fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Diagnostics;
+using Microsoft.AspNetCore.Mvc;
+
+namespace JobTrackerApi.Services;
+
+public sealed class PdfRenderExceptionHandler : IExceptionHandler
+{
+    public async ValueTask<bool> TryHandleAsync(HttpContext context, Exception exception, CancellationToken cancellationToken)
+    {
+        if (exception is not (PdfCapacityException or PdfRenderTimeoutException)) return false;
+        var busy = exception is PdfCapacityException;
+        var status = busy ? StatusCodes.Status503ServiceUnavailable : StatusCodes.Status504GatewayTimeout;
+        context.Response.StatusCode = status;
+        context.Response.Headers.CacheControl = "no-store";
+        if (busy) context.Response.Headers.RetryAfter = "3";
+        await context.Response.WriteAsJsonAsync(new ProblemDetails
+        {
+            Status = status,
+            Title = busy ? "PDF generation is busy" : "PDF generation timed out",
+            Detail = exception.Message,
+            Extensions = { ["code"] = busy ? "pdf_capacity_exceeded" : "pdf_render_timeout", ["traceId"] = context.TraceIdentifier }
+        }, cancellationToken);
+        return true;
+    }
+}