union-ark-web 1.0.1

package/ark-web/src/test/java/com/epcc/arkweb/ArkWebStructureContractTest.java

@@ -0,0 +1,290 @@
+package com.epcc.arkweb;
+
+import org.junit.Test;
+import org.springframework.beans.factory.annotation.AutowiredAnnotationBeanPostProcessor;
+
+import com.epcc.arkweb.web.llm.AgentController;
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.union.control.service.AgentExecutionService;
+import com.union.control.service.ConversationService;
+import com.union.control.service.MemoryStoreService;
+import com.union.control.service.RunningAnalysisMockService;
+import com.epcc.arkweb.web.llm.AgentAuthorizationInterceptor;
+import com.epcc.arkweb.web.llm.AgentPermission;
+import org.springframework.web.bind.annotation.PostMapping;
+
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.Arrays;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class ArkWebStructureContractTest {
+
+    private static final Path ROOT = Paths.get("src/main/java");
+    private static final Path LOCAL_MOCK = Paths.get("src/local-mock/java");
+    private static final Path PRODUCTION_OVERLAY = Paths.get("src/production-overlay/java");
+    private static final Path WORKSPACE = Paths.get("..");
+
+    @Test
+    public void dubboTimeoutBindsTheSharedPyDeadline() {
+        for (String seconds : new String[]{null, "2.5"}) {
+            org.springframework.beans.factory.support.DefaultListableBeanFactory beans =
+                    new org.springframework.beans.factory.support.DefaultListableBeanFactory();
+            beans.setBeanExpressionResolver(new org.springframework.context.expression.StandardBeanExpressionResolver());
+            new org.springframework.beans.factory.xml.XmlBeanDefinitionReader(beans)
+                    .loadBeanDefinitions("classpath:dubbo-consumer.xml");
+            java.util.Properties values = new java.util.Properties();
+            values.setProperty("dubbo.application.name", "timeout-test");
+            values.setProperty("dubbo.registry.address", "N/A");
+            values.setProperty("dubbo.consumer.timeout-ms", "10000");
+            values.setProperty("dubbo.consumer.check", "false");
+            values.setProperty("dubbo.consumer.direct-url", "");
+            if (seconds != null) values.setProperty("AGENT_MAX_RUN_SECONDS", seconds);
+            org.springframework.context.support.PropertySourcesPlaceholderConfigurer placeholders =
+                    new org.springframework.context.support.PropertySourcesPlaceholderConfigurer();
+            placeholders.setEnvironment(new org.springframework.mock.env.MockEnvironment());
+            placeholders.setProperties(values);
+            placeholders.postProcessBeanFactory(beans);
+            try {
+                com.alibaba.dubbo.config.spring.ReferenceBean<?> reference =
+                        (com.alibaba.dubbo.config.spring.ReferenceBean<?>) beans.getBean("&agentProxyService");
+                assertThat(reference.getTimeout()).isEqualTo(seconds == null ? 900000 : 2500);
+            } finally {
+                beans.destroySingletons();
+            }
+        }
+    }
+
+    @Test
+    public void localApplicationUsesTheProductionRootPackage() throws Exception {
+        String source = source("com/epcc/arkweb/Application.java");
+        assertThat(source)
+                .contains("package com.epcc.arkweb;")
+                .contains("class Application")
+                .contains("@ImportResource(\"classpath:dubbo-consumer.xml\")")
+                .doesNotContain("MapperScan")
+                .doesNotContain("com.union.control.mapper");
+        assertThat(ROOT.resolve("com/union/control")).doesNotExist();
+    }
+
+    @Test
+    public void allLlmControllersLiveAtTheProductionWebLayer() throws Exception {
+        for (String controller : Arrays.asList(
+                "LlmController.java", "AgentController.java", "ScheduledTaskController.java")) {
+            Path expected = ROOT.resolve("com/epcc/arkweb/web/llm").resolve(controller);
+            assertThat(expected).exists();
+        }
+
+        List<Path> serviceControllers = Files.walk(WORKSPACE.resolve("ark-control/src/main/java"))
+                .filter(Files::isRegularFile)
+                .filter(path -> path.getFileName().toString().endsWith("Controller.java"))
+                .collect(Collectors.toList());
+        assertThat(serviceControllers).isEmpty();
+
+    }
+
+    @Test
+    public void springSelectsTheAgentControllerProductionConstructor() {
+        java.lang.reflect.Constructor<?>[] constructors = new AutowiredAnnotationBeanPostProcessor()
+                .determineCandidateConstructors(AgentController.class, "agentController");
+        assertThat(constructors).hasSize(1);
+        assertThat(constructors[0].getParameterTypes()).containsExactly(
+                ConversationService.class, AgentExecutionService.class,
+                MemoryStoreService.class, RunningAnalysisMockService.class,
+                AuthenticatedRequest.class, AgentAuthorizationInterceptor.class);
+    }
+
+    @Test
+    public void controllerMatchesProductionShiroAndRouteConventions() throws Exception {
+        String source = source("com/epcc/arkweb/web/llm/ScheduledTaskController.java");
+
+        assertThat(source)
+                .contains("package com.epcc.arkweb.web.llm;")
+                .contains("@RequestMapping(value = {\"llm\", \"union-op/llm\"})")
+                .contains("@RequiresPermissions(value = \"/assistantManager/page\")")
+                .contains("AuthenticatedRequest")
+                .contains("request.json(")
+                .doesNotContain("@RequestHeader")
+                .doesNotContain("HttpHeaders.COOKIE")
+                .doesNotContain("CASSESSIONID")
+                .doesNotContain("agent:execute")
+                .doesNotContain("ScheduledExecutionToken");
+    }
+
+    @Test
+    public void authenticationLivesInWebAndNotInService() throws Exception {
+        String service = Files.walk(WORKSPACE.resolve("ark-control/src/main/java"))
+                .filter(Files::isRegularFile)
+                .map(path -> {
+                    try {
+                        return new String(Files.readAllBytes(path), StandardCharsets.UTF_8);
+                    } catch (Exception error) {
+                        throw new IllegalStateException(error);
+                    }
+                })
+                .collect(Collectors.joining("\n"));
+
+        assertThat(service)
+                .doesNotContain("org.apache.shiro")
+                .doesNotContain("AuthContextHolder")
+                .doesNotContain("currentUserId()");
+        assertThat(ROOT.resolve("com/epcc/arkweb/helper/AuthenticatedRequest.java")).exists();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/ShiroConfig.java")).exists();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/Realm.java")).exists();
+        assertThat(ROOT.resolve("com/epcc/arkweb/filter/LoginFormFilter.java")).exists();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/LocalCasRealm.java")).doesNotExist();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/LocalShiroConfig.java")).doesNotExist();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/ArkRealm.java")).doesNotExist();
+        assertThat(ROOT.resolve("com/epcc/arkweb/filter/AgentAuthenticationFilter.java")).doesNotExist();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/ScheduledExecutionRealm.java")).doesNotExist();
+        assertThat(ROOT.resolve("com/epcc/arkweb/config/AgentAuthorizationConfig.java"))
+                .doesNotExist();
+        assertThat(source("com/epcc/arkweb/config/InterceptorConfig.java"))
+                .contains("addPathPatterns(\"/agent/**\")")
+                .doesNotContain("SecurityManager");
+        assertThat(LOCAL_MOCK.resolve("com/epcc/arkweb/mock/ArkAuthServiceMock.java"))
+                .exists();
+        assertThat(ROOT.resolve("com/epcc/arkweb/local")).doesNotExist();
+    }
+
+    @Test
+    public void productionShiroCopiesWhitelistAgentBeforeTheCatchAll() throws Exception {
+        for (String name : Arrays.asList("CasShiroConfig.java", "ShiroConfig.java")) {
+            Path file = PRODUCTION_OVERLAY.resolve("com/epcc/arkweb/config").resolve(name);
+            assertThat(file).exists();
+            String source = new String(Files.readAllBytes(file), StandardCharsets.UTF_8);
+            int agent = source.indexOf("filterMap.put(\"/agent/**\", \"anon\")");
+            int catchAll = source.indexOf("filterMap.put(\"/**\",\"authc\")");
+            if (catchAll < 0)
+                catchAll = source.indexOf("filterMap.put(\"/**\", \"authc\")");
+            assertThat(agent).as(name).isGreaterThanOrEqualTo(0);
+            assertThat(agent).as(name).isLessThan(catchAll);
+            assertThat(source).doesNotContain("ScheduledExecutionRealm")
+                    .doesNotContain("ScheduledExecutionFilter");
+        }
+
+        String interceptors = new String(Files.readAllBytes(PRODUCTION_OVERLAY.resolve(
+                "com/epcc/arkweb/config/InterceptorConfig.java")), StandardCharsets.UTF_8);
+        assertThat(interceptors)
+                .contains("registry.addInterceptor(agentAuthorizationInterceptor)")
+                .contains("addPathPatterns(\"/agent/**\")")
+                .contains("\"/logout\", \"/agent/**\"")
+                .contains("\"/healthcheck.html\", \"/logout\", \"/agent/**\"");
+    }
+
+    @Test
+    public void scheduledAuthorizationReturnsTheCompleteTrustedSnapshot() throws Exception {
+        String source = source("com/epcc/arkweb/web/llm/AgentController.java");
+
+        assertThat(source)
+                .contains("@RequestMapping(\"/agent\")")
+                .contains("@PostMapping(\"/scheduledTaskAuthorize\")")
+                .contains("data.put(\"trustedContext\", authorization)")
+                .contains("new LinkedHashMap<>(context)")
+                .contains("this.authorization.authorize(");
+    }
+
+    @Test
+    public void everyAgentToolDeclaresItsPermission() {
+        for (java.lang.reflect.Method method : AgentController.class.getDeclaredMethods()) {
+            if (method.getAnnotation(PostMapping.class) == null
+                    || method.getName().equals("scheduledTaskAuthorize")) continue;
+            AgentPermission permission = method.getAnnotation(AgentPermission.class);
+            assertThat(permission).as(method.getName()).isNotNull();
+            assertThat(permission.value()).as(method.getName())
+                    .isEqualTo("/assistantManager/page");
+        }
+    }
+
+    @Test
+    public void browserCommandsCannotDeserializeTrustedIdentity() throws Exception {
+        String command = source("com/epcc/arkweb/vo/llm/ScheduledTaskCommandVO.java");
+        String query = source("com/epcc/arkweb/vo/llm/ScheduledTaskQueryVO.java");
+
+        for (String forbidden : Arrays.asList("userId", "loginName", "orgCode",
+                "roleId", "permission", "executionToken", "cookie")) {
+            assertThat(command).doesNotContain(forbidden);
+            assertThat(query).doesNotContain(forbidden);
+        }
+    }
+
+    @Test
+    public void webOwnsAuthenticationButNotSchedulingOrMappers() throws Exception {
+        List<String> files = Files.walk(ROOT)
+                .filter(Files::isRegularFile)
+                .map(path -> path.getFileName().toString())
+                .collect(Collectors.toList());
+        assertThat(files).doesNotContain("ScheduledTaskServiceImpl.java");
+        assertThat(files).doesNotContain("ApiExceptionHandler.java");
+        assertThat(files).doesNotContain("ScheduledTaskMapper.java");
+        assertThat(files).doesNotContain("CasSessionFilter.java", "TrustedPrincipal.java",
+                "AgentAuthenticationFilter.java", "LocalCasRealm.java", "CasSessionToken.java",
+                "AuthenticatedUser.java");
+        assertThat(files).contains(
+                "AuthContextHolder.java", "ShiroUser.java", "ResultMsg.java",
+                "ShiroConfig.java", "Realm.java", "LoginFormFilter.java",
+                "InterceptorConfig.java", "AgentAuthorizationInterceptor.java",
+                "AgentPermission.java");
+        assertThat(ROOT.resolve("com/epcc/arkweb/schedule/ScheduledTaskScheduler.java")).doesNotExist();
+        Path formerSecurityPackage = ROOT.resolve("com/epcc/arkweb/security");
+        assertThat(!Files.exists(formerSecurityPackage)
+                || Files.walk(formerSecurityPackage).noneMatch(Files::isRegularFile)).isTrue();
+    }
+
+    @Test
+    public void webDependsOnTheFacadeAndConsumesDubboReferences() throws Exception {
+        String pom = new String(Files.readAllBytes(Paths.get("pom.xml")), StandardCharsets.UTF_8);
+        String dubbo = new String(Files.readAllBytes(
+                Paths.get("src/main/resources/dubbo-consumer.xml")), StandardCharsets.UTF_8);
+
+        assertThat(pom).contains("<artifactId>ark-control-facade</artifactId>")
+                .doesNotContain("<artifactId>ark-control</artifactId>");
+        assertThat(dubbo)
+                .contains("id=\"agentProxyService\" interface=\"com.union.control.service.AgentProxyService\" check=\"${dubbo.consumer.check}\" url=\"${dubbo.consumer.direct-url}\" timeout=\"#{T(java.lang.Math).ceil(${AGENT_MAX_RUN_SECONDS:900} * 1000)}\"")
+                .contains("url=\"${dubbo.consumer.direct-url}\"")
+                .contains("timeout=\"${dubbo.consumer.timeout-ms}\"")
+                .contains("retries=\"0\"")
+                .doesNotContain("name=\"stream\"")
+                .doesNotContain("callback=\"true\"");
+
+        String config = new String(Files.readAllBytes(
+                Paths.get("src/main/resources/application.yml")), StandardCharsets.UTF_8);
+        assertThat(config)
+                .contains("direct-url: ${DUBBO_DIRECT_URL:}")
+                .contains("timeout-ms: ${DUBBO_CONSUMER_TIMEOUT_MS:10000}");
+
+        String controller = source("com/epcc/arkweb/web/llm/LlmController.java");
+        assertThat(controller)
+                .contains("pyAppBaseUrl + \"/agent/v1/runs\"")
+                .contains("response.getOutputStream().flush()")
+                .doesNotContain("gateway.stream(");
+    }
+
+    @Test
+    public void webDoesNotLogDubboArgumentsOrStreamChunks() throws Exception {
+        String source = Files.walk(ROOT)
+                .filter(Files::isRegularFile)
+                .map(path -> {
+                    try {
+                        return new String(Files.readAllBytes(path), StandardCharsets.UTF_8);
+                    } catch (Exception error) {
+                        throw new IllegalStateException(error);
+                    }
+                })
+                .collect(Collectors.joining("\n"));
+
+        assertThat(source)
+                .doesNotContain("invocation.getArguments()")
+                .doesNotContain("rpc.getArguments()")
+                .doesNotContain("callback chunk");
+    }
+
+    private static String source(String relative) throws Exception {
+        return new String(Files.readAllBytes(ROOT.resolve(relative)), StandardCharsets.UTF_8);
+    }
+}

package/ark-web/src/test/java/com/epcc/arkweb/ShiroTestSupport.java

@@ -0,0 +1,32 @@
+package com.epcc.arkweb;
+
+import com.epcc.arkweb.model.ShiroUser;
+import org.apache.shiro.mgt.DefaultSecurityManager;
+import org.apache.shiro.subject.SimplePrincipalCollection;
+import org.apache.shiro.subject.Subject;
+import org.apache.shiro.util.ThreadContext;
+
+public final class ShiroTestSupport {
+    public static final String USER_ID = "user-1";
+    public static final String ORG_CODE = "104100000004";
+    public static final String ROLE_ID = "ark-role-1";
+
+    private ShiroTestSupport() {}
+
+    public static void bindLocalUser() {
+        DefaultSecurityManager manager = new DefaultSecurityManager();
+        ShiroUser user = new ShiroUser();
+        user.setLoginName(USER_ID);
+        user.setOrgCode(ORG_CODE);
+        user.setRoleId(ROLE_ID);
+        Subject subject = new Subject.Builder(manager)
+                .principals(new SimplePrincipalCollection(
+                        user, ShiroTestSupport.class.getName()))
+                .authenticated(true).buildSubject();
+        subject.getSession().setAttribute("wl_session_user_key", user);
+        ThreadContext.bind(manager);
+        ThreadContext.bind(subject);
+    }
+
+    public static void clear() { ThreadContext.remove(); }
+}

package/ark-web/src/test/java/com/epcc/arkweb/config/LocalShiroIntegrationTest.java

@@ -0,0 +1,121 @@
+package com.epcc.arkweb.config;
+
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.epcc.arkweb.mock.ArkAuthServiceMock;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authc.UsernamePasswordToken;
+import org.apache.shiro.mgt.SecurityManager;
+import org.apache.shiro.subject.Subject;
+import org.apache.shiro.util.ThreadContext;
+import org.junit.After;
+import org.junit.Test;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+import org.springframework.core.env.MapPropertySource;
+import org.springframework.context.support.PropertySourcesPlaceholderConfigurer;
+import org.springframework.mock.web.MockFilterChain;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import javax.servlet.Filter;
+
+import java.util.Collections;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class LocalShiroIntegrationTest {
+    @After
+    public void clearShiro() {
+        ThreadContext.remove();
+        SecurityUtils.setSecurityManager(null);
+    }
+
+    @Test
+    public void authenticatedRequestUsesTheShiroSubjectAndPermissions() {
+        AnnotationConfigApplicationContext context = context("local-auth-mock");
+        try {
+            SecurityManager manager = context.getBean(SecurityManager.class);
+            SecurityUtils.setSecurityManager(manager);
+            Subject subject = new Subject.Builder(manager).buildSubject();
+            subject.login(new UsernamePasswordToken("user-1", "local-only"));
+            subject.execute(() -> {
+                assertThat(context.getBean(AuthenticatedRequest.class).actor().getRoleId())
+                        .isEqualTo("role-1");
+                assertThat(SecurityUtils.getSubject().isPermitted("/assistantManager/page"))
+                        .isTrue();
+            });
+        } finally {
+            context.close();
+        }
+    }
+
+    @Test
+    public void localRequestAuthenticatesWithoutSubmittingTheLoginForm() throws Exception {
+        AnnotationConfigApplicationContext context = context("local-auth-mock");
+        try {
+            SecurityManager manager = context.getBean(SecurityManager.class);
+            SecurityUtils.setSecurityManager(manager);
+            context.getBean("localAuthFilter", Filter.class).doFilter(
+                    new MockHttpServletRequest(), new MockHttpServletResponse(),
+                    new MockFilterChain());
+            assertThat(SecurityUtils.getSubject().isAuthenticated()).isTrue();
+            assertThat(SecurityUtils.getSubject().isPermitted("/assistantManager/page")).isTrue();
+        } finally {
+            context.close();
+        }
+    }
+
+    @Test
+    public void scheduledRequestDoesNotCreateAShiroLogin() throws Exception {
+        AnnotationConfigApplicationContext context = context("local-auth-mock");
+        try {
+            SecurityManager manager = context.getBean(SecurityManager.class);
+            SecurityUtils.setSecurityManager(manager);
+            MockHttpServletRequest request = new MockHttpServletRequest();
+            request.addHeader("Authorization",
+                    "Scheduled AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+            context.getBean("localAuthFilter", Filter.class).doFilter(
+                    request, new MockHttpServletResponse(), new MockFilterChain());
+            assertThat(SecurityUtils.getSubject().isAuthenticated()).isFalse();
+        } finally {
+            context.close();
+        }
+    }
+
+    @Test
+    public void localShiroDoesNotRegisterWithoutTheExplicitProfile() {
+        AnnotationConfigApplicationContext context = context();
+        try {
+            assertThat(context.getBeansOfType(ShiroConfig.class)).isEmpty();
+            assertThat(context.getBeansOfType(ArkAuthServiceMock.class)).isEmpty();
+        } finally {
+            context.close();
+        }
+    }
+
+    private static AnnotationConfigApplicationContext context(String... profiles) {
+        AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext();
+        context.getEnvironment().setActiveProfiles(profiles);
+        if (profiles.length > 0)
+            context.getEnvironment().getPropertySources().addFirst(new MapPropertySource(
+                    "test", Collections.<String, Object>singletonMap("arkshiro.sso", "false")));
+        context.register(TestConfiguration.class);
+        context.refresh();
+        return context;
+    }
+
+    @Configuration
+    @Import({ShiroConfig.class, ArkAuthServiceMock.class})
+    public static class TestConfiguration {
+        @Bean public static PropertySourcesPlaceholderConfigurer placeholders() {
+            return new PropertySourcesPlaceholderConfigurer();
+        }
+        @Bean public ObjectMapper objectMapper() { return new ObjectMapper(); }
+        @Bean public AuthenticatedRequest authenticatedRequest(ObjectMapper json) {
+            return new AuthenticatedRequest(json);
+        }
+    }
+}

package/ark-web/src/test/java/com/epcc/arkweb/helper/AuthenticatedRequestTest.java

@@ -0,0 +1,131 @@
+package com.epcc.arkweb.helper;
+
+import com.epcc.arkweb.ShiroTestSupport;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.epcc.arkweb.web.llm.AgentAuthorizationInterceptor;
+import com.union.control.service.ScheduledTaskService;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class AuthenticatedRequestTest {
+    private final ObjectMapper json = new ObjectMapper();
+
+    @Before
+    public void setUp() { ShiroTestSupport.bindLocalUser(); }
+
+    @After
+    public void tearDown() {
+        RequestContextHolder.resetRequestAttributes();
+        ShiroTestSupport.clear();
+    }
+
+    @Test
+    public void authenticatedIdentityOverridesClientSuppliedIdentity() throws Exception {
+        Map<String, Object> payload = new LinkedHashMap<>();
+        payload.put("userId", "attacker");
+        payload.put("orgCode", "attacker-org");
+        payload.put("roleId", "attacker-role");
+        payload.put("conversationId", "thread-1");
+
+        String input = new AuthenticatedRequest(json).json(payload);
+        Map<String, Object> parsed = json.readValue(
+                input, new TypeReference<Map<String, Object>>() {});
+
+        assertThat(parsed)
+                .containsEntry("userId", ShiroTestSupport.USER_ID)
+                .containsEntry("orgCode", ShiroTestSupport.ORG_CODE)
+                .containsEntry("roleId", ShiroTestSupport.ROLE_ID)
+                .containsEntry("conversationId", "thread-1");
+    }
+
+    @Test
+    public void removesClientIdentityBeforeForwardingPayload() throws Exception {
+        byte[] input = "{\"userId\":\"attacker\",\"orgCode\":\"x\",\"prompt\":\"hello\"}"
+                .getBytes("UTF-8");
+
+        Map<String, Object> parsed = json.readValue(
+                new AuthenticatedRequest(json).clientPayload(input),
+                new TypeReference<Map<String, Object>>() {});
+
+        assertThat(parsed).containsEntry("prompt", "hello")
+                .doesNotContainKeys("userId", "orgCode", "roleId");
+    }
+
+    @Test
+    public void scheduledContextOverridesClientIdentityWithoutUsingShiro() throws Exception {
+        Map<String, Object> context = new LinkedHashMap<>();
+        context.put("runId", 7L);
+        context.put("taskId", 8L);
+        context.put("userId", "scheduled-user");
+        context.put("orgCode", "scheduled-org");
+        context.put("roleId", "scheduled-role");
+        context.put("prompt", "prompt");
+        context.put("scheduledAt", "2026-09-02T01:00:00.000Z");
+        context.put("timezone", "UTC");
+        context.put("expiresAt", "2030-09-02T02:00:00.000Z");
+        MockHttpServletRequest servletRequest = new MockHttpServletRequest();
+        ScheduledTaskService tasks = mock(ScheduledTaskService.class);
+        when(tasks.resolveScheduledToken(
+                "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA")).thenReturn(context);
+        AgentAuthorizationInterceptor authorization = new AgentAuthorizationInterceptor(tasks);
+        authorization.setArkAuthService(new FakeArkAuthService());
+        MockHttpServletResponse servletResponse = new MockHttpServletResponse();
+        servletRequest.addHeader(AgentAuthorizationInterceptor.TRUSTED_CONTEXT_HEADER,
+                "Scheduled AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+        RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(servletRequest));
+        authorization.preHandle(servletRequest, servletResponse, scheduledHandler());
+
+        Map<String, Object> payload = new LinkedHashMap<>();
+        payload.put("userId", "attacker");
+        payload.put("orgCode", "attacker-org");
+        payload.put("roleId", "attacker-role");
+
+        Map<String, Object> parsed = json.readValue(
+                new AuthenticatedRequest(json).json(payload),
+                new TypeReference<Map<String, Object>>() {});
+
+        assertThat(parsed).containsEntry("userId", "scheduled-user")
+                .containsEntry("orgCode", "scheduled-org")
+                .containsEntry("roleId", "scheduled-role");
+    }
+
+    private static org.springframework.web.method.HandlerMethod scheduledHandler() throws Exception {
+        return new org.springframework.web.method.HandlerMethod(new ScheduledProbe(),
+                ScheduledProbe.class.getMethod("tool"));
+    }
+
+    public static final class ScheduledProbe {
+        @com.epcc.arkweb.web.llm.AgentPermission("/assistantManager/page")
+        public void tool() {}
+    }
+
+    public static final class FakeArkAuthService {
+        public FakeResult queryResource(String roleId, String userName, String traceNo) {
+            return new FakeResult(java.util.Collections.singletonList(new FakeResource()));
+        }
+    }
+
+    public static final class FakeResult {
+        private final Object result;
+        FakeResult(Object result) { this.result = result; }
+        public boolean isSuccess() { return true; }
+        public Object getResult() { return result; }
+    }
+
+    public static final class FakeResource {
+        public String getResourceUrl() { return "/assistantManager/page"; }
+    }
+}

package/ark-web/src/test/java/com/epcc/arkweb/local/LocalArkAuthServiceMockTest.java

@@ -0,0 +1,17 @@
+package com.epcc.arkweb.mock;
+
+import org.junit.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+public class LocalArkAuthServiceMockTest {
+    @Test
+    public void grantsOnlyTheConfiguredRole() {
+        ArkAuthServiceMock mock = new ArkAuthServiceMock(
+                "user-1", "local-only", "104100000004", "role-1");
+
+        assertThat(mock.queryResource("role-1", "user-1", "trace").getResult())
+                .extracting("resourceUrl").containsExactly("/assistantManager/page");
+        assertThat(mock.queryResource("role-2", "user-1", "trace").getResult()).isEmpty();
+    }
+}