fix(security): harden public CV edges

2026-08-15 20:53:16 +02:00
parent 74a1e0d845
commit 8ef8b098c8
13 changed files with 54 additions and 6 deletions
@@ -0,0 +1,29 @@
+using System.Net;
+using JobTrackerApi.Services;
+using Microsoft.AspNetCore.Http;
+using Xunit;
+
+namespace JobTrackerApi.Tests;
+
+public sealed class RateLimitPartitionKeysTests
+{
+    [Fact]
+    public void Public_pdf_partition_isolated_by_client_and_slug()
+    {
+        var first = Context("203.0.113.10", "shared-slug");
+        var second = Context("203.0.113.11", "shared-slug");
+        var otherSlug = Context("203.0.113.10", "other-slug");
+
+        Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(second));
+        Assert.NotEqual(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(otherSlug));
+        Assert.Equal(RateLimitPartitionKeys.PublicPdf(first), RateLimitPartitionKeys.PublicPdf(Context("203.0.113.10", "shared-slug")));
+    }
+
+    private static DefaultHttpContext Context(string address, string slug)
+    {
+        var context = new DefaultHttpContext();
+        context.Connection.RemoteIpAddress = IPAddress.Parse(address);
+        context.Request.RouteValues["slug"] = slug;
+        return context;
+    }
+}