test(server): cover the locked migration cases for per-job proxy JWTs

Issue #1165's acceptance criteria name four migration cases; the suite covered
missing scope and stale attempt but not the rest. Adds: a legacy opaque job
token is rejected at the proxy (no dual-accept window), a worker-session JWT
cannot authenticate against the proxy, a job JWT bound to another workspace is
rejected, an expired job JWT is rejected, a pre-migration token without the
explicit type header is rejected, and a worker-session token smuggling job
claims is rejected.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: FelixTJDietrich

server/application/src/test/java/de/tum/cit/aet/hephaestus/agent/proxy/LlmProxyIntegrationTest.java

@@ -95,6 +95,39 @@ void shouldAuthenticateRunningJobTokenAgainstPersistedRouting() throws Exception
                 .isInstanceOf(ProxyRouting.class);
     }
 
+    @Test
+    void shouldRejectLegacyOpaqueJobToken() throws Exception {
+        // The database-backed secret the entity still persists is a pre-migration credential; the
+        // proxy accepts only per-job JWTs — there is deliberately no dual-accept window.
+        AgentJob job = runningJob(true);
+
+        AuthenticationResult result = authenticate(job.getJobToken());
+
+        assertThat(result.status()).isEqualTo(401);
+        assertThat(result.authentication()).isNull();
+    }
+
+    @Test
+    void shouldRejectWorkerSessionJwtAtTheProxy() throws Exception {
+        runningJob(true);
+
+        AuthenticationResult result = authenticate(jwtIssuer.issue("worker-1").token());
+
+        assertThat(result.status()).isEqualTo(401);
+        assertThat(result.authentication()).isNull();
+    }
+
+    @Test
+    void shouldRejectJobJwtBoundToAnotherWorkspace() throws Exception {
+        AgentJob job = runningJob(true);
+
+        AuthenticationResult result = authenticate(
+                jwtIssuer.issueForJob(job.getId(), workspace.getId() + 1, job.getRetryCount(), Duration.ofMinutes(5)));
+
+        assertThat(result.status()).isEqualTo(401);
+        assertThat(result.authentication()).isNull();
+    }
+
     @Test
     void shouldFailClosedWhenCatalogModelIsDisabled() {
         AgentJob job = runningJob(false);

server/application/src/test/java/de/tum/cit/aet/hephaestus/core/runtime/hub/auth/WorkerJwtTest.java

@@ -15,6 +15,7 @@
 import java.time.Instant;
 import java.util.Base64;
 import java.util.List;
+import java.util.Map;
 import java.util.UUID;
 import java.util.stream.Stream;
 import org.assertj.core.api.Assertions;
@@ -68,6 +69,65 @@ void issuedJobTokenVerifiesWithRequiredClaims() {
         assertThat(jwt.jti()).isNotBlank();
     }
 
+    @Test
+    void expiredJobTokenRejected() {
+        WorkerSigningKey active = keyRing.active();
+        Instant past = Instant.now().minusSeconds(120);
+        String token = JWT.create()
+                .withHeader(Map.of("kid", active.kid(), "typ", "job+jwt"))
+                .withIssuer("hephaestus-test")
+                .withAudience("hephaestus-worker")
+                .withClaim("job_id", UUID.randomUUID().toString())
+                .withClaim("workspace_id", 42L)
+                .withClaim("attempt", 0)
+                .withClaim("scope", List.of("llm_proxy"))
+                .withJWTId(UUID.randomUUID().toString())
+                .withIssuedAt(past)
+                .withExpiresAt(past.plusSeconds(30))
+                .sign(Algorithm.RSA256(active.publicKey(), active.privateKey()));
+
+        assertThatThrownBy(() -> verifier.verify(token)).isInstanceOf(WorkerJwtInvalidException.class);
+    }
+
+    @Test
+    void legacyTokenWithoutExplicitTypeRejected() {
+        // Tokens minted before the claim-profile migration carry the library default "JWT" header
+        // type; the one-way cut rejects them even when the signature and claims would verify.
+        WorkerSigningKey active = keyRing.active();
+        String token = JWT.create()
+                .withKeyId(active.kid())
+                .withIssuer("hephaestus-test")
+                .withAudience("hephaestus-worker")
+                .withSubject("worker-1")
+                .withJWTId(UUID.randomUUID().toString())
+                .withIssuedAt(Instant.now())
+                .withExpiresAt(Instant.now().plusSeconds(60))
+                .sign(Algorithm.RSA256(active.publicKey(), active.privateKey()));
+
+        assertThatThrownBy(() -> verifier.verify(token))
+                .isInstanceOf(WorkerJwtInvalidException.class)
+                .hasMessageContaining("token type");
+    }
+
+    @Test
+    void workerSessionTokenCarryingJobClaimsRejected() {
+        WorkerSigningKey active = keyRing.active();
+        String token = JWT.create()
+                .withHeader(Map.of("kid", active.kid(), "typ", "worker-session+jwt"))
+                .withIssuer("hephaestus-test")
+                .withAudience("hephaestus-worker")
+                .withSubject("worker-1")
+                .withClaim("job_id", UUID.randomUUID().toString())
+                .withJWTId(UUID.randomUUID().toString())
+                .withIssuedAt(Instant.now())
+                .withExpiresAt(Instant.now().plusSeconds(60))
+                .sign(Algorithm.RSA256(active.publicKey(), active.privateKey()));
+
+        assertThatThrownBy(() -> verifier.verify(token))
+                .isInstanceOf(WorkerJwtInvalidException.class)
+                .hasMessageContaining("job claims");
+    }
+
     @Test
     void revokedTokenRejected() {
         WorkerJwtIssuer.IssuedWorkerJwt issued = issuer.issue("worker-1");