joungmin/vpd-permission-poc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refs #744: expose DDS MCP under public context path

Browse Source
This commit is contained in:
devmrko
2026-08-04 14:55:24 +09:00
parent d868d7bbb8
commit 7dd47d39b9
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
dds-backoffice/src/main/java/com/cloudhandson/ddsbackoffice/config/SecurityConfig.java
View File

@@ -24,13 +24,13 @@ public class SecurityConfig {
} }
return http return http
.csrf(csrf -> csrf.ignoringRequestMatchers("/dds/mcp/messages")) .csrf(csrf -> csrf.ignoringRequestMatchers("/dds/mcp/messages", "/mcp/dds/messages"))
.headers(headers -> headers.httpStrictTransportSecurity(hsts -> hsts .headers(headers -> headers.httpStrictTransportSecurity(hsts -> hsts
.includeSubDomains(true) .includeSubDomains(true)
.maxAgeInSeconds(31_536_000))) .maxAgeInSeconds(31_536_000)))
.authorizeHttpRequests(auth -> auth .authorizeHttpRequests(auth -> auth
.requestMatchers("/css/**", "/js/**", "/health", "/login", .requestMatchers("/css/**", "/js/**", "/health", "/login",
"/dds/mcp/sse", "/dds/mcp/messages").permitAll() "/dds/mcp/sse", "/dds/mcp/messages", "/mcp/dds/sse", "/mcp/dds/messages").permitAll()
.anyRequest().authenticated()) .anyRequest().authenticated())
.httpBasic(basic -> { .httpBasic(basic -> {
}) })

15
dds-backoffice/src/main/java/com/cloudhandson/ddsbackoffice/web/DdsMcpSseController.java
View File

@@ -6,6 +6,7 @@ import com.cloudhandson.ddsbackoffice.service.DdsMcpSseService;
import com.cloudhandson.vpdbackoffice.service.AppException; import com.cloudhandson.vpdbackoffice.service.AppException;
import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.node.ObjectNode; import com.fasterxml.jackson.databind.node.ObjectNode;
import jakarta.servlet.http.HttpServletRequest;
import java.io.IOException; import java.io.IOException;
import java.util.Map; import java.util.Map;
import java.util.UUID; import java.util.UUID;
@@ -38,8 +39,11 @@ public class DdsMcpSseController {
this.service = service; this.service = service;
} }
@GetMapping(path = "/dds/mcp/sse", produces = MediaType.TEXT_EVENT_STREAM_VALUE) @GetMapping(path = {"/dds/mcp/sse", "/mcp/dds/sse"}, produces = MediaType.TEXT_EVENT_STREAM_VALUE)
public SseEmitter sse(@RequestHeader(name = "Authorization", required = false) String authorization) throws IOException { public SseEmitter sse(
@RequestHeader(name = "Authorization", required = false) String authorization,
HttpServletRequest request
) throws IOException {
DdsMcpAuthenticatedUser user = bearerAuthenticator.authenticate(authorization); DdsMcpAuthenticatedUser user = bearerAuthenticator.authenticate(authorization);
String sessionId = UUID.randomUUID().toString(); String sessionId = UUID.randomUUID().toString();
SseEmitter emitter = new SseEmitter(SSE_TIMEOUT_MILLIS); SseEmitter emitter = new SseEmitter(SSE_TIMEOUT_MILLIS);
@@ -47,11 +51,14 @@ public class DdsMcpSseController {
emitter.onCompletion(() -> sessions.remove(sessionId)); emitter.onCompletion(() -> sessions.remove(sessionId));
emitter.onTimeout(() -> sessions.remove(sessionId)); emitter.onTimeout(() -> sessions.remove(sessionId));
emitter.onError(error -> sessions.remove(sessionId)); emitter.onError(error -> sessions.remove(sessionId));
emitter.send(SseEmitter.event().name("endpoint").data("/dds/mcp/messages?sessionId=" + sessionId)); String messagesPath = request.getRequestURI().startsWith("/mcp/dds/")
? "/mcp/dds/messages"
: "/dds/mcp/messages";
emitter.send(SseEmitter.event().name("endpoint").data(messagesPath + "?sessionId=" + sessionId));
return emitter; return emitter;
} }
@PostMapping(path = "/dds/mcp/messages", consumes = MediaType.APPLICATION_JSON_VALUE) @PostMapping(path = {"/dds/mcp/messages", "/mcp/dds/messages"}, consumes = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<?> message( public ResponseEntity<?> message(
@RequestHeader(name = "Authorization", required = false) String authorization, @RequestHeader(name = "Authorization", required = false) String authorization,
@RequestParam(required = false) String sessionId, @RequestParam(required = false) String sessionId,