Fix cross-user job history leak

2026-04-11 17:05:52 +02:00
parent 41595605b9
commit 811963749e
4 changed files with 227 additions and 0 deletions
@@ -85,6 +85,9 @@ namespace JobTrackerApi.Data
            .HasForeignKey(a => a.JobApplicationId)
            .OnDelete(DeleteBehavior.Cascade);

+        modelBuilder.Entity<JobEvent>()
+            .HasQueryFilter(x => CurrentUserId != null && x.JobApplication.OwnerUserId == CurrentUserId);
+
        modelBuilder.Entity<JobEvent>()
            .HasOne(e => e.JobApplication)
            .WithMany(j => j.Events)