fix(mail): search every owned job

Replace ineffective pageSize=100 selectors with a bounded owner-filtered search endpoint for composing and moving linked threads.
2026-08-15 20:13:14 +02:00
parent dc511296a4
commit a08ba9b45d
9 changed files with 167 additions and 57 deletions
@@ -74,6 +74,45 @@ public sealed class JobApplicationsAuthorizationTests
        Assert.IsType<NotFoundResult>(result.Result);
    }

+    [Fact]
+    public async Task Job_choices_searches_all_owned_rows_without_leaking_another_tenant()
+    {
+        var dbName = Guid.NewGuid().ToString();
+        await using (var ownerDb = CreateDb(dbName, "owner-1"))
+        {
+            var company = new Company { Name = "Owner company", OwnerUserId = "owner-1" };
+            ownerDb.Companies.Add(company);
+            for (var index = 0; index < 130; index++)
+            {
+                ownerDb.JobApplications.Add(new JobApplication
+                {
+                    JobTitle = index == 0 ? "Historic target role" : $"Recent role {index}",
+                    Company = company,
+                    OwnerUserId = "owner-1",
+                    SavedAt = DateTime.UtcNow.AddDays(index),
+                });
+            }
+            await ownerDb.SaveChangesAsync();
+        }
+        await using (var otherDb = CreateDb(dbName, "owner-2"))
+        {
+            var company = new Company { Name = "Other tenant", OwnerUserId = "owner-2" };
+            otherDb.JobApplications.Add(new JobApplication
+            {
+                JobTitle = "Historic target private", Company = company, OwnerUserId = "owner-2",
+            });
+            await otherDb.SaveChangesAsync();
+        }
+
+        await using var searchDb = CreateDb(dbName, "owner-1");
+        var result = await CreateController(searchDb).GetChoices("historic target", 20, default);
+        var choices = Assert.IsType<List<JobApplicationChoiceDto>>(Assert.IsType<OkObjectResult>(result.Result).Value);
+
+        var choice = Assert.Single(choices);
+        Assert.Equal("Historic target role", choice.JobTitle);
+        Assert.Equal("Owner company", choice.CompanyName);
+    }
+
    private static JobTrackerContext CreateDb(string dbName, string? userId)
    {
        var options = new DbContextOptionsBuilder<JobTrackerContext>()