matevip 2e3dd071a5 fix(kb-open): assert session belongs to path kbId + cleanup ... - requireSessionOwnership now also checks session.kbId() == path kbId (404 on mismatch), so a research session started under one KB cannot be addressed via another KB path even when the caller's key is bound to both — defense-in-depth on top of the keyId ownership check. - Drop internal "R7" / "review #446" markers from the controller Javadoc in favour of functional wording. - Import Set/Map/concurrent types and static any() instead of inline FQNs in the new kb-open research/auth tests, per code style.		2026-07-02 17:52:25 +08:00
..
KbApiKeyAdminController.java	feat(kb-open): P0-A open-API auth — API keys, rate limit, centralized authorization	2026-06-28 14:45:53 +08:00
KbOpenApiController.java	feat(kb-open): P0-B 9 个开放 API 端点 (#445)	2026-06-30 09:36:55 +08:00
KbOpenResearchController.java	fix(kb-open): assert session belongs to path kbId + cleanup	2026-07-02 17:52:25 +08:00