chore: record pre-existing uncommitted repository state

Snapshot of the in-flight state that already existed, identically, in both this worktree and the main checkout before this session began: the initial HTTP Client platform implementation (previously untracked), the redis-lab removal, and the JPA / object-storage / notification integration work. Kept separate from this session's HTTP Client review response, which lands in the following commit, so the two bodies of work stay reviewable apart. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-11 16:48:43 +09:00
parent 1a3b560678
commit 5f10b791d3
1857 changed files with 130925 additions and 72491 deletions
@@ -0,0 +1,105 @@
+Closure<String> renderPublicPathSnapshot = { File environmentFile ->
+    if (!environmentFile.isFile()) {
+        throw new GradleException(
+                "missing public-path environment file ${environmentFile}")
+    }
+
+    def valuePattern = ~/^SECURITY_PUBLIC_PATHS=(.*)$/
+    String raw = environmentFile.readLines('UTF-8').findResult { String line ->
+        def matcher = valuePattern.matcher(line)
+        matcher.matches() ? matcher.group(1) : null
+    } ?: ''
+    List<String> publicPaths = raw.split(',')
+            .collect { String value -> value.trim() }
+            .findAll { String value -> !value.isEmpty() }
+            .toSorted()
+
+    String header =
+            "# feature-security-operational-baseline D5 — deny-by-default public path snapshot.\n" +
+                    "# SSOT: SECURITY_PUBLIC_PATHS (src/.env) -> SecurityConfig permitAll(); " +
+                    "anyRequest authenticated.\n" +
+                    "# Update only after review with: ./gradlew updatePublicPathSnapshot " +
+                    "-PapprovePublicPathChange\n"
+    header + (publicPaths.isEmpty() ? '' : publicPaths.join('\n') + '\n')
+}
+
+File publicPathEnvironmentFile = rootProject.file('.env')
+File publicPathSnapshotFile =
+        rootProject.file('../docs/security/public-paths-snapshot.txt')
+boolean publicPathUpdateApproved = project.hasProperty('approvePublicPathChange')
+def existingPublicPathEnvironment = providers.provider {
+    publicPathEnvironmentFile.isFile() ? publicPathEnvironmentFile : null
+}
+def existingPublicPathSnapshot = providers.provider {
+    publicPathSnapshotFile.isFile() ? publicPathSnapshotFile : null
+}
+
+tasks.register('verifyPublicPathSnapshot') {
+    group = 'verification'
+    description = 'Fails without mutation when the committed deny-by-default public path baseline drifts.'
+    inputs.file(existingPublicPathEnvironment).optional()
+    inputs.file(existingPublicPathSnapshot).optional()
+    inputs.property('updateApprovalRequested', publicPathUpdateApproved)
+
+    doLast {
+        if (publicPathUpdateApproved) {
+            throw new GradleException(
+                    'verifyPublicPathSnapshot is read-only; use updatePublicPathSnapshot ' +
+                            '-PapprovePublicPathChange for an intentional update.')
+        }
+        String canonical
+        try {
+            canonical = renderPublicPathSnapshot(publicPathEnvironmentFile)
+        } catch (GradleException exception) {
+            throw new GradleException(
+                    "verifyPublicPathSnapshot: ${exception.message}", exception)
+        }
+        if (!publicPathSnapshotFile.isFile()) {
+            throw new GradleException(
+                    "verifyPublicPathSnapshot: missing committed baseline ${publicPathSnapshotFile}")
+        }
+
+        String existing = publicPathSnapshotFile.getText('UTF-8')
+        if (existing != canonical) {
+            throw new GradleException(
+                    "verifyPublicPathSnapshot: the deny-by-default public path surface changed.\n" +
+                            "  expected (snapshot):\n${existing}\n" +
+                            "  actual (SECURITY_PUBLIC_PATHS):\n${canonical}\n" +
+                            'A protected endpoint may now be public. Review the change, then run:\n' +
+                            '  ./gradlew updatePublicPathSnapshot -PapprovePublicPathChange')
+        }
+        logger.lifecycle(
+                'verifyPublicPathSnapshot: OK — committed public paths are unchanged.')
+    }
+}
+
+tasks.register('updatePublicPathSnapshot') {
+    group = 'build setup'
+    description = 'Explicitly updates the committed public path baseline after security review.'
+    inputs.file(existingPublicPathEnvironment).optional()
+    inputs.property('approved', publicPathUpdateApproved)
+    outputs.file(publicPathSnapshotFile)
+    outputs.upToDateWhen { false }
+
+    doLast {
+        if (!publicPathUpdateApproved) {
+            throw new GradleException(
+                    'updatePublicPathSnapshot requires -PapprovePublicPathChange')
+        }
+        String canonical
+        try {
+            canonical = renderPublicPathSnapshot(publicPathEnvironmentFile)
+        } catch (GradleException exception) {
+            throw new GradleException(
+                    "updatePublicPathSnapshot: ${exception.message}", exception)
+        }
+        if (!publicPathSnapshotFile.parentFile.isDirectory()
+                && !publicPathSnapshotFile.parentFile.mkdirs()) {
+            throw new GradleException(
+                    "updatePublicPathSnapshot: failed to create ${publicPathSnapshotFile.parentFile}")
+        }
+        publicPathSnapshotFile.setText(canonical, 'UTF-8')
+        logger.lifecycle(
+                "updatePublicPathSnapshot: wrote reviewed baseline ${publicPathSnapshotFile}")
+    }
+}