test(email): protect free send access

JobTrackerApi.Tests/EmailSendControllerTests.cs

@@ -4,6 +4,7 @@ using JobTrackerApi.Data;
 using JobTrackerApi.Models;
 using JobTrackerApi.Services;
 using JobTrackerApi.Services.EmailProviders;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Data.Sqlite;
@@ -16,6 +17,23 @@ namespace JobTrackerApi.Tests;
 
 public sealed class EmailSendControllerTests
 {
+    [Fact]
+    public void Basic_email_send_requires_local_authentication_but_not_pro_entitlement()
+    {
+        var controllerAuthorization = typeof(EmailController).GetCustomAttributes(typeof(AuthorizeAttribute), inherit: true)
+            .Cast<AuthorizeAttribute>()
+            .ToList();
+        var sendAuthorization = typeof(EmailController).GetMethod(nameof(EmailController.Send))!
+            .GetCustomAttributes(typeof(AuthorizeAttribute), inherit: true)
+            .Cast<AuthorizeAttribute>()
+            .ToList();
+
+        var authorization = Assert.Single(controllerAuthorization);
+        Assert.Equal("local", authorization.AuthenticationSchemes);
+        Assert.True(string.IsNullOrWhiteSpace(authorization.Policy));
+        Assert.Empty(sendAuthorization);
+    }
+
     [Fact]
     public async Task Confirmed_send_is_recorded_once_and_duplicate_returns_existing_result()
     {