feat(email): add safe message detail

JobTrackerApi.Tests/CorrespondenceControllerTests.cs

@@ -1,9 +1,11 @@
 using JobTrackerApi.Controllers;
 using JobTrackerApi.Data;
 using JobTrackerApi.Models;
+using JobTrackerApi.Services;
 using JobTrackerApi.Tests.TestSupport;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
+using Moq;
 using Xunit;
 
 namespace JobTrackerApi.Tests;
@@ -32,4 +34,55 @@ public sealed class CorrespondenceControllerTests
         var stored = await db.Correspondences.SingleAsync();
         Assert.Equal("manual", stored.Provider);
     }
+
+    [Fact]
+    public async Task Message_detail_is_owner_scoped_and_tolerates_bad_metadata()
+    {
+        var databaseName = Guid.NewGuid().ToString();
+        var options = new DbContextOptionsBuilder<JobTrackerContext>().UseInMemoryDatabase(databaseName).Options;
+        var owner = new Mock<ICurrentUserService>();
+        owner.SetupGet(service => service.UserId).Returns("user-1");
+
+        int messageId;
+        await using (var ownerDb = new JobTrackerContext(options, owner.Object))
+        {
+            var company = new Company { Name = "Acme", OwnerUserId = "user-1" };
+            ownerDb.Companies.Add(company);
+            await ownerDb.SaveChangesAsync();
+            var job = new JobApplication { JobTitle = "Backend Developer", CompanyId = company.Id, OwnerUserId = "user-1" };
+            ownerDb.JobApplications.Add(job);
+            await ownerDb.SaveChangesAsync();
+            var message = new Correspondence
+            {
+                JobApplicationId = job.Id,
+                From = "Company",
+                Subject = "Interview",
+                Content = "Safe saved copy",
+                ExternalLabelsJson = "not-json",
+                AttachmentMetadataJson = "also-not-json"
+            };
+            ownerDb.Correspondences.Add(message);
+            await ownerDb.SaveChangesAsync();
+            messageId = message.Id;
+
+            var ownerResult = await new CorrespondenceController(ownerDb).GetMessage(messageId, CancellationToken.None);
+            var ok = Assert.IsType<OkObjectResult>(ownerResult.Result);
+            var detail = Assert.IsType<EmailMessageDetailDto>(ok.Value);
+            Assert.Equal("Safe saved copy", detail.BodyText);
+            Assert.Empty(detail.Labels);
+            Assert.Empty(detail.Attachments);
+
+            var inboxResult = await new CorrespondenceController(ownerDb).GetInbox(null, null, null, CancellationToken.None);
+            var inbox = Assert.IsType<OkObjectResult>(inboxResult.Result);
+            var item = Assert.Single(Assert.IsType<List<CorrespondenceController.CorrespondenceInboxItemDto>>(inbox.Value));
+            Assert.Equal(0, item.LabelCount);
+            Assert.Equal(0, item.AttachmentCount);
+        }
+
+        var other = new Mock<ICurrentUserService>();
+        other.SetupGet(service => service.UserId).Returns("user-2");
+        await using var otherDb = new JobTrackerContext(options, other.Object);
+        var otherResult = await new CorrespondenceController(otherDb).GetMessage(messageId, CancellationToken.None);
+        Assert.IsType<NotFoundResult>(otherResult.Result);
+    }
 }

JobTrackerApi.Tests/EmailControllerTests.cs

@@ -59,7 +59,7 @@ public sealed class EmailControllerTests
         var result = await controller.GetMessage("gmail", "message-1", CancellationToken.None);
 
         var ok = Assert.IsType<OkObjectResult>(result.Result);
-        var detail = Assert.IsType<EmailController.MessageDetail>(ok.Value);
+        var detail = Assert.IsType<EmailMessageDetailDto>(ok.Value);
         Assert.Equal("Safe plain text", detail.BodyText);
         Assert.DoesNotContain("script", System.Text.Json.JsonSerializer.Serialize(detail), StringComparison.OrdinalIgnoreCase);
         Assert.Equal("user-1", provider.LastOwnerUserId);