refs #740: enforce HMM MCP VPD runtime boundary

src/test/java/com/cloudhandson/vpdbackoffice/service/McpSseServiceTest.java

@@ -3,6 +3,8 @@ package com.cloudhandson.vpdbackoffice.service;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
 
 import com.cloudhandson.vpdbackoffice.config.BackofficeProperties;
 import com.cloudhandson.vpdbackoffice.config.McpProperties;
@@ -106,6 +108,50 @@ class McpSseServiceTest {
     assertThat(response.path("result").path("isError").asBoolean()).isFalse();
   }
 
+  @Test
+  void routesSelectAiToolThroughTheVpdAwareExecutor() {
+    String selectAiTools = """
+        [
+          {
+            "name":"search_hr_data",
+            "label":"HMM HR 데이터 조회",
+            "description":"VPD가 적용된 HMM HR 데이터를 조회합니다.",
+            "argumentName":"query",
+            "argumentDescription":"완전한 자연어 질문입니다.",
+            "executionType":"SELECT_AI"
+          }
+        ]
+        """;
+    McpProperties selectAiProperties =
+        new McpProperties("", "", "", "", "", "", selectAiTools);
+    SelectAiService selectAiService = mock(SelectAiService.class);
+    when(selectAiService.generateAndExecute(
+        "valid-token", "내 휴가 신청 내역을 보여줘"))
+        .thenReturn(objectMapper.createObjectNode().put("vpdEnforced", true));
+    McpSseService selectAiMcp = new McpSseService(
+        agentToolRunner,
+        selectAiService,
+        bearerAuthenticator,
+        new EnvironmentMcpToolCatalog(selectAiProperties, objectMapper),
+        selectAiProperties,
+        new BackofficeProperties(null, null, null, null, null),
+        objectMapper);
+    ObjectNode request = request(5, "tools/call");
+    request.putObject("params")
+        .put("name", "search_hr_data")
+        .putObject("arguments")
+        .put("query", "내 휴가 신청 내역을 보여줘");
+
+    ObjectNode response =
+        selectAiMcp.handle("default", request, "valid-token");
+
+    verify(selectAiService).generateAndExecute(
+        "valid-token", "내 휴가 신청 내역을 보여줘");
+    assertThat(response.path("result").path("isError").asBoolean()).isFalse();
+    assertThat(response.path("result").path("content").get(0).path("text").asText())
+        .contains("\"vpdEnforced\" : true");
+  }
+
   @Test
   void rejectsDiscoveryWhenBearerAuthenticationFails() {
     McpSseService rejectingService = new McpSseService(