feat(cv-import): ground reviewed facts in revisioned career profiles

2026-10-26 14:30:14 +01:00
parent 3ea8ff9d62
commit e8f76a9dea
24 changed files with 1197 additions and 13 deletions
@@ -20,6 +20,49 @@ namespace JobTrackerApi.Tests;

 public sealed class ProfileCvControllerTests
 {
+    [Fact]
+    public async Task Document_import_rejects_spoofed_pdf_without_storing_it()
+    {
+        var user = new ApplicationUser { Id = "user-1" };
+        var users = CreateUserManager();
+        users.Setup(x => x.GetUserAsync(It.IsAny<ClaimsPrincipal>())).ReturnsAsync(user);
+        await using var db = CreateDb();
+        var controller = CreateController(users.Object, new Mock<ISummarizerService>().Object, db, CreatePaths());
+        var file = new FormFile(new MemoryStream(Encoding.UTF8.GetBytes("not a PDF")), 0, 9, "file", "cv.pdf");
+        Assert.IsType<BadRequestObjectResult>(await controller.Import(file));
+        Assert.Empty(db.CvUploadArtifacts);
+    }
+
+    [Fact]
+    public async Task Document_import_requires_explicit_approval_and_repeat_apply_is_idempotent()
+    {
+        var user = new ApplicationUser { Id = "user-1" };
+        var users = CreateUserManager();
+        users.Setup(x => x.GetUserAsync(It.IsAny<ClaimsPrincipal>())).ReturnsAsync(user);
+        ConfigureWorkerUser(users, user);
+        users.Setup(x => x.UpdateAsync(user)).ReturnsAsync(IdentityResult.Success);
+        var ai = new Mock<ISummarizerService>();
+        const string source = "# Ada Lovelace\n\n## Skills\nC#, SQL";
+        ai.Setup(x => x.ExtractCvDocumentAsync(It.IsAny<Stream>(), It.IsAny<string>(), It.IsAny<string?>(), It.IsAny<CancellationToken>())).ReturnsAsync(new CvImportDocument(source, false, "application/pdf", 1, source.Length, "cv.pdf", new[] { new CvImportBlock("b1", source, "text", 1) }, Array.Empty<string>(), "docling"));
+        await using var db = CreateDb();
+        var controller = CreateController(users.Object, ai.Object, db, CreatePaths());
+        var bytes = Encoding.UTF8.GetBytes("%PDF-1.7\nsynthetic admission only");
+        var file = new FormFile(new MemoryStream(bytes), 0, bytes.Length, "file", "cv.pdf") { Headers = new HeaderDictionary(), ContentType = "application/pdf" };
+        Assert.IsType<AcceptedResult>(await controller.Import(file));
+        var run = await db.CvExtractionRuns.SingleAsync();
+        Assert.True((await controller.ProcessQueuedRunAsync(run.Id, default))!.Succeeded);
+        Assert.Null(user.ProfileCvStructureJson);
+        Assert.IsType<ConflictObjectResult>(await controller.AcceptRun(run.Id, new(null, 0)));
+        var review = Assert.IsType<CvImportReview>(Assert.IsType<OkObjectResult>(await controller.GetImportReview(run.Id)).Value);
+        var field = review.Groups.SelectMany(g => g.Fields).Single(f => f.ExtractedValue == "C#");
+        var request = new ProfileCvController.ApplyReviewedRequest(0, new[] { new CvImportDecision(field.Id, "use") });
+        Assert.IsType<OkObjectResult>(await controller.ApplyReviewed(run.Id, request));
+        Assert.IsType<OkObjectResult>(await controller.ApplyReviewed(run.Id, request));
+        Assert.Single(db.CareerProfileVersions);
+        Assert.Equal(new[] { "C#" }, StructuredCvProfileJson.Deserialize(user.ProfileCvStructureJson).Skills);
+        ai.Verify(x => x.SummarizeSectionAsync(It.IsAny<string>(), It.IsAny<string>(), It.IsAny<int>(), It.IsAny<int>()), Times.Never);
+    }
+
    [Fact]
    public async Task Upload_rejects_unsupported_extension()
    {