[Developer] add Codex streamable MCP endpoint

src/main/java/com/cloudhandson/vpdbackoffice/config/SecurityConfig.java

@@ -8,7 +8,9 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.factory.PasswordEncoderFactories;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.security.provisioning.InMemoryUserDetailsManager;
+import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
 import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.http.HttpMethod;
 
 @Configuration
 public class SecurityConfig {
@@ -16,21 +18,24 @@ public class SecurityConfig {
   @Bean
   SecurityFilterChain securityFilterChain(
       HttpSecurity http,
-      BackofficeProperties properties
+      BackofficeProperties properties,
+      McpAccessTokenFilter mcpAccessTokenFilter
   ) throws Exception {
     if (properties.security().requireHttps()) {
       http.requiresChannel(channel -> channel.anyRequest().requiresSecure());
     }
 
     return http
+        .addFilterBefore(mcpAccessTokenFilter, BasicAuthenticationFilter.class)
         .csrf(csrf -> csrf.ignoringRequestMatchers(
-            "/mcp/messages", "/mcp/*/messages", "/dds/mcp/messages"))
+            "/mcp", "/mcp/messages", "/mcp/*/messages", "/dds/mcp/messages"))
         .headers(headers -> headers.httpStrictTransportSecurity(hsts -> hsts
             .includeSubDomains(true)
             .maxAgeInSeconds(31_536_000)))
         .authorizeHttpRequests(auth -> auth
             .requestMatchers("/css/**", "/js/**", "/webjars/**", "/dds/mcp/sse", "/dds/mcp/messages")
             .permitAll()
+            .requestMatchers(HttpMethod.POST, "/mcp").hasAnyRole("ADMIN", "MCP")
             .anyRequest().authenticated())
         .httpBasic(basic -> {
         })