From 8f174cb767e71287c645c7f2c12ad38011083d2d Mon Sep 17 00:00:00 2001
From: cesnimda <connor.babbington@cesnimda.co.uk>
Date: Thu, 2 Jul 2026 22:00:27 +0200
Subject: [PATCH] feat: dev-only OpenAPI document at /openapi/v1.json

- AddOpenApi/MapOpenApi (anonymous, Development environment only).
- security: mark ProfileCvController.ProcessQueuedRunAsync [NonAction] -
  the controller-level [Route] exposed this background-service hook as a
  routable any-verb endpoint, which also broke OpenAPI generation.

96 endpoint paths documented.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 JobTrackerApi/Controllers/ProfileCvController.cs | 4 ++++
 JobTrackerApi/JobTrackerApi.csproj               | 1 +
 JobTrackerApi/Program.cs                         | 7 +++++++
 3 files changed, 12 insertions(+)

diff --git a/JobTrackerApi/Controllers/ProfileCvController.cs b/JobTrackerApi/Controllers/ProfileCvController.cs
index 65d50ba..a599d69 100644
--- a/JobTrackerApi/Controllers/ProfileCvController.cs
+++ b/JobTrackerApi/Controllers/ProfileCvController.cs
@@ -883,6 +883,10 @@ public sealed class ProfileCvController : ControllerBase
         return run;
     }
 
+    // Invoked by CvProcessingHostedService (this controller is also registered as a
+    // transient service). NonAction keeps it off the HTTP surface: without it the
+    // controller-level [Route] exposes it as an any-verb endpoint.
+    [NonAction]
     public async Task ProcessQueuedRunAsync(int runId, CancellationToken cancellationToken)
     {
         var run = await _db.CvExtractionRuns.FirstOrDefaultAsync(x => x.Id == runId, cancellationToken);
diff --git a/JobTrackerApi/JobTrackerApi.csproj b/JobTrackerApi/JobTrackerApi.csproj
index 5cd7b4c..feaf612 100644
--- a/JobTrackerApi/JobTrackerApi.csproj
+++ b/JobTrackerApi/JobTrackerApi.csproj
@@ -11,6 +11,7 @@
     <Compile Remove="Controllers\**\*.cs" />
     <Compile Remove="Services\**\*.cs" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="9.0.14" />
+    <PackageReference Include="Microsoft.AspNetCore.OpenApi" Version="9.0.14" />
     <PackageReference Include="Pomelo.EntityFrameworkCore.MySql" Version="9.0.0" />
   </ItemGroup>
 
diff --git a/JobTrackerApi/Program.cs b/JobTrackerApi/Program.cs
index 6a36ce0..13400eb 100644
--- a/JobTrackerApi/Program.cs
+++ b/JobTrackerApi/Program.cs
@@ -112,6 +112,7 @@ builder.Services.AddCors(options =>
 
 // Add controllers
 builder.Services.AddControllers();
+builder.Services.AddOpenApi();
 var dataRoot = (builder.Configuration["Data:Root"] ?? "").Trim();
 if (string.IsNullOrWhiteSpace(dataRoot))
 {
@@ -441,4 +442,10 @@ app.UseAuthentication();
 app.UseAuthorization();
 app.MapControllers();
 
+// API schema for tooling/docs. Dev-only: not exposed in production deployments.
+if (app.Environment.IsDevelopment())
+{
+    app.MapOpenApi().AllowAnonymous();
+}
+
 app.Run();