fix(security): enforce audited account, network and resource boundaries

Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.

job-tracker-ui/src/api.ts

@@ -1,5 +1,6 @@
-import axios from "axios";
+import axios, { CanceledError, type InternalAxiosRequestConfig } from "axios";
 import { clearAuthClientState, getCsrfToken } from "./auth";
+import { bindSession, checkSessionCookie, getSessionContext, invalidateSession, isSessionInvalidated, sessionRequestSignal } from "./sessionBoundary";
 
 function looksLikeHtml(value: string) {
   return /<\s*html\b|<\s*body\b|<\s*head\b|<\s*title\b|<\s*!doctype\b/i.test(value);
@@ -48,7 +49,19 @@ export const api = axios.create({
   xsrfHeaderName: "X-CSRF-TOKEN",
 });
 
+const requestCookies = new WeakMap<InternalAxiosRequestConfig, string | null>();
+
 api.interceptors.request.use((config) => {
+  checkSessionCookie();
+  if (isSessionInvalidated()) throw new CanceledError("This page belongs to an earlier session. Reload it before continuing.");
+  const context = getSessionContext();
+  const retainedContext = config.headers.get("X-Session-Context");
+  if (retainedContext && retainedContext !== context) throw new CanceledError("The request belongs to an earlier session.");
+  if (context) config.headers.set("X-Session-Context", context);
+  requestCookies.set(config, getCsrfToken());
+  config.signal = config.signal instanceof AbortSignal
+    ? AbortSignal.any([config.signal, sessionRequestSignal()])
+    : sessionRequestSignal();
   const method = (config.method ?? "get").toUpperCase();
   if (["POST", "PUT", "PATCH", "DELETE"].includes(method)) {
     const csrfToken = getCsrfToken();
@@ -58,13 +71,35 @@ api.interceptors.request.use((config) => {
     }
   }
   return config;
-});
+}, (error) => { throw error; }, { synchronous: true });
 
 api.interceptors.response.use(
-  (r) => r,
+  (r) => {
+    checkSessionCookie();
+    if (isSessionInvalidated()) throw new CanceledError("Discarded a response from an earlier session.");
+    if ((r.config.method ?? "get").toLowerCase() === "get" && requestCookies.get(r.config) !== getCsrfToken()) {
+      throw new CanceledError("Discarded a read started before the session changed.");
+    }
+    if (r.config.url === "/auth/me") {
+      if (!bindSession(r.data?.id, r.data?.sessionContext)) {
+        invalidateSession();
+        throw new CanceledError("The session changed while loading this page.");
+      }
+    }
+    return r;
+  },
   (err) => {
+    checkSessionCookie();
+    if (isSessionInvalidated()) return Promise.reject(new CanceledError("Discarded an earlier session's response."));
+    if (err?.config && requestCookies.get(err.config) !== getCsrfToken()) {
+      return Promise.reject(new CanceledError("Discarded an earlier session's error."));
+    }
     const status = err?.response?.status;
+    if ([409, 428].includes(status) && ["session_context_required", "session_context_mismatch"].includes(err?.response?.data?.code)) {
+      invalidateSession();
+    }
     if (status === 401) {
+      if (getSessionContext()) invalidateSession();
       clearAuthClientState();
     }
     return Promise.reject(err);