fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -4,6 +4,15 @@ namespace JobTrackerApi.Services;

 public static class RateLimitPartitionKeys
 {
+    public static string Account(HttpContext context, string policy)
+    {
+        var owner = LocalAuthIdentity.GetRequiredUserId(context.User);
+        // Separate namespaces prevent an anonymous address colliding with an account ID.
+        return owner is null
+            ? $"{policy}:ip:{context.Connection.RemoteIpAddress?.ToString() ?? "unknown"}"
+            : $"{policy}:user:{owner}";
+    }
+
    public static string PublicPdf(HttpContext context)
    {
        var client = context.Connection.RemoteIpAddress?.ToString() ?? "unknown";