fix #557: guide permission-driven VPD flow

src/main/java/com/cloudhandson/vpdbackoffice/web/McpChatbotController.java

@@ -1,7 +1,11 @@
 package com.cloudhandson.vpdbackoffice.web;
 
 import com.cloudhandson.vpdbackoffice.service.McpChatbotService;
+import com.cloudhandson.vpdbackoffice.service.BearerTokenService;
+import com.cloudhandson.vpdbackoffice.mapper.UserMapper;
 import jakarta.servlet.http.HttpServletRequest;
+import java.util.List;
+import org.springframework.dao.DataAccessException;
 import org.springframework.stereotype.Controller;
 import org.springframework.ui.Model;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -13,13 +17,27 @@ import org.springframework.web.servlet.support.ServletUriComponentsBuilder;
 public class McpChatbotController {
 
   private final McpChatbotService chatbotService;
+  private final BearerTokenService tokenService;
+  private final UserMapper userMapper;
 
-  public McpChatbotController(McpChatbotService chatbotService) {
+  public McpChatbotController(
+      McpChatbotService chatbotService,
+      BearerTokenService tokenService,
+      UserMapper userMapper
+  ) {
     this.chatbotService = chatbotService;
+    this.tokenService = tokenService;
+    this.userMapper = userMapper;
   }
 
   @GetMapping("/mcp-chatbot")
-  public String page() {
+  public String page(Model model) {
+    try {
+      model.addAttribute("users", userMapper.findAll());
+    } catch (DataAccessException exception) {
+      model.addAttribute("users", List.of());
+      model.addAttribute("runtimeError", RuntimeErrorMessages.dataAccess(exception));
+    }
     return "mcp-chatbot";
   }
 
@@ -28,6 +46,7 @@ public class McpChatbotController {
       @RequestParam(defaultValue = "vpd-live") String contextPath,
       @RequestParam(defaultValue = "") String question,
       @RequestParam(defaultValue = "") String bearerToken,
+      @RequestParam(required = false) Long tempUserId,
       @RequestParam(defaultValue = "50") int limit,
       HttpServletRequest request,
       Model model
@@ -38,7 +57,20 @@ public class McpChatbotController {
           .replaceQuery(null)
           .build()
           .toUriString();
-      model.addAttribute("result", chatbotService.chat(serverOrigin, contextPath, question, bearerToken, limit));
+      String effectiveToken = bearerToken;
+      Long temporaryKeyId = null;
+      if (tempUserId != null) {
+        var issued = tokenService.issueTemporaryToken(tempUserId, "MCP Chatbot 임시 실행");
+        effectiveToken = issued.plainToken();
+        temporaryKeyId = issued.keyId();
+      }
+      try {
+        model.addAttribute("result", chatbotService.chat(serverOrigin, contextPath, question, effectiveToken, limit));
+      } finally {
+        if (temporaryKeyId != null) {
+          tokenService.revokeToken(temporaryKeyId, "temporary chatbot completed");
+        }
+      }
     } catch (Exception e) {
       model.addAttribute("errorMessage", e.getMessage());
     }