fix(security): preserve tenant scope through service lookup

[seonghobae]

Objective

Advance tenant-safe job reads after #361 by carrying authenticated tenant authority through the application-service lookup boundary. The service must not globally retrieve a job and filter ownership afterward when the repository exposes a storage-scoped tenant/id query.

Test-first state

This Draft starts intentionally RED at exact test-only head aff4f013f60ea400818693f30d51ff92c227f344. TenantScopedConversionServiceLookupTest requires the service-interface default to fail closed without invoking global getJob(UUID), and requires DefaultDocumentConversionService to delegate directly to ConversionJobRepository.findByTenantAndId(...) while rejecting absent tenant/job authority. Production does not expose getJob(UUID, TenantContext) at this head, so test compilation is expected to fail at that exact boundary.

Stack and scope

Base is #361 branch fix/tenant-id-query-boundary-after-342-20260811 exact head 977492622bc1f26d09c3f5ebbb76461407063f8f, itself stacked on #342. This child adds only the application-service scoped lookup contract/implementation and focused tests. It does not modify controllers, admin deletion, artifact delivery, OIDC/credential work, durable persistence, or canonical docs.

Acceptance

Observe exact-head RED -> smallest service contract/implementation -> exact-head Maven/coverage/Javadoc and emitted CI evidence. Keep Draft while #361/#342 remain open; after ancestors integrate, reconcile this unique delta onto the live protected base and regenerate base-sensitive checks/reviews. Independent write-authorized approval remains a separate protected-merge gate.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a106d53b-2481-47e9-8bbe-26b598ba4b5e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

@opencode-agent review

Perform an independent formal review of exact current head 2df4b52a40b727fa960217e1335b80d1efc77222 only. Focus on preserving tenant scope through service lookup, cross-tenant denial, and regression tests. Do not mutate or merge.