fix(api): restrict deprecated endpoint jobs-by-reference API to JOB resource

[Hedi (heditar)]

Proposed changes

• EndpointApi.java — changed @AccessControl on the deprecated GET /endpoints/jobs/{endpointExternalReference} from resourceType = ResourceType.ASSET to resourceType = ResourceType.JOB, so the required capability becomes AGENT_RUNTIME_ACCESS instead of ACCESS_ASSETS. The endpoint returns AssetAgentJob entries which can carry agent tokens; gating it on ASSET opened it to any asset-management user instead of just agents/service accounts.
• AgentRuntimeAccessControlTest.java — added a GetEndpointJobsByExternalReference nested test class covering: forbidden with only MANAGE_ASSETS, allowed with AGENT_RUNTIME_ACCESS (proves old agents can still call this deprecated API to complete their upgrade), and forbidden with no capability.

Testing Instructions

see with Hedi (@heditar)

Related issues

Checklist

• I consider the submitted work as finished
• I tested the code for its functionality
• I wrote test cases for the relevant uses case
• I added/update the relevant documentation (either on github or on notion)
• Where necessary I refactored code to improve the overall quality
• For bug fix -> I implemented a test that covers the bug

[github-actions]

📖 Documentation check — ✅ Passed

1 functional file(s), 0 doc file(s) changed.

No documentation gaps detected.

[Copilot]

🔵 Needs a closer look

One or more issues must be addressed before approval.

Pull request overview

This PR restricts the deprecated endpoint job retrieval API to the agent runtime capability instead of general asset access.

Changes:

• Changed the endpoint authorization resource from ASSET to JOB.
• Added regression tests for allowed and denied capability combinations.

File summaries

File	Description
openaev-api/src/test/java/io/openaev/service/account/AgentRuntimeAccessControlTest.java	Updated as part of this pull request.
openaev-api/src/main/java/io/openaev/rest/asset/endpoint/EndpointApi.java	Updated as part of this pull request.

Review details

Suppressed comments (1)

openaev-api/src/test/java/io/openaev/service/account/AgentRuntimeAccessControlTest.java:187

• issue (blocking): This regression test does not exercise the old authorization path: ResourceType.ASSET + READ resolves to ACCESS_ASSETS, but the mock user only has MANAGE_ASSETS, so the old code would already return 403 and this test would pass before the fix. Grant ACCESS_ASSETS (or both asset capabilities) and rename the test accordingly so it fails with the previous annotation.

    @DisplayName("should be forbidden with only MANAGE_ASSETS capability")
    @WithMockUser(withCapabilities = {Capability.MANAGE_ASSETS})
    void given_manageAssetsOnly_should_forbidJobsByExternalReference() throws Exception {

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.97%. Comparing base (db92bab) to head (1e2e106).
⚠️ Report is 5 commits behind head on main.

❌ Your project check has failed because the head coverage (11.57%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #8013      +/-   ##
============================================
- Coverage     47.12%   46.97%   -0.16%     
- Complexity    12509    13000     +491     
============================================
  Files          3053     3033      -20     
  Lines        101872   103431    +1559     
  Branches      16510    16751     +241     
============================================
+ Hits          48006    48582     +576     
- Misses        49984    51031    +1047     
+ Partials       3882     3818      -64     

Flag	Coverage Δ
backend	46.97% <ø> (-0.16%)	⬇️
e2e	46.97% <ø> (-0.16%)	⬇️
frontend	46.97% <ø> (-0.16%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.