feat: establish AIOA identity and organization baseline

2026-07-18 08:05:45 +08:00
commit bbb09ed56f
42 changed files with 2473 additions and 0 deletions
@@ -0,0 +1,11 @@
+package com.all8ai.aioa
+
+import org.springframework.boot.autoconfigure.SpringBootApplication
+import org.springframework.boot.runApplication
+
+@SpringBootApplication
+class AioaApplication
+
+fun main(args: Array<String>) {
+    runApplication<AioaApplication>(*args)
+}
@@ -0,0 +1,46 @@
+package com.all8ai.aioa.identity.api
+
+import com.all8ai.aioa.identity.application.CurrentUserService
+import org.springframework.security.core.annotation.AuthenticationPrincipal
+import org.springframework.security.oauth2.jwt.Jwt
+import org.springframework.web.bind.annotation.GetMapping
+import org.springframework.web.bind.annotation.RequestMapping
+import org.springframework.web.bind.annotation.RestController
+import java.util.UUID
+
+@RestController
+@RequestMapping("/api/v1/me")
+class CurrentUserController(
+    private val currentUserService: CurrentUserService,
+) {
+    @GetMapping
+    fun currentUser(@AuthenticationPrincipal jwt: Jwt): CurrentUserResponse {
+        val currentUser = currentUserService.get(jwt.subject, jwt.getClaimAsString("tenant_id"))
+        return CurrentUserResponse(
+            id = currentUser.id,
+            tenantId = currentUser.tenantId,
+            username = currentUser.username,
+            displayName = currentUser.displayName,
+            email = currentUser.email,
+            department = currentUser.department?.let { OrganizationRef(it.id, it.name) },
+            position = currentUser.position?.let { OrganizationRef(it.id, it.name) },
+            roles = currentUser.roles,
+        )
+    }
+}
+
+data class CurrentUserResponse(
+    val id: UUID,
+    val tenantId: UUID,
+    val username: String,
+    val displayName: String,
+    val email: String?,
+    val department: OrganizationRef?,
+    val position: OrganizationRef?,
+    val roles: Set<String>,
+)
+
+data class OrganizationRef(
+    val id: UUID,
+    val name: String,
+)
@@ -0,0 +1,27 @@
+package com.all8ai.aioa.identity.application
+
+import com.all8ai.aioa.identity.domain.CurrentUser
+import com.all8ai.aioa.identity.domain.CurrentUserRepository
+import com.all8ai.aioa.shared.web.ApiException
+import org.springframework.http.HttpStatus
+import org.springframework.stereotype.Service
+import java.util.UUID
+
+@Service
+class CurrentUserService(
+    private val repository: CurrentUserRepository,
+) {
+    fun get(subject: String, tenantClaim: String?): CurrentUser {
+        val tenantId = tenantClaim?.let(::parseTenantId)
+            ?: throw ApiException(HttpStatus.FORBIDDEN, "TENANT_CLAIM_MISSING", "登录身份缺少租户信息")
+
+        return repository.findActiveBySubject(tenantId, subject)
+            ?: throw ApiException(HttpStatus.FORBIDDEN, "USER_NOT_PROVISIONED", "当前用户尚未同步到 OA 系统")
+    }
+
+    private fun parseTenantId(value: String): UUID = try {
+        UUID.fromString(value)
+    } catch (_: IllegalArgumentException) {
+        throw ApiException(HttpStatus.FORBIDDEN, "TENANT_CLAIM_INVALID", "登录身份中的租户信息无效")
+    }
+}
@@ -0,0 +1,23 @@
+package com.all8ai.aioa.identity.domain
+
+import java.util.UUID
+
+data class CurrentUser(
+    val id: UUID,
+    val tenantId: UUID,
+    val username: String,
+    val displayName: String,
+    val email: String?,
+    val department: OrganizationRef?,
+    val position: OrganizationRef?,
+    val roles: Set<String>,
+)
+
+data class OrganizationRef(
+    val id: UUID,
+    val name: String,
+)
+
+fun interface CurrentUserRepository {
+    fun findActiveBySubject(tenantId: UUID, subject: String): CurrentUser?
+}
@@ -0,0 +1,77 @@
+package com.all8ai.aioa.identity.infrastructure
+
+import com.all8ai.aioa.identity.domain.CurrentUser
+import com.all8ai.aioa.identity.domain.CurrentUserRepository
+import com.all8ai.aioa.identity.domain.OrganizationRef
+import org.jooq.DSLContext
+import org.springframework.stereotype.Repository
+import java.util.UUID
+
+@Repository
+class JooqCurrentUserRepository(
+    private val dsl: DSLContext,
+) : CurrentUserRepository {
+    override fun findActiveBySubject(tenantId: UUID, subject: String): CurrentUser? {
+        val record = dsl.fetchOne(
+            """
+            SELECT
+                u.id,
+                u.tenant_id,
+                u.username,
+                u.display_name,
+                u.email,
+                d.id AS department_id,
+                d.name AS department_name,
+                p.id AS position_id,
+                p.name AS position_name
+            FROM identity.user_account u
+            LEFT JOIN organization.user_assignment a
+              ON a.tenant_id = u.tenant_id
+             AND a.user_id = u.id
+             AND a.is_primary = TRUE
+             AND a.effective_from <= CURRENT_TIMESTAMP
+             AND (a.effective_until IS NULL OR a.effective_until > CURRENT_TIMESTAMP)
+            LEFT JOIN organization.department d ON d.id = a.department_id
+            LEFT JOIN organization.position p ON p.id = a.position_id
+            WHERE u.tenant_id = ?
+              AND u.keycloak_subject = ?
+              AND u.status = 'ACTIVE'
+            """.trimIndent(),
+            tenantId,
+            subject,
+        ) ?: return null
+
+        val userId = record.get("id", UUID::class.java)!!
+        val roles = dsl.fetch(
+            """
+            SELECT r.code
+            FROM authz.user_role ur
+            JOIN authz.role r
+              ON r.tenant_id = ur.tenant_id
+             AND r.id = ur.role_id
+            WHERE ur.tenant_id = ?
+              AND ur.user_id = ?
+              AND ur.effective_from <= CURRENT_TIMESTAMP
+              AND (ur.effective_until IS NULL OR ur.effective_until > CURRENT_TIMESTAMP)
+              AND r.status = 'ACTIVE'
+            ORDER BY r.code
+            """.trimIndent(),
+            tenantId,
+            userId,
+        ).mapNotNull { it.get("code", String::class.java) }.toSortedSet()
+
+        return CurrentUser(
+            id = userId,
+            tenantId = record.get("tenant_id", UUID::class.java)!!,
+            username = record.get("username", String::class.java)!!,
+            displayName = record.get("display_name", String::class.java)!!,
+            email = record.get("email", String::class.java),
+            department = ref(record.get("department_id", UUID::class.java), record.get("department_name", String::class.java)),
+            position = ref(record.get("position_id", UUID::class.java), record.get("position_name", String::class.java)),
+            roles = roles,
+        )
+    }
+
+    private fun ref(id: UUID?, name: String?): OrganizationRef? =
+        if (id != null && name != null) OrganizationRef(id, name) else null
+}
@@ -0,0 +1,20 @@
+package com.all8ai.aioa.shared.security
+
+import org.springframework.context.annotation.Bean
+import org.springframework.context.annotation.Configuration
+import org.springframework.security.config.Customizer.withDefaults
+import org.springframework.security.config.annotation.web.builders.HttpSecurity
+import org.springframework.security.web.SecurityFilterChain
+
+@Configuration
+class SecurityConfiguration {
+    @Bean
+    fun securityFilterChain(http: HttpSecurity): SecurityFilterChain = http
+        .csrf { it.disable() }
+        .authorizeHttpRequests {
+            it.requestMatchers("/actuator/health", "/actuator/info").permitAll()
+                .anyRequest().authenticated()
+        }
+        .oauth2ResourceServer { it.jwt(withDefaults()) }
+        .build()
+}
@@ -0,0 +1,9 @@
+package com.all8ai.aioa.shared.web
+
+import org.springframework.http.HttpStatus
+
+class ApiException(
+    val status: HttpStatus,
+    val code: String,
+    override val message: String,
+) : RuntimeException(message)
@@ -0,0 +1,48 @@
+package com.all8ai.aioa.shared.web
+
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.validation.ConstraintViolationException
+import org.slf4j.LoggerFactory
+import org.slf4j.MDC
+import org.springframework.http.HttpStatus
+import org.springframework.http.ProblemDetail
+import org.springframework.http.ResponseEntity
+import org.springframework.web.bind.MethodArgumentNotValidException
+import org.springframework.web.bind.annotation.ExceptionHandler
+import org.springframework.web.bind.annotation.RestControllerAdvice
+import java.net.URI
+
+@RestControllerAdvice
+class GlobalExceptionHandler {
+    private val logger = LoggerFactory.getLogger(javaClass)
+
+    @ExceptionHandler(ApiException::class)
+    fun handleApiException(exception: ApiException, request: HttpServletRequest): ResponseEntity<ProblemDetail> =
+        response(exception.status, exception.code, exception.message, request)
+
+    @ExceptionHandler(MethodArgumentNotValidException::class, ConstraintViolationException::class)
+    fun handleValidation(exception: Exception, request: HttpServletRequest): ResponseEntity<ProblemDetail> =
+        response(HttpStatus.BAD_REQUEST, "REQUEST_INVALID", exception.message ?: "请求参数无效", request)
+
+    @ExceptionHandler(Exception::class)
+    fun handleUnexpected(exception: Exception, request: HttpServletRequest): ResponseEntity<ProblemDetail> {
+        logger.error("Unhandled request error", exception)
+        return response(HttpStatus.INTERNAL_SERVER_ERROR, "INTERNAL_ERROR", "服务器处理请求失败", request)
+    }
+
+    private fun response(
+        status: HttpStatus,
+        code: String,
+        detail: String,
+        request: HttpServletRequest,
+    ): ResponseEntity<ProblemDetail> {
+        val problem = ProblemDetail.forStatusAndDetail(status, detail).apply {
+            type = URI.create("https://aioa.all8ai.com/problems/${code.lowercase().replace('_', '-')}")
+            title = status.reasonPhrase
+            instance = URI.create(request.requestURI)
+            setProperty("code", code)
+            setProperty("traceId", MDC.get(TraceIdFilter.MDC_TRACE_ID) ?: "unknown")
+        }
+        return ResponseEntity.status(status).body(problem)
+    }
+}
@@ -0,0 +1,39 @@
+package com.all8ai.aioa.shared.web
+
+import jakarta.servlet.FilterChain
+import jakarta.servlet.http.HttpServletRequest
+import jakarta.servlet.http.HttpServletResponse
+import org.slf4j.MDC
+import org.springframework.core.Ordered
+import org.springframework.core.annotation.Order
+import org.springframework.stereotype.Component
+import org.springframework.web.filter.OncePerRequestFilter
+import java.util.UUID
+
+@Component
+@Order(Ordered.HIGHEST_PRECEDENCE)
+class TraceIdFilter : OncePerRequestFilter() {
+    override fun doFilterInternal(
+        request: HttpServletRequest,
+        response: HttpServletResponse,
+        filterChain: FilterChain,
+    ) {
+        val traceId = request.getHeader(TRACE_ID_HEADER)
+            ?.takeIf { TRACE_ID_PATTERN.matches(it) }
+            ?: UUID.randomUUID().toString()
+
+        MDC.put(MDC_TRACE_ID, traceId)
+        response.setHeader(TRACE_ID_HEADER, traceId)
+        try {
+            filterChain.doFilter(request, response)
+        } finally {
+            MDC.remove(MDC_TRACE_ID)
+        }
+    }
+
+    companion object {
+        const val TRACE_ID_HEADER = "X-Trace-Id"
+        const val MDC_TRACE_ID = "traceId"
+        private val TRACE_ID_PATTERN = Regex("[A-Za-z0-9._:-]{8,128}")
+    }
+}
@@ -0,0 +1,40 @@
+spring:
+  application:
+    name: aioa-backend
+  datasource:
+    url: ${DB_URL:jdbc:postgresql://127.0.0.1:15432/aioa}
+    username: ${DB_USER:aioa}
+    password: ${DB_PASSWORD:change-me}
+    hikari:
+      maximum-pool-size: ${DB_POOL_SIZE:10}
+      minimum-idle: 1
+  flyway:
+    enabled: true
+    locations: classpath:db/migration
+  jooq:
+    sql-dialect: postgres
+  security:
+    oauth2:
+      resourceserver:
+        jwt:
+          issuer-uri: ${OIDC_ISSUER_URI:http://localhost:8081/realms/aioa}
+
+server:
+  port: ${SERVER_PORT:8080}
+  shutdown: graceful
+  error:
+    include-message: never
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info,prometheus
+  endpoint:
+    health:
+      probes:
+        enabled: true
+
+logging:
+  pattern:
+    correlation: "[traceId=%X{traceId:-}] "
@@ -0,0 +1,30 @@
+CREATE SCHEMA IF NOT EXISTS identity;
+CREATE SCHEMA IF NOT EXISTS organization;
+CREATE SCHEMA IF NOT EXISTS authz;
+CREATE SCHEMA IF NOT EXISTS workflow;
+CREATE SCHEMA IF NOT EXISTS form;
+CREATE SCHEMA IF NOT EXISTS business;
+CREATE SCHEMA IF NOT EXISTS knowledge;
+CREATE SCHEMA IF NOT EXISTS integration;
+CREATE SCHEMA IF NOT EXISTS audit;
+CREATE SCHEMA IF NOT EXISTS flowable;
+
+CREATE TABLE audit.event (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL,
+    actor_id UUID NOT NULL,
+    action VARCHAR(120) NOT NULL,
+    resource_type VARCHAR(120) NOT NULL,
+    resource_id VARCHAR(200),
+    trace_id VARCHAR(128) NOT NULL,
+    idempotency_key VARCHAR(128),
+    result VARCHAR(32) NOT NULL,
+    occurred_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    details JSONB NOT NULL DEFAULT '{}'::jsonb
+);
+
+CREATE INDEX idx_audit_event_tenant_time
+    ON audit.event (tenant_id, occurred_at DESC);
+
+CREATE INDEX idx_audit_event_trace
+    ON audit.event (trace_id);
@@ -0,0 +1,103 @@
+CREATE TABLE identity.tenant (
+    id UUID PRIMARY KEY,
+    code VARCHAR(64) NOT NULL UNIQUE,
+    name VARCHAR(200) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version BIGINT NOT NULL DEFAULT 0
+);
+
+CREATE TABLE organization.department (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    parent_id UUID REFERENCES organization.department(id),
+    code VARCHAR(64) NOT NULL,
+    name VARCHAR(200) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version BIGINT NOT NULL DEFAULT 0,
+    UNIQUE (tenant_id, code),
+    UNIQUE (tenant_id, id)
+);
+
+CREATE TABLE organization.position (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    code VARCHAR(64) NOT NULL,
+    name VARCHAR(200) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version BIGINT NOT NULL DEFAULT 0,
+    UNIQUE (tenant_id, code),
+    UNIQUE (tenant_id, id)
+);
+
+CREATE TABLE identity.user_account (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    keycloak_subject VARCHAR(100) NOT NULL,
+    username VARCHAR(100) NOT NULL,
+    display_name VARCHAR(200) NOT NULL,
+    email VARCHAR(320),
+    status VARCHAR(32) NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    version BIGINT NOT NULL DEFAULT 0,
+    UNIQUE (tenant_id, keycloak_subject),
+    UNIQUE (tenant_id, username),
+    UNIQUE (tenant_id, id)
+);
+
+CREATE TABLE organization.user_assignment (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    user_id UUID NOT NULL,
+    department_id UUID NOT NULL,
+    position_id UUID,
+    is_primary BOOLEAN NOT NULL DEFAULT FALSE,
+    effective_from TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    effective_until TIMESTAMPTZ,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    CONSTRAINT fk_assignment_user FOREIGN KEY (tenant_id, user_id)
+        REFERENCES identity.user_account(tenant_id, id),
+    CONSTRAINT fk_assignment_department FOREIGN KEY (tenant_id, department_id)
+        REFERENCES organization.department(tenant_id, id),
+    CONSTRAINT fk_assignment_position FOREIGN KEY (tenant_id, position_id)
+        REFERENCES organization.position(tenant_id, id)
+);
+
+CREATE UNIQUE INDEX uq_user_primary_assignment
+    ON organization.user_assignment (tenant_id, user_id)
+    WHERE is_primary = TRUE AND effective_until IS NULL;
+
+CREATE TABLE authz.role (
+    id UUID PRIMARY KEY,
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    code VARCHAR(100) NOT NULL,
+    name VARCHAR(200) NOT NULL,
+    status VARCHAR(32) NOT NULL,
+    UNIQUE (tenant_id, code),
+    UNIQUE (tenant_id, id)
+);
+
+CREATE TABLE authz.user_role (
+    tenant_id UUID NOT NULL REFERENCES identity.tenant(id),
+    user_id UUID NOT NULL,
+    role_id UUID NOT NULL,
+    effective_from TIMESTAMPTZ NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    effective_until TIMESTAMPTZ,
+    PRIMARY KEY (tenant_id, user_id, role_id),
+    CONSTRAINT fk_user_role_user FOREIGN KEY (tenant_id, user_id)
+        REFERENCES identity.user_account(tenant_id, id),
+    CONSTRAINT fk_user_role_role FOREIGN KEY (tenant_id, role_id)
+        REFERENCES authz.role(tenant_id, id)
+);
+
+CREATE INDEX idx_user_account_subject
+    ON identity.user_account (tenant_id, keycloak_subject);
+
+CREATE INDEX idx_assignment_department
+    ON organization.user_assignment (tenant_id, department_id);
@@ -0,0 +1,37 @@
+INSERT INTO identity.tenant (id, code, name, status)
+VALUES ('00000000-0000-7000-8000-000000000001', 'demo', 'AIOA 演示组织', 'ACTIVE');
+
+INSERT INTO organization.department (id, tenant_id, code, name, status)
+VALUES ('20000000-0000-7000-8000-000000000001', '00000000-0000-7000-8000-000000000001', 'product', '产品研发部', 'ACTIVE');
+
+INSERT INTO organization.position (id, tenant_id, code, name, status)
+VALUES
+    ('30000000-0000-7000-8000-000000000001', '00000000-0000-7000-8000-000000000001', 'employee', '员工', 'ACTIVE'),
+    ('30000000-0000-7000-8000-000000000002', '00000000-0000-7000-8000-000000000001', 'manager', '部门主管', 'ACTIVE'),
+    ('30000000-0000-7000-8000-000000000003', '00000000-0000-7000-8000-000000000001', 'oa-admin', 'OA 管理员', 'ACTIVE');
+
+INSERT INTO identity.user_account (id, tenant_id, keycloak_subject, username, display_name, email, status)
+VALUES
+    ('40000000-0000-7000-8000-000000000001', '00000000-0000-7000-8000-000000000001', '10000000-0000-7000-8000-000000000001', 'employee', '员工小明', 'employee@example.local', 'ACTIVE'),
+    ('40000000-0000-7000-8000-000000000002', '00000000-0000-7000-8000-000000000001', '10000000-0000-7000-8000-000000000002', 'manager', '王主管', 'manager@example.local', 'ACTIVE'),
+    ('40000000-0000-7000-8000-000000000003', '00000000-0000-7000-8000-000000000001', '10000000-0000-7000-8000-000000000003', 'admin', 'OA 管理员', 'admin@example.local', 'ACTIVE');
+
+INSERT INTO organization.user_assignment (id, tenant_id, user_id, department_id, position_id, is_primary)
+VALUES
+    ('50000000-0000-7000-8000-000000000001', '00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000001', '20000000-0000-7000-8000-000000000001', '30000000-0000-7000-8000-000000000001', TRUE),
+    ('50000000-0000-7000-8000-000000000002', '00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000002', '20000000-0000-7000-8000-000000000001', '30000000-0000-7000-8000-000000000002', TRUE),
+    ('50000000-0000-7000-8000-000000000003', '00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000003', '20000000-0000-7000-8000-000000000001', '30000000-0000-7000-8000-000000000003', TRUE);
+
+INSERT INTO authz.role (id, tenant_id, code, name, status)
+VALUES
+    ('60000000-0000-7000-8000-000000000001', '00000000-0000-7000-8000-000000000001', 'employee', '普通员工', 'ACTIVE'),
+    ('60000000-0000-7000-8000-000000000002', '00000000-0000-7000-8000-000000000001', 'department_manager', '部门主管', 'ACTIVE'),
+    ('60000000-0000-7000-8000-000000000003', '00000000-0000-7000-8000-000000000001', 'oa_admin', 'OA 管理员', 'ACTIVE');
+
+INSERT INTO authz.user_role (tenant_id, user_id, role_id)
+VALUES
+    ('00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000001', '60000000-0000-7000-8000-000000000001'),
+    ('00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000002', '60000000-0000-7000-8000-000000000001'),
+    ('00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000002', '60000000-0000-7000-8000-000000000002'),
+    ('00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000003', '60000000-0000-7000-8000-000000000001'),
+    ('00000000-0000-7000-8000-000000000001', '40000000-0000-7000-8000-000000000003', '60000000-0000-7000-8000-000000000003');
@@ -0,0 +1,55 @@
+package com.all8ai.aioa.identity.application
+
+import com.all8ai.aioa.identity.domain.CurrentUser
+import com.all8ai.aioa.identity.domain.CurrentUserRepository
+import com.all8ai.aioa.shared.web.ApiException
+import org.assertj.core.api.Assertions.assertThat
+import org.assertj.core.api.Assertions.assertThatThrownBy
+import org.junit.jupiter.api.Test
+import org.springframework.http.HttpStatus
+import java.util.UUID
+
+class CurrentUserServiceTest {
+    private val tenantId = UUID.fromString("00000000-0000-7000-8000-000000000001")
+
+    @Test
+    fun `loads provisioned user within claimed tenant`() {
+        val expected = CurrentUser(
+            id = UUID.randomUUID(),
+            tenantId = tenantId,
+            username = "employee",
+            displayName = "员工小明",
+            email = null,
+            department = null,
+            position = null,
+            roles = setOf("employee"),
+        )
+        val service = CurrentUserService(CurrentUserRepository { actualTenant, subject ->
+            expected.takeIf { actualTenant == tenantId && subject == "subject-1" }
+        })
+
+        assertThat(service.get("subject-1", tenantId.toString())).isEqualTo(expected)
+    }
+
+    @Test
+    fun `rejects missing tenant claim`() {
+        val service = CurrentUserService(CurrentUserRepository { _, _ -> null })
+
+        assertThatThrownBy { service.get("subject-1", null) }
+            .isInstanceOfSatisfying(ApiException::class.java) {
+                assertThat(it.status).isEqualTo(HttpStatus.FORBIDDEN)
+                assertThat(it.code).isEqualTo("TENANT_CLAIM_MISSING")
+            }
+    }
+
+    @Test
+    fun `rejects user not provisioned in claimed tenant`() {
+        val service = CurrentUserService(CurrentUserRepository { _, _ -> null })
+
+        assertThatThrownBy { service.get("unknown", tenantId.toString()) }
+            .isInstanceOfSatisfying(ApiException::class.java) {
+                assertThat(it.status).isEqualTo(HttpStatus.FORBIDDEN)
+                assertThat(it.code).isEqualTo("USER_NOT_PROVISIONED")
+            }
+    }
+}
@@ -0,0 +1,36 @@
+package com.all8ai.aioa.shared.web
+
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import org.springframework.mock.web.MockFilterChain
+import org.springframework.mock.web.MockHttpServletRequest
+import org.springframework.mock.web.MockHttpServletResponse
+
+class TraceIdFilterTest {
+    private val filter = TraceIdFilter()
+
+    @Test
+    fun `preserves a valid client trace id`() {
+        val request = MockHttpServletRequest().apply {
+            addHeader(TraceIdFilter.TRACE_ID_HEADER, "client-trace-123")
+        }
+        val response = MockHttpServletResponse()
+
+        filter.doFilter(request, response, MockFilterChain())
+
+        assertThat(response.getHeader(TraceIdFilter.TRACE_ID_HEADER)).isEqualTo("client-trace-123")
+    }
+
+    @Test
+    fun `replaces an invalid client trace id`() {
+        val request = MockHttpServletRequest().apply {
+            addHeader(TraceIdFilter.TRACE_ID_HEADER, "bad value")
+        }
+        val response = MockHttpServletResponse()
+
+        filter.doFilter(request, response, MockFilterChain())
+
+        assertThat(response.getHeader(TraceIdFilter.TRACE_ID_HEADER))
+            .matches("[0-9a-f-]{36}")
+    }
+}