fix(security): replace ETL Basic auth with fail-closed JWT mode

[seonghobae]

Purpose

Replace the directly reachable ETL service's historical HTTP Basic boundary with independently enforced OAuth 2.0 Resource Server JWT authentication. The repository default is credential-free deny: workload APIs remain unavailable until a deployment explicitly selects JWT mode and supplies issuer and audience authority.

Exact current identity

• protected/live base: develop@d6c6665163eabe1b5eca80556c6963bafd6b2625;
• branch: test/etl-service-auth-mode-106add;
• exact current head: 1e855bd9f5bf4fc946f7aa58623b67ccf0d0d0e0;
• current head is an auditable two-parent merge descending from both valid RED predecessor 761a7d06d7773aa3b62c0b1748c81c70983bb1e4 and exact protected develop;
• exact comparison to live develop: ahead, zero behind, merge base exactly live develop;
• current diff is the bounded seven-file dependency, security configuration, tests, and source-backed doctoring slice;
• Draft: true.

No history was rewritten. Checks, reviews, approvals, and synthetic merge evidence from #280 or predecessor heads do not transfer.

Hosted RED evidence

CI 31529757696 reached the real Spring Security filter chain on macOS, Ubuntu, and Windows. Normal production/test compilation succeeded and ETL ran 286 tests with exactly one failure and zero errors/skips: valid historical Basic credentials reached /api/security-contract, returning 200 where the acquisition-ready boundary required 401. Dependency Review, SBOM, SAST, and Security Scan were terminal-success on that RED head.

GREEN boundary

• adds Spring Boot's maintained OAuth 2.0 Resource Server dependency;
• removes HTTP Basic, form login, logout, stateful sessions, request cache, and implicit credential fallback;
• default deny mode permits only actuator health/info and returns 401 for /api/**;
• explicit jwt mode requires nonblank deployment-owned issuer and audience properties;
• valid bearer tokens authenticate through the real resource-server filter and use validated JWT sub as the principal name;
• missing, invalid, and historical Basic credentials fail closed;
• direct port-8000 and gateway-routed requests cross the same ETL-owned authentication boundary;
• no issuer, JWK endpoint, audience, token, client secret, certificate, or compatibility password is invented;
• source-backed rollout, rollback, failure, principal-migration, gateway handoff, privacy, and APA 7 standards evidence is recorded in docs/security/etl-service-jwt.md.

Machine-readable contract dependency

PR #278 truthfully documents the protected Basic mechanism and Semgrep correctly blocks it. Do not suppress or falsify that result. After this runtime boundary integrates, rebuild #278 on protected develop and replace the Basic OpenAPI scheme with bearer JWT semantics so runtime, contract, and SAST evidence move together.

Current verification state

Fresh exact-current-head CI, Dependency Review, CycloneDX SBOM, SAST Semgrep, and Security Scan were triggered by the GREEN head. Pending or predecessor-head results are not accepted as passing.

Keep Draft until the unchanged exact head has terminal-success applicable checks, non-vacuous applicable owned-production coverage, zero valid unresolved findings, and qualifying independent formal review where live governance requires it. After exact unique-work preservation is proven, stale predecessor #280 remains superseded.

Closes #161 only after protected integration.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 87d0c7db-7165-489f-a410-2b9d82c026cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}