feat(email): confirm hub thread unlink

2026-08-10 09:40:59 +02:00
parent 73ee095795
commit 1dabbeb233
3 changed files with 88 additions and 1 deletions
@@ -853,6 +853,35 @@ public sealed class GmailControllerTests
        Assert.Equal("Need manual review", decision.Note);
    }

+    [Fact]
+    public async Task Unlink_thread_cannot_remove_another_users_messages()
+    {
+        await using var db = CreateDb();
+        var company = new Company { Name = "Other company", OwnerUserId = "user-2" };
+        db.Companies.Add(company);
+        await db.SaveChangesAsync();
+
+        var job = new JobApplication { JobTitle = "Private role", CompanyId = company.Id, OwnerUserId = "user-2" };
+        db.JobApplications.Add(job);
+        await db.SaveChangesAsync();
+        db.Correspondences.Add(new Correspondence
+        {
+            JobApplicationId = job.Id,
+            From = "Company",
+            Content = "Private message",
+            ExternalMessageId = "other-message",
+            ExternalThreadId = "other-thread"
+        });
+        await db.SaveChangesAsync();
+
+        var controller = CreateController(db, Mock.Of<IGmailOAuthService>(), "user-1");
+        var result = await controller.UnlinkThread(new UnlinkGmailThreadRequest(job.Id, "other-thread", null, "review"), CancellationToken.None);
+
+        Assert.IsType<NotFoundObjectResult>(result.Result);
+        Assert.Single(await db.Correspondences.IgnoreQueryFilters().ToListAsync());
+        Assert.Empty(await db.GmailReviewDecisions.IgnoreQueryFilters().ToListAsync());
+    }
+
    [Fact]
    public async Task Relink_thread_can_move_messages_from_other_jobs()
    {