ilpanich / axiam-java-sdk / 29515378130 / 1

91%

main: 91%

push

github

feat(spring): add @AxiamRequireAccess/@AxiamRequireAuth/@AxiamRequireRole with enforcement interceptor (CONTRACT §11) (#15)

* docs(contract): sync CONTRACT.md §11 declarative authorization helpers

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* feat(spring): add @AxiamRequireAccess/@AxiamRequireAuth/@AxiamRequireRole with enforcement interceptor (CONTRACT §11)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* docs: use en-dash in CONTRACT §1–§11 conformance statement

Match the exact wording in CONTRACT.md's Closing Notes (en-dash U+2013).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* fix(example): return JSON from document controller to avoid reflected XSS

CodeQL flagged the example GET /documents/{id} handler for reflected XSS
because it echoed the raw path variable into a plain-string response body.
Return a JSON Map instead (never interpreted as HTML) and canonicalize the
id via UUID.fromString before echoing it. The interceptor already 400s a
non-UUID id, so this only hardens the example. Existing IT assertions
(body contains the owner) still hold.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

---------

Co-authored-by: Claude <noreply@anthropic.com>

367 of 429 branches covered (85.55%)

Branch coverage included in aggregate %.

1000 of 1068 relevant lines covered (93.63%)

4.07 hits per line