fix(rd21): guard career and job saves with durable revisions

2026-10-23 08:07:23 +02:00
parent 8f2cad67f7
commit 12f342c09c
32 changed files with 1185 additions and 277 deletions
@@ -564,28 +564,23 @@ public sealed class AuthAndSystemControllerTests
        Assert.Equal("{\"jobs\":[]}", user.ProfileCvStructureJson);
    }

-    [Fact]
-    public async Task Career_only_save_does_not_wipe_identity()
+    [Theory]
+    [InlineData("stale text", null)]
+    [InlineData(null, "{\"summary\":[\"stale\"]}")]
+    [InlineData("", "")]
+    public async Task Legacy_profile_endpoint_cannot_bypass_canonical_revision_guards(string? text, string? structured)
    {
-        // The mirror: /career saves the master profile and omits identity fields.
        var user = new ApplicationUser
        {
-            Email = "ada@example.com",
-            UserName = "ada",
-            FirstName = "Ada",
-            LastName = "Lovelace",
-            DisplayName = "Ada L.",
+            UserName = "ada", FirstName = "Ada", ProfileCvText = "Approved text", ProfileCvStructureJson = "Approved structure",
        };
        var controller = BuildProfileController(user);
-
-        var result = await controller.UpdateProfile(new AuthController.UpdateProfileRequest(null, null, null, null, null, "New CV text", "{\"jobs\":[1]}"));
-
-        Assert.IsType<NoContentResult>(result);
+        var result = await controller.UpdateProfile(new AuthController.UpdateProfileRequest(
+            null, null, "Stale identity", null, null, text, structured));
+        Assert.IsType<BadRequestObjectResult>(result);
        Assert.Equal("Ada", user.FirstName);
-        Assert.Equal("Lovelace", user.LastName);
-        Assert.Equal("Ada L.", user.DisplayName);
-        Assert.Equal("New CV text", user.ProfileCvText);
-        Assert.Equal("{\"jobs\":[1]}", user.ProfileCvStructureJson);
+        Assert.Equal("Approved text", user.ProfileCvText);
+        Assert.Equal("Approved structure", user.ProfileCvStructureJson);
    }

    [Fact]