[] digest = MessageDigest.getInstance("SHA-256")
+                    .digest(session.getId().toString().getBytes(StandardCharsets.UTF_8));
+            return Base64.getUrlEncoder().withoutPadding().encodeToString(digest).substring(0, 16);
+        } catch (NoSuchAlgorithmException impossible) {
+            throw new IllegalStateException(impossible);
+        }
+    }
+
+    private static final class Challenge implements Serializable {
+        private static final long serialVersionUID = 1L;
+        final String id = UUID.randomUUID().toString();
+        final String userId;
+        final String token;
+        final String answer;
+        final long expiresAt;
+
+        Challenge(String userId, String token, String answer, long expiresAt) {
+            this.userId = userId;
+            this.token = token;
+            this.answer = answer;
+            this.expiresAt = expiresAt;
+        }
+    }
+
+    public static final class CaptchaException extends RuntimeException {
+        private static final long serialVersionUID = 1L;
+        final HttpStatus status;
+
+        CaptchaException(String code, HttpStatus status) {
+            super(code);
+            this.status = status;
+        }
+    }
+}

package/ark-web/src/main/java/com/epcc/arkweb/web/sensitive/reveal/SensitiveRevealController.java

@@ -0,0 +1,163 @@
+package com.epcc.arkweb.web.sensitive.reveal;
+
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.union.control.service.SensitiveDataDemoService;
+import com.union.control.service.sensitive.SensitiveRevealService;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.http.CacheControl;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.LinkedHashMap;
+import java.util.UUID;
+
+@RestController
+@RequestMapping("/api/sensitive/reveal")
+public class SensitiveRevealController {
+    private static final Logger LOG = LoggerFactory.getLogger(SensitiveRevealController.class);
+    private final SensitiveRevealService service;
+    private final SensitiveDataDemoService demoService;
+    private final AuthenticatedRequest request;
+    private final SensitiveCaptchaService captcha;
+    private final boolean strictMode;
+
+    public SensitiveRevealController(SensitiveRevealService service,
+            SensitiveDataDemoService demoService, AuthenticatedRequest request,
+            SensitiveCaptchaService captcha,
+            @Value("${sensitive.reveal.strict_mode:false}") boolean strictMode) {
+        this.service = service;
+        this.demoService = demoService;
+        this.request = request;
+        this.captcha = captcha;
+        this.strictMode = strictMode;
+    }
+
+    @GetMapping("/options")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public ResponseEntity<Map<String, Boolean>> options() {
+        request.actor();
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+                .body(Collections.singletonMap("strictMode", strictMode));
+    }
+
+    @PostMapping("/captcha")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public ResponseEntity<byte[]> captcha(@RequestBody Map<String, Object> payload) {
+        String userId = request.actor().getLoginName();
+        if (!strictMode) {
+            LOG.info("Sensitive captcha request rejected reason=strict_mode_disabled");
+            throw new SensitiveCaptchaService.CaptchaException("STRICT_MODE_DISABLED", HttpStatus.CONFLICT);
+        }
+        byte[] png = captcha.generate(SecurityUtils.getSubject().getSession(false),
+                userId, string(payload, "token"));
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+                .header(HttpHeaders.PRAGMA, "no-cache").contentType(MediaType.IMAGE_PNG).body(png);
+    }
+
+    @PostMapping
+    @RequiresPermissions(value = "/assistantManager/page")
+    public ResponseEntity<Map<String, String>> reveal(@RequestBody Map<String, Object> payload) {
+        String requestId = UUID.randomUUID().toString();
+        long started = System.nanoTime();
+        String stage = "captcha";
+        LOG.info("Sensitive reveal received request_id={} strict_mode={} session_ref={}", requestId, strictMode,
+                SensitiveCaptchaService.sessionRef(SecurityUtils.getSubject().getSession(false)));
+        try {
+            if (strictMode) {
+                captcha.verify(SecurityUtils.getSubject().getSession(false), request.actor().getLoginName(),
+                        string(payload, "token"), string(payload, "captchaCode"));
+            }
+            stage = "control";
+            LOG.info("Sensitive reveal calling Control request_id={}", requestId);
+            // Only token and server-generated trace metadata cross Dubbo; the answer stays in Web.
+            Map<String, Object> input = new LinkedHashMap<>();
+            input.put("token", payload.get("token"));
+            input.put("revealRequestId", requestId);
+            String plaintext = service.reveal(request.json(input));
+            LOG.info("Sensitive reveal completed request_id={} elapsed_ms={}",
+                    requestId, (System.nanoTime() - started) / 1000000);
+            return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+                    .header(HttpHeaders.PRAGMA, "no-cache")
+                    .body(Collections.singletonMap("value", plaintext));
+        } catch (RuntimeException error) {
+            String reason = error instanceof SensitiveCaptchaService.CaptchaException
+                    ? error.getMessage() : error.getClass().getSimpleName();
+            LOG.info("Sensitive reveal rejected request_id={} stage={} reason={} elapsed_ms={}",
+                    requestId, stage, reason, (System.nanoTime() - started) / 1000000);
+            throw error;
+        }
+    }
+
+    @ExceptionHandler(SensitiveCaptchaService.CaptchaException.class)
+    public ResponseEntity<Map<String, String>> captchaError(SensitiveCaptchaService.CaptchaException error) {
+        return ResponseEntity.status(error.status).cacheControl(CacheControl.noStore())
+                .header(HttpHeaders.PRAGMA, "no-cache").contentType(MediaType.APPLICATION_JSON)
+                .body(Collections.singletonMap("code", error.getMessage()));
+    }
+
+    private static String string(Map<String, Object> payload, String key) {
+        Object value = payload.get(key);
+        return value instanceof String ? (String) value : null;
+    }
+
+    @PostMapping("/demo/save")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public ResponseEntity<Map<String, Object>> saveDemo(@RequestBody Map<String, Object> payload) {
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+                .body(demoService.save(request.json(payload)));
+    }
+
+    @PostMapping("/demo/address-book/save")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public ResponseEntity<Map<String, Object>> saveAddressBookDemo(@RequestBody Map<String, Object> payload) {
+        return ResponseEntity.ok().cacheControl(CacheControl.noStore())
+                .body(demoService.saveAddressBook(request.json(payload)));
+    }
+
+    @ExceptionHandler(SensitiveRevealService.ExpiredTokenException.class)
+    public ResponseEntity<Map<String, String>> expiredToken(SensitiveRevealService.ExpiredTokenException error) {
+        return ResponseEntity.status(HttpStatus.GONE).cacheControl(CacheControl.noStore())
+                .body(Collections.singletonMap("code", "TOKEN_EXPIRED"));
+    }
+
+    @PostMapping("/demo/insert")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public Map<String, Integer> insertDemo(@RequestBody Map<String, Object> payload) {
+        return Collections.singletonMap("affectedRows", demoService.insert(request.json(payload)));
+    }
+
+    @GetMapping("/demo/query")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public List<Map<String, Object>> queryDemo() {
+        return demoService.query(request.json());
+    }
+
+    @PostMapping("/demo/address-book/insert")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public Map<String, Integer> insertAddressBookDemo(
+            @RequestBody Map<String, Object> payload) {
+        return Collections.singletonMap("affectedRows",
+                demoService.insertAddressBook(request.json(payload)));
+    }
+
+    @GetMapping("/demo/address-book/query")
+    @RequiresPermissions(value = "/assistantManager/page")
+    public List<Map<String, Object>> queryAddressBookDemo() {
+        return demoService.queryAddressBook(request.json());
+    }
+}

package/ark-web/src/main/resources/application.properties

@@ -0,0 +1 @@
+sensitive.reveal.strict_mode=${SENSITIVE_REVEAL_STRICT_MODE:true}