test(security): reject Basic at the ETL service boundary

[seonghobae]

Scope

Fail-first security work for #161 from exact protected develop@942d164ceb7af497bb28a95f842db96429d1bdc4.

This Draft adds only EtlServiceAuthenticationModeTest. The test registers the real production SecurityConfig, installs a valid in-memory test principal, builds MockMvc with the actual Spring Security filter chain, and exercises a protected /api/** route. Unauthenticated access must remain rejected, and credentials valid only for the historical HTTP Basic mechanism must also be rejected by the acquisition-ready target boundary.

Protected SecurityConfig currently enables httpBasic(...), so the intended hosted result is RED because those Basic credentials authenticate and reach the protected test endpoint. A setup/context/controller/import/dependency failure does not count as RED.

Writer / implementation boundary

No production authentication mutation is included. The eventual GREEN still requires the independently authenticated ETL mechanism specified by #161, including the required dependency/POM work. Active PR #164 owns the ETL POM coverage boundary, so this branch does not race that writer or invent an issuer, JWK set, audience, credential, certificate authority, or compatibility secret.

Exact identity

• live base at branch and PR creation: 942d164ceb7af497bb28a95f842db96429d1bdc4;
• exact test-only head: 53920b125513ab3161bcd86f2afed3fc41d249a9;
• compare proof: one commit ahead, zero behind, merge base exactly 942d164ceb7af497bb28a95f842db96429d1bdc4;
• production files changed: none;
• Draft: true.

Acceptance boundary

Keep Draft until hosted execution proves the intended single security assertion failure on the current Basic filter chain. Synthetic merge evidence is development evidence only; it is not literal-source merge authority. Production GREEN requires the final runtime mechanism, machine-readable contract, SAST, complete security/dependency evidence, non-vacuous owned-production coverage, and qualifying independent review on an unchanged exact head.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 054656a9-02fd-400a-ba6b-d709447e10da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}