fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00
parent 7d641edc7b
commit 0954876295
116 changed files with 10101 additions and 122 deletions
@@ -0,0 +1,133 @@
+{
+  "ticket": "B02",
+  "completedDate": "2026-09-08",
+  "baselineCommit": "7d641edc7bca866ccf06012897ba1d107c07e59f",
+  "environment": "Windows, existing .NET 9 SDK and UI dependencies, synthetic local SQLite/browser fixtures, external providers disabled",
+  "status": "complete locally; not deployed; existing R01a standalone TypeScript diagnostic remains",
+  "acceptance": "Original retained request rejected; direct object ownership and associations enforced; same-account controls and private state disposal pass",
+  "runs": [
+    {
+      "phase": "before application edits: original replay expected safe assertion failed",
+      "path": ".artifacts/b02/before.json",
+      "sha256": "BECFB841585A287BADF04E7446DC43FB785F066981E07636534E75F6EF9D2E30",
+      "total": 1,
+      "passed": 0,
+      "failed": 1,
+      "skipped": 0,
+      "observation": "HTTP 200; A unchanged; B overwritten with retained A draft"
+    },
+    {
+      "phase": "focused backend authorization/session/career/CV",
+      "path": ".artifacts/b02/focused.trx",
+      "sha256": "B43DF85097B6CE15B6DC7766162934E14F62132686EAA20B76F8EA014170A659",
+      "total": 91,
+      "passed": 91,
+      "failed": 0,
+      "skipped": 0
+    },
+    {
+      "phase": "broader backend including focused cases",
+      "path": ".artifacts/b02/backend.trx",
+      "sha256": "9539800BF98F5B6B2CA6E52FA37FCFB96845A77D6CDA166DFEB3948AA10AD07D",
+      "total": 853,
+      "passed": 853,
+      "failed": 0,
+      "skipped": 0,
+      "excluded": [
+        "JobTrackerApi.Tests.ImapServiceSsrfGuardTests.ConnectAsync_rejects_unresolvable_host_without_leaking_dns_detail"
+      ],
+      "exclusionReason": "Existing test performs real DNS; external access not authorized."
+    },
+    {
+      "phase": "focused frontend before final anonymous-BFCache control addition; superseded by full run",
+      "path": ".artifacts/b02/frontend-focused.json",
+      "sha256": "72CCCA872249B808C3C1BFAFCA64F5C4BCB1417FD6DA8643AB2DA241B045BE09",
+      "suites": 5,
+      "total": 51,
+      "passed": 51,
+      "failed": 0,
+      "skipped": 0
+    },
+    {
+      "phase": "final full frontend",
+      "path": ".artifacts/b02/frontend.json",
+      "sha256": "2D0B7B4A47BF5986FC80205D70FD0024B4CDA6483202A72D225A1034297D1F16",
+      "suites": 66,
+      "total": 294,
+      "passed": 294,
+      "failed": 0,
+      "skipped": 0
+    },
+    {
+      "phase": "full browser suite before final anonymous-BFCache refinement",
+      "path": ".artifacts/b02/browser.json",
+      "sha256": "FA78BF60624F42F9DA4A7F7C7DA53FBC4C984297946ED98116DD93BD0FFDB844",
+      "total": 17,
+      "passed": 17,
+      "failed": 0,
+      "skipped": 0,
+      "flaky": 0
+    },
+    {
+      "phase": "final B02 API/browser rerun after all application edits",
+      "path": ".artifacts/b02/browser-final.json",
+      "sha256": "A24785864DD906D04C4E6FF84A0ADE2F5D6F2A43B361C901635F41CEB81617B4",
+      "total": 4,
+      "passed": 4,
+      "failed": 0,
+      "skipped": 0,
+      "flaky": 0,
+      "observation": "HTTP 409; both A and B unchanged"
+    }
+  ],
+  "checks": [
+    {
+      "command": "dotnet build JobTrackerApi.Tests/JobTrackerApi.Tests.csproj --configuration Release --no-restore -warnaserror",
+      "path": ".artifacts/b02/backend-build.log",
+      "sha256": "3B4A8D824FDF9BC33C527A5B00FD3E045AE7C43F28FD79885CA78641DF222927",
+      "exitCode": 0,
+      "warnings": 0,
+      "errors": 0
+    },
+    {
+      "command": "node --max-old-space-size=4096 node_modules/next/dist/bin/next build",
+      "cwd": "job-tracker-ui",
+      "path": ".artifacts/b02/frontend-build.log",
+      "sha256": "DC7F4BC6EAAD13C897A69F58394867B3B5CBD49B881B60C2D0DF8F7A4612E592",
+      "exitCode": 0
+    },
+    {
+      "command": "node node_modules/typescript/bin/tsc --noEmit --pretty false",
+      "cwd": "job-tracker-ui",
+      "path": ".artifacts/b02/typecheck.log",
+      "sha256": "2F9960647ABADEFD054152A9566E4E6557A55383E98627AED742B93EDEBB16DD",
+      "exitCode": 2,
+      "diagnostic": "src/interview-prep.test.tsx(120,10): error TS2571: Object is of type 'unknown'.",
+      "classification": "Pre-existing audit R01a, unchanged, no new diagnostics"
+    },
+    {
+      "command": "node node_modules/eslint/bin/eslint.js src/api.ts src/sessionBoundary.ts src/session-boundary.test.ts src/App.tsx src/views/LoginPage.tsx src/i18n/translations.ts e2e/account-isolation.spec.ts e2e/smoke.spec.ts --max-warnings=0",
+      "cwd": "job-tracker-ui",
+      "path": ".artifacts/b02/lint.log",
+      "sha256": "33237F0AC9684ACA5331E14FA4337EFC24C4C03D39E589FD0FBCA54F627A9483",
+      "exitCode": 0,
+      "note": "Tool emitted stale Browserslist database advisory; no lint violations; no dependency update."
+    },
+    {
+      "command": "git diff --check",
+      "exitCode": 0
+    }
+  ],
+  "newRegressionCases": {
+    "backendMiddleware": 13,
+    "frontendBoundary": 15,
+    "realApiAndBrowserScenarios": 4
+  },
+  "commands": "Exact test commands and local offline fixture reproduction in ../b02-completion.md and b02-browser-config.ts.txt",
+  "rawOutputs": "Hashes identify local ignored .artifacts/b02 files; permanent tests, this manifest and compact observations are retained in repository.",
+  "originalEvidencePreserved": true,
+  "b01ApplicationCodePreserved": true,
+  "schemaMigration": false,
+  "deployed": false,
+  "nextTicket": "B03 — shared PDF admission; not started"
+}