[ANCHOR-1151] Protect event endpoints behind auth

[philipliu]

Description

This protects the /event and /events endpoint behind JWT auth. It also adds customer ID <-> account verification to the customer integration.

Context

These endpoints were previously unauthenticated, allowing attackers to post arbitrary events.

Testing

• ./gradlew test

Documentation

N/A

Known limitations

N/A

[Copilot]

Pull request overview

This PR enhances security by protecting event endpoints with authentication and adding customer ID-to-account verification in the customer integration service.

Changes:

• Wraps /event and test endpoints (/events, /events/latest) behind JWT authentication
• Adds validation to ensure customer IDs can only be accessed by the matching authenticated account
• Modifies account injection logic in Sep12Service to include account information even when customer ID is provided

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
kotlin-reference-server/src/main/kotlin/org/stellar/reference/event/EventRoute.kt	Wraps all event endpoints in authentication block and conditionally enables test endpoints based on configuration flag
kotlin-reference-server/src/main/kotlin/org/stellar/reference/di/ReferenceServerContainer.kt	Passes enableTestEndpoints flag (from config.appSettings.isTest) to event route initialization
kotlin-reference-server/src/main/kotlin/org/stellar/reference/callbacks/customer/CustomerService.kt	Adds assertCustomerMatchesRequest validation to prevent unauthorized access to customer data by ID
helm-charts/reference-server/values.yaml	Adds auth.type configuration option with default value NONE
helm-charts/reference-server/templates/configmap.yaml	Templates auth.type from values file instead of hardcoding
core/src/main/java/org/stellar/anchor/sep12/Sep12Service.java	Removes condition preventing account injection when customer ID is present, enabling security validation
core/src/test/kotlin/org/stellar/anchor/sep12/Sep12ServiceTest.kt	Adds tests verifying account injection for GET and PUT requests with customer ID

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.