feat(ap4): defend forwarded identity headers

backend/src/test/java/com/example/keycloakpattern/ApiSecurityTest.java

@@ -11,7 +11,7 @@ import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMock
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.web.servlet.MockMvc;
 
-@SpringBootTest
+@SpringBootTest(properties = "edge.internal-auth-token=test-internal-edge-token")
 @AutoConfigureMockMvc
 class ApiSecurityTest {
 
@@ -42,18 +42,34 @@ class ApiSecurityTest {
     }
 
     @Test
-    void edgeEndpointRejectsMissingIdentityHeader() throws Exception {
+    void edgeEndpointRejectsMissingTrustedHeaders() throws Exception {
         mockMvc.perform(get("/edge/me"))
             .andExpect(status().isUnauthorized());
     }
 
     @Test
-    void edgeEndpointCurrentlyTrustsForwardedUserHeader() throws Exception {
+    void edgeEndpointRejectsForgedIdentityWithoutInternalToken() throws Exception {
         mockMvc.perform(get("/edge/me")
-                .header("X-Forwarded-User", "regular-user")
-                .header("X-Forwarded-Email", "regular-user@example.test"))
+                .header("X-Auth-Request-User", "spoofed-admin"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointRejectsWrongInternalToken() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "spoofed-admin")
+                .header("X-Internal-Auth-Token", "wrong-token"))
+            .andExpect(status().isUnauthorized());
+    }
+
+    @Test
+    void edgeEndpointAcceptsIdentityFromTrustedEdge() throws Exception {
+        mockMvc.perform(get("/edge/me")
+                .header("X-Auth-Request-User", "regular-user")
+                .header("X-Auth-Request-Email", "regular-user@example.test")
+                .header("X-Internal-Auth-Token", "test-internal-edge-token"))
             .andExpect(status().isOk())
             .andExpect(jsonPath("$.user").value("regular-user"))
-            .andExpect(jsonPath("$.identityHeader").value("X-Forwarded-User"));
+            .andExpect(jsonPath("$.identityHeader").value("X-Auth-Request-User"));
     }
 }