union-ark-web 1.0.1

package/ark-web/src/test/java/com/epcc/arkweb/web/llm/AgentAuthorizationInterceptorTest.java

@@ -0,0 +1,134 @@
+package com.epcc.arkweb.web.llm;
+
+import com.union.control.service.ScheduledTaskService;
+import org.junit.After;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+import org.springframework.web.method.HandlerMethod;
+
+import java.lang.reflect.Method;
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class AgentAuthorizationInterceptorTest {
+    private static final String TOKEN = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+
+    @After
+    public void clearRequest() {
+        RequestContextHolder.resetRequestAttributes();
+    }
+
+    @Test
+    public void rawScheduledBearerCannotSkipTheAuthorizationEndpoint() throws Exception {
+        AgentAuthorizationInterceptor interceptor = interceptor(mock(ScheduledTaskService.class));
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/agent/tool");
+        request.addHeader("Authorization", "Scheduled " + TOKEN);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        assertThat(interceptor.preHandle(request, response, handler())).isFalse();
+        assertThat(response.getStatus()).isEqualTo(401);
+    }
+
+    @Test
+    public void trustedContextUsesDatabaseIdentityAndLiveResources() throws Exception {
+        ScheduledTaskService tasks = mock(ScheduledTaskService.class);
+        when(tasks.resolveScheduledToken(TOKEN)).thenReturn(row());
+        AgentAuthorizationInterceptor interceptor = interceptor(tasks);
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/agent/tool");
+        request.addHeader(AgentAuthorizationInterceptor.TRUSTED_CONTEXT_HEADER,
+                "Scheduled " + TOKEN);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        RequestContextHolder.setRequestAttributes(new ServletRequestAttributes(request));
+
+        assertThat(interceptor.preHandle(request, response, handler())).isTrue();
+        assertThat(AgentAuthorizationInterceptor.currentContext().get("userId"))
+                .isEqualTo("user-1");
+        assertThat(AgentAuthorizationInterceptor.currentContext().get("roleId"))
+                .isEqualTo("role-1");
+    }
+
+    @Test
+    public void missingProductionAuthServiceFailsClosed() throws Exception {
+        ScheduledTaskService tasks = mock(ScheduledTaskService.class);
+        when(tasks.resolveScheduledToken(TOKEN)).thenReturn(row());
+        AgentAuthorizationInterceptor interceptor = new AgentAuthorizationInterceptor(tasks);
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/agent/tool");
+        request.addHeader(AgentAuthorizationInterceptor.TRUSTED_CONTEXT_HEADER,
+                "Scheduled " + TOKEN);
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        assertThat(interceptor.preHandle(request, response, handler())).isFalse();
+        assertThat(response.getStatus()).isEqualTo(403);
+    }
+
+    @Test
+    public void unannotatedAgentMethodFailsClosed() throws Exception {
+        AgentAuthorizationInterceptor interceptor = interceptor(mock(ScheduledTaskService.class));
+        MockHttpServletRequest request = new MockHttpServletRequest("POST", "/agent/newTool");
+        MockHttpServletResponse response = new MockHttpServletResponse();
+        Method method = Probe.class.getMethod("unprotectedTool");
+
+        assertThat(interceptor.preHandle(
+                request, response, new HandlerMethod(new Probe(), method))).isFalse();
+        assertThat(response.getStatus()).isEqualTo(403);
+    }
+
+    private static AgentAuthorizationInterceptor interceptor(ScheduledTaskService tasks) {
+        AgentAuthorizationInterceptor interceptor = new AgentAuthorizationInterceptor(tasks);
+        interceptor.setArkAuthService(new FakeArkAuthService());
+        return interceptor;
+    }
+
+    private static HandlerMethod handler() throws Exception {
+        Method method = Probe.class.getMethod("tool");
+        return new HandlerMethod(new Probe(), method);
+    }
+
+    private static Map<String, Object> row() {
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("runId", 7L);
+        row.put("taskId", 8L);
+        row.put("userId", "user-1");
+        row.put("orgCode", "org-1");
+        row.put("roleId", "role-1");
+        row.put("prompt", "prompt");
+        row.put("scheduledAt", "2026-09-02T01:00:00.000Z");
+        row.put("timezone", "UTC");
+        row.put("expiresAt", "2030-09-02T02:00:00.000Z");
+        return row;
+    }
+
+    public static final class Probe {
+        @AgentPermission("/assistantManager/page")
+        public void tool() {}
+        public void unprotectedTool() {}
+    }
+
+    public static final class FakeArkAuthService {
+        public FakeResult queryResource(String roleId, String userName, String traceNo) {
+            return new FakeResult(Collections.singletonList(
+                    new FakeResource("/assistantManager/page")));
+        }
+    }
+
+    public static final class FakeResult {
+        private final Object result;
+        FakeResult(Object result) { this.result = result; }
+        public boolean isSuccess() { return true; }
+        public Object getResult() { return result; }
+    }
+
+    public static final class FakeResource {
+        private final String url;
+        FakeResource(String url) { this.url = url; }
+        public String getResourceUrl() { return url; }
+    }
+}

package/ark-web/src/test/java/com/epcc/arkweb/web/llm/AgentControllerAuthorizationTest.java

@@ -0,0 +1,97 @@
+package com.epcc.arkweb.web.llm;
+
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.union.control.service.AgentExecutionService;
+import com.union.control.service.ConversationService;
+import com.union.control.service.MemoryStoreService;
+import com.union.control.service.RunningAnalysisMockService;
+import com.union.control.service.ScheduledTaskService;
+import org.junit.Test;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+public class AgentControllerAuthorizationTest {
+    @Test
+    public void returnsTrustedContextOnlyAfterControlAndResourceChecks() {
+        ScheduledTaskService tasks = mock(ScheduledTaskService.class);
+        String token = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("runId", 7L);
+        row.put("taskId", 8L);
+        row.put("userId", "user-1");
+        row.put("orgCode", "org-1");
+        row.put("roleId", "role-1");
+        row.put("prompt", "prompt");
+        row.put("scheduledAt", "2026-09-02T01:00:00.000Z");
+        row.put("timezone", "UTC");
+        row.put("expiresAt", "2030-09-02T02:00:00.000Z");
+        when(tasks.resolveScheduledToken(token)).thenReturn(row);
+        AgentAuthorizationInterceptor authorization = new AgentAuthorizationInterceptor(tasks);
+        authorization.setArkAuthService(new FakeArkAuthService(true));
+        AgentController controller = new AgentController(
+                mock(ConversationService.class), mock(AgentExecutionService.class),
+                mock(MemoryStoreService.class), mock(RunningAnalysisMockService.class),
+                mock(AuthenticatedRequest.class), authorization);
+
+        ResponseEntity<Map<String, Object>> response = controller.scheduledTaskAuthorize(
+                "Scheduled " + token, Collections.emptyMap());
+
+        assertThat(response.getStatusCode()).isEqualTo(HttpStatus.OK);
+        assertThat(response.getBody().get("success")).isEqualTo(true);
+        @SuppressWarnings("unchecked") Map<String, Object> data =
+                (Map<String, Object>) response.getBody().get("data");
+        assertThat(data).containsEntry("userId", "user-1")
+                .containsEntry("roleId", "role-1")
+                .containsEntry("trustedContext", "Scheduled " + token);
+    }
+
+    @Test
+    public void rejectsIdentityFieldsInTheAuthorizationRequestBody() {
+        AgentAuthorizationInterceptor authorization = new AgentAuthorizationInterceptor(
+                mock(ScheduledTaskService.class));
+        authorization.setArkAuthService(new FakeArkAuthService(true));
+        AgentController controller = new AgentController(
+                mock(ConversationService.class), mock(AgentExecutionService.class),
+                mock(MemoryStoreService.class), mock(RunningAnalysisMockService.class),
+                mock(AuthenticatedRequest.class), authorization);
+        Map<String, Object> payload = new LinkedHashMap<>();
+        payload.put("roleId", "attacker-role");
+
+        assertThat(controller.scheduledTaskAuthorize(
+                "Scheduled AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA", payload)
+                .getStatusCode()).isEqualTo(HttpStatus.UNAUTHORIZED);
+    }
+
+    public static final class FakeArkAuthService {
+        private final boolean allowed;
+
+        FakeArkAuthService(boolean allowed) { this.allowed = allowed; }
+
+        public FakeResult queryResource(String roleId, String userName, String traceNo) {
+            return new FakeResult(allowed
+                    ? Collections.singletonList(new FakeResource("/assistantManager/page"))
+                    : Collections.<FakeResource>emptyList());
+        }
+    }
+
+    public static final class FakeResult {
+        private final Object result;
+        FakeResult(Object result) { this.result = result; }
+        public boolean isSuccess() { return true; }
+        public Object getResult() { return result; }
+    }
+
+    public static final class FakeResource {
+        private final String url;
+        FakeResource(String url) { this.url = url; }
+        public String getResourceUrl() { return url; }
+    }
+}

package/ark-web/src/test/java/com/epcc/arkweb/web/llm/LlmControllerTest.java

@@ -0,0 +1,113 @@
+package com.epcc.arkweb.web.llm;
+
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.union.control.service.AgentExecutionService;
+import com.union.control.service.AgentResponse;
+import com.union.control.service.AgentProxyService;
+import com.union.control.service.ConversationService;
+import org.junit.Test;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpMethod;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.test.web.client.MockRestServiceServer;
+import org.springframework.web.client.RestTemplate;
+
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+import static org.springframework.test.web.client.match.MockRestRequestMatchers.header;
+import static org.springframework.test.web.client.match.MockRestRequestMatchers.method;
+import static org.springframework.test.web.client.match.MockRestRequestMatchers.requestTo;
+import static org.springframework.test.web.client.response.MockRestResponseCreators.withSuccess;
+
+public class LlmControllerTest {
+    @Test
+    public void returnsSynchronousAgentResponseAsJson() {
+        ConversationService conversations = mock(ConversationService.class);
+        AgentExecutionService executions = mock(AgentExecutionService.class);
+        AgentProxyService gateway = mock(AgentProxyService.class);
+        AuthenticatedRequest request = mock(AuthenticatedRequest.class);
+        byte[] payload = "{}".getBytes(StandardCharsets.UTF_8);
+        when(request.clientPayload(payload)).thenReturn(payload);
+        when(gateway.sync("CASSESSIONID=session", "{}"))
+                .thenReturn(new AgentResponse(200, "{\"content\":{\"status\":\"READY\"}}"));
+
+        ResponseEntity<String> response = new LlmController(
+                conversations, executions, gateway, request, "http://py-app", new RestTemplate())
+                .chatMessageSync("CASSESSIONID=session", payload);
+
+        assertThat(response.getHeaders().getContentType()).isEqualTo(MediaType.APPLICATION_JSON);
+        assertThat(response.getBody()).isEqualTo("{\"content\":{\"status\":\"READY\"}}");
+    }
+
+    @Test
+    public void streamsPyAppHttpResponseDirectlyToTheBrowser() throws Exception {
+        ConversationService conversations = mock(ConversationService.class);
+        AgentExecutionService executions = mock(AgentExecutionService.class);
+        AgentProxyService gateway = mock(AgentProxyService.class);
+        AuthenticatedRequest request = mock(AuthenticatedRequest.class);
+        RestTemplate http = new RestTemplate();
+        MockRestServiceServer server = MockRestServiceServer.createServer(http);
+        byte[] payload = "{}".getBytes(StandardCharsets.UTF_8);
+        when(request.clientPayload(payload)).thenReturn(payload);
+        when(request.json(payload)).thenReturn("claim");
+        Map<String, Object> execution = new LinkedHashMap<>();
+        execution.put("conversationId", "conversation-1");
+        execution.put("runId", "run-1");
+        Map<String, Object> claimed = new LinkedHashMap<>();
+        claimed.put("data", execution);
+        when(executions.claimAguiRun("claim")).thenReturn(claimed);
+        server.expect(requestTo("http://py-app/agent/v1/runs"))
+                .andExpect(method(HttpMethod.POST))
+                .andExpect(header(HttpHeaders.COOKIE, "CASSESSIONID=session"))
+                .andRespond(withSuccess("data: first\n\ndata: second\n\n", MediaType.TEXT_EVENT_STREAM));
+        MockHttpServletResponse response = new MockHttpServletResponse();
+
+        new LlmController(conversations, executions, gateway, request, "http://py-app", http)
+                .chatMessage("CASSESSIONID=session", payload, response);
+
+        assertThat(response.getContentAsString()).isEqualTo("data: first\n\ndata: second\n\n");
+        assertThat(response.getHeader(HttpHeaders.CONTENT_TYPE)).isEqualTo("text/event-stream");
+        assertThat(response.getHeader("X-Accel-Buffering")).isEqualTo("no");
+        server.verify();
+    }
+    @Test(timeout = 5000)
+    public void streamingStopsWaitingForASilentUpstream() throws Exception {
+        com.sun.net.httpserver.HttpServer server = com.sun.net.httpserver.HttpServer.create(
+                new java.net.InetSocketAddress("127.0.0.1", 0), 0);
+        server.createContext("/", exchange -> {
+            try { Thread.sleep(150); }
+            catch (InterruptedException error) { Thread.currentThread().interrupt(); }
+            finally { exchange.close(); }
+        });
+        server.start();
+        try {
+            AuthenticatedRequest request = mock(AuthenticatedRequest.class);
+            AgentExecutionService executions = mock(AgentExecutionService.class);
+            byte[] payload = "{}".getBytes(StandardCharsets.UTF_8);
+            when(request.clientPayload(payload)).thenReturn(payload);
+            when(request.json(payload)).thenReturn("claim");
+            Map<String, Object> execution = new LinkedHashMap<>();
+            execution.put("conversationId", "thread-1");
+            execution.put("runId", "run-1");
+            when(executions.claimAguiRun("claim"))
+                    .thenReturn(java.util.Collections.singletonMap("data", execution));
+            LlmController controller = new LlmController(mock(ConversationService.class), executions,
+                    mock(AgentProxyService.class), request,
+                    "http://127.0.0.1:" + server.getAddress().getPort(), 0.05);
+            org.assertj.core.api.Assertions.assertThatThrownBy(() -> controller.chatMessage(
+                    "session", payload, new MockHttpServletResponse()))
+                    .isInstanceOf(org.springframework.web.client.ResourceAccessException.class)
+                    .hasCauseInstanceOf(java.net.SocketTimeoutException.class);
+        } finally {
+            server.stop(0);
+        }
+    }
+
+}

package/ark-web/src/test/java/com/epcc/arkweb/web/sensitive/reveal/SensitiveRevealControllerTest.java

@@ -0,0 +1,273 @@
+package com.epcc.arkweb.web.sensitive.reveal;
+
+import com.epcc.arkweb.ShiroTestSupport;
+import com.epcc.arkweb.helper.AuthenticatedRequest;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.google.code.kaptcha.Producer;
+import com.union.control.service.SensitiveDataDemoService;
+import com.union.control.service.sensitive.SensitiveRevealService;
+import org.apache.shiro.SecurityUtils;
+import org.apache.shiro.authz.annotation.RequiresPermissions;
+import org.apache.shiro.session.Session;
+import org.apache.shiro.session.mgt.SimpleSession;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+import org.springframework.http.MediaType;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+
+import javax.imageio.ImageIO;
+import java.awt.image.BufferedImage;
+import java.io.ByteArrayInputStream;
+import java.lang.reflect.Method;
+import java.time.Clock;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.*;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.*;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
+
+public class SensitiveRevealControllerTest {
+    private static final String ROOT = "/api/sensitive/reveal";
+    private static final String TOKEN = "rt_AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA";
+    private static final String OTHER_TOKEN = "rt_BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB";
+    private final Producer producer = mock(Producer.class);
+    private final SensitiveRevealService reveal = mock(SensitiveRevealService.class);
+    private final SensitiveDataDemoService demo = mock(SensitiveDataDemoService.class);
+    private final Clock clock = mock(Clock.class);
+    private SensitiveCaptchaService captcha;
+    private MockMvc mvc;
+
+    @Before
+    public void setUp() {
+        ShiroTestSupport.bindLocalUser();
+        when(producer.createText()).thenReturn("A7K9");
+        when(producer.createImage(anyString())).thenReturn(new BufferedImage(110, 40,
+                BufferedImage.TYPE_INT_RGB));
+        when(clock.millis()).thenReturn(1000L);
+        when(reveal.reveal(anyString())).thenReturn("13800138000");
+        captcha = new SensitiveCaptchaService(producer, clock);
+        mvc = mvc(true);
+    }
+
+    @After
+    public void tearDown() { ShiroTestSupport.clear(); }
+
+    @Test
+    public void normalModeKeepsDirectRevealAndDoesNotGenerateACaptcha() throws Exception {
+        mvc = mvc(false);
+        mvc.perform(get(ROOT + "/options")).andExpect(jsonPath("$.strictMode").value(false));
+        submit(TOKEN, null).andExpect(status().isOk())
+                .andExpect(jsonPath("$.value").value("13800138000"));
+        mvc.perform(post(ROOT + "/captcha").contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"" + TOKEN + "\"}"))
+                .andExpect(status().isConflict());
+        verifyZeroInteractions(producer);
+    }
+
+    @Test
+    public void strictModeReturnsPngAndOnlyCallsControlAfterCorrectAnswer() throws Exception {
+        mvc.perform(get(ROOT + "/options")).andExpect(jsonPath("$.strictMode").value(true));
+        byte[] png = generate();
+        BufferedImage image = ImageIO.read(new ByteArrayInputStream(png));
+        assertThat(image.getWidth()).isEqualTo(110);
+        assertThat(image.getHeight()).isEqualTo(40);
+        verifyZeroInteractions(reveal);
+
+        submit(TOKEN, " a7k9 ").andExpect(status().isOk())
+                .andExpect(header().string("Cache-Control", "no-store"))
+                .andExpect(jsonPath("$.value").value("13800138000"));
+        ArgumentCaptor<String> input = ArgumentCaptor.forClass(String.class);
+        verify(reveal).reveal(input.capture());
+        assertThat(input.getValue()).contains(TOKEN, "user-1")
+                .doesNotContain("captchaCode").doesNotContain("a7k9");
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        verifyNoMoreInteractions(reveal);
+    }
+
+    @Test
+    public void missingWrongAndExpiredAnswersNeverReachControl() throws Exception {
+        submit(TOKEN, null).andExpect(status().isForbidden())
+                .andExpect(jsonPath("$.code").value("CAPTCHA_REQUIRED"));
+        generate();
+        submit(TOKEN, "wrong").andExpect(status().isForbidden())
+                .andExpect(jsonPath("$.code").value("CAPTCHA_INVALID"));
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        generate();
+        when(clock.millis()).thenReturn(121000L);
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden())
+                .andExpect(jsonPath("$.code").value("CAPTCHA_EXPIRED"));
+        verifyZeroInteractions(reveal);
+    }
+
+    @Test
+    public void captchaCannotBeUsedForAnotherTokenOrSession() throws Exception {
+        generate();
+        submit(OTHER_TOKEN, "A7K9").andExpect(status().isForbidden());
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        generate();
+        ShiroTestSupport.bindLocalUser();
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        verifyZeroInteractions(reveal);
+    }
+
+    @Test
+    public void refreshingOverwritesThePreviousChallenge() throws Exception {
+        generate();
+        when(producer.createText()).thenReturn("B8M2");
+        generate();
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        generate();
+        submit(TOKEN, "B8M2").andExpect(status().isOk());
+        verify(reveal, times(1)).reveal(anyString());
+    }
+
+    @Test
+    public void invalidTokenDoesNotGenerateAnImage() throws Exception {
+        mvc.perform(post(ROOT + "/captcha").contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"bad\"}"))
+                .andExpect(status().isBadRequest());
+        verifyZeroInteractions(producer, reveal);
+    }
+
+    @Test
+    public void anonymousRequestsCannotGenerateAnImage() throws Exception {
+        SecurityUtils.getSubject().logout();
+        assertThatThrownBy(() -> generate()).hasRootCauseInstanceOf(
+                org.apache.shiro.authz.UnauthenticatedException.class);
+        verifyZeroInteractions(producer, reveal);
+    }
+
+    @Test
+    public void everyBrowserEndpointRetainsTheExistingPermission() {
+        for (Method method : SensitiveRevealController.class.getDeclaredMethods()) {
+            if (method.getAnnotation(org.springframework.web.bind.annotation.PostMapping.class) == null
+                    && method.getAnnotation(org.springframework.web.bind.annotation.GetMapping.class) == null) continue;
+            assertThat(method.getAnnotation(RequiresPermissions.class).value())
+                    .containsExactly("/assistantManager/page");
+        }
+    }
+
+    @Test
+    public void changingUserWithinASessionInvalidatesTheAnswer() {
+        Session session = new SimpleSession();
+        captcha.generate(session, "user-1", TOKEN);
+        assertThatThrownBy(() -> captcha.verify(session, "user-2", TOKEN, "A7K9"))
+                .isInstanceOf(SensitiveCaptchaService.CaptchaException.class);
+    }
+
+    @Test
+    public void actualKaptchaProducesADecodablePngAndTheAnswerIsVerifiable() throws Exception {
+        Producer real = spy(new com.epcc.arkweb.mock.LocalKaptchaConfiguration().captchaProducer());
+        doReturn("A7K9").when(real).createText();
+        SensitiveCaptchaService service = new SensitiveCaptchaService(real, clock);
+        Session session = new SimpleSession();
+
+        BufferedImage image = ImageIO.read(new ByteArrayInputStream(service.generate(session, "user-1", TOKEN)));
+
+        assertThat(image.getWidth()).isEqualTo(110);
+        assertThat(image.getHeight()).isEqualTo(40);
+        service.verify(session, "user-1", TOKEN, "A7K9");
+    }
+
+    @Test
+    public void pngFailureDoesNotLeaveTheOldChallengeUsable() throws Exception {
+        generate();
+        when(producer.createImage(anyString())).thenThrow(new IllegalStateException("internal image failure"));
+        mvc.perform(post(ROOT + "/captcha").contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"" + TOKEN + "\"}"))
+                .andExpect(status().isServiceUnavailable())
+                .andExpect(jsonPath("$.code").value("CAPTCHA_UNAVAILABLE"));
+        submit(TOKEN, "A7K9").andExpect(status().isForbidden());
+        verifyZeroInteractions(reveal);
+    }
+
+    @Test
+    public void sessionChallengeSurvivesSerializationAndIsConsumedOnceUnderConcurrency() throws Exception {
+        SimpleSession session = new SimpleSession();
+        captcha.generate(session, "user-1", TOKEN);
+        java.io.ByteArrayOutputStream bytes = new java.io.ByteArrayOutputStream();
+        try (java.io.ObjectOutputStream output = new java.io.ObjectOutputStream(bytes)) {
+            output.writeObject(session);
+        }
+        final Session restored;
+        try (java.io.ObjectInputStream input = new java.io.ObjectInputStream(
+                new ByteArrayInputStream(bytes.toByteArray()))) {
+            restored = (Session) input.readObject();
+        }
+        java.util.concurrent.ExecutorService threads = java.util.concurrent.Executors.newFixedThreadPool(2);
+        java.util.concurrent.CountDownLatch start = new java.util.concurrent.CountDownLatch(1);
+        java.util.concurrent.Callable<Integer> attempt = () -> {
+            start.await();
+            try {
+                captcha.verify(restored, "user-1", TOKEN, "A7K9");
+                return 1;
+            } catch (SensitiveCaptchaService.CaptchaException expected) {
+                return 0;
+            }
+        };
+        try {
+            java.util.concurrent.Future<Integer> first = threads.submit(attempt);
+            java.util.concurrent.Future<Integer> second = threads.submit(attempt);
+            start.countDown();
+            assertThat(first.get(5, java.util.concurrent.TimeUnit.SECONDS)
+                    + second.get(5, java.util.concurrent.TimeUnit.SECONDS)).isEqualTo(1);
+        } finally {
+            threads.shutdownNow();
+        }
+    }
+
+    @Test
+    public void savesReturnExactMaskedRowsWithoutClientRevealAndOverwriteIdentity() throws Exception {
+        java.util.Map<String, Object> saved = new java.util.LinkedHashMap<>();
+        saved.put("id", 7); saved.put("phoneNumber", "[#138****8000#VIEW:" + TOKEN + "]");
+        when(demo.save(anyString())).thenReturn(saved);
+        when(demo.saveAddressBook(anyString())).thenReturn(saved);
+        for (String path : new String[]{"/demo/save", "/demo/address-book/save"}) {
+            mvc.perform(post(ROOT + path).contentType(MediaType.APPLICATION_JSON)
+                    .content("{\"id\":7,\"userId\":\"forged\",\"phoneNumber\":\"new text\"}"))
+                    .andExpect(status().isOk()).andExpect(header().string("Cache-Control", "no-store"))
+                    .andExpect(jsonPath("$.id").value(7))
+                    .andExpect(jsonPath("$.phoneNumber").value(saved.get("phoneNumber")));
+        }
+        ArgumentCaptor<String> input = ArgumentCaptor.forClass(String.class);
+        verify(demo).save(input.capture());
+        assertThat(input.getValue()).contains("user-1").doesNotContain("forged");
+        verifyZeroInteractions(reveal, producer);
+    }
+
+    @Test
+    public void expiredSaveTokenHasARefreshableStatusWithoutPlaintext() throws Exception {
+        when(demo.save(anyString())).thenThrow(new SensitiveRevealService.ExpiredTokenException());
+        mvc.perform(post(ROOT + "/demo/save").contentType(MediaType.APPLICATION_JSON).content("{}"))
+                .andExpect(status().isGone()).andExpect(jsonPath("$.code").value("TOKEN_EXPIRED"))
+                .andExpect(header().string("Cache-Control", "no-store"));
+        verifyZeroInteractions(reveal, producer);
+    }
+
+    private MockMvc mvc(boolean strict) {
+        return MockMvcBuilders.standaloneSetup(new SensitiveRevealController(reveal,
+                demo, new AuthenticatedRequest(new ObjectMapper()),
+                captcha, strict)).build();
+    }
+
+    private byte[] generate() throws Exception {
+        return mvc.perform(post(ROOT + "/captcha").contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"" + TOKEN + "\"}"))
+                .andExpect(status().isOk())
+                .andExpect(content().contentType(MediaType.IMAGE_PNG))
+                .andExpect(header().string("Cache-Control", "no-store"))
+                .andReturn().getResponse().getContentAsByteArray();
+    }
+
+    private org.springframework.test.web.servlet.ResultActions submit(String token, String answer)
+            throws Exception {
+        return mvc.perform(post(ROOT).contentType(MediaType.APPLICATION_JSON)
+                .content("{\"token\":\"" + token + "\""
+                        + (answer == null ? "" : ",\"captchaCode\":\"" + answer + "\"") + "}"));
+    }
+}

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "union-ark-web",
+  "version": "1.0.1",
+  "description": "Ark Web and Ark Control Dubbo applications for Union Agent",
+  "files": [
+    "ark-control-facade",
+    "ark-control",
+    "ark-web",
+    "!ark-control-facade/target",
+    "!ark-control/target",
+    "!ark-web/target",
+    "PROJECT_OVERVIEW.md",
+    "pom.xml"
+  ],
+  "scripts": {
+    "test": "mvn test"
+  }
+}

package/pom.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>com.nucc.channel.ark</groupId>
+    <artifactId>union-agent-apps</artifactId>
+    <version>1.0.0</version>
+    <packaging>pom</packaging>
+
+    <modules>
+        <module>ark-control-facade</module>
+        <module>ark-control</module>
+        <module>ark-web</module>
+    </modules>
+</project>