feat(cv-import): add source-grounded review and explicit corrections

JobTrackerApi.Tests/ProfileCvControllerTests.cs

@@ -20,6 +20,46 @@ namespace JobTrackerApi.Tests;
 
 public sealed class ProfileCvControllerTests
 {
+    [Fact]
+    public async Task Pending_import_review_remains_reachable_after_ten_newer_completed_runs()
+    {
+        var user = new ApplicationUser { Id = "user-1" };
+        var users = CreateUserManager();
+        users.Setup(x => x.GetUserAsync(It.IsAny<ClaimsPrincipal>())).ReturnsAsync(user);
+        await using var db = CreateDb();
+        var pending = new CvExtractionRun { OwnerUserId = user.Id, Status = "pending_review", StartedAtUtc = DateTimeOffset.UtcNow.AddDays(-5), ParserVersion = "docling-v1" };
+        db.CvExtractionRuns.Add(pending);
+        db.CvExtractionRuns.AddRange(Enumerable.Range(0, 12).Select(i => new CvExtractionRun { OwnerUserId = user.Id, Status = "applied", StartedAtUtc = DateTimeOffset.UtcNow.AddMinutes(-i) }));
+        await db.SaveChangesAsync();
+        var result = await CreateController(users.Object, Mock.Of<ISummarizerService>(), db, CreatePaths()).GetRuns();
+        var runs = Assert.IsAssignableFrom<IEnumerable<CvExtractionRunListItem>>(Assert.IsType<OkObjectResult>(result.Result).Value).ToList();
+        Assert.Contains(runs, r => r.Id == pending.Id);
+        Assert.Equal(11, runs.Count);
+    }
+    [Fact]
+    public async Task Document_import_rejects_docx_dtd_before_admission_or_file_storage()
+    {
+        var user = new ApplicationUser { Id = "user-1" };
+        var users = CreateUserManager();
+        users.Setup(x => x.GetUserAsync(It.IsAny<ClaimsPrincipal>())).ReturnsAsync(user);
+        await using var db = CreateDb();
+        var paths = CreatePaths();
+        var controller = CreateController(users.Object, Mock.Of<ISummarizerService>(), db, paths);
+        using var bytes = new MemoryStream();
+        using (var archive = new System.IO.Compression.ZipArchive(bytes, System.IO.Compression.ZipArchiveMode.Create, true))
+        {
+            foreach (var entry in new Dictionary<string, string> { ["[Content_Types].xml"] = "<Types/>", ["word/document.xml"] = "<document/>", ["word/_rels/document.xml.rels"] = "<!DOCTYPE Relationships [<!ENTITY example 'inert'>]><Relationships>&example;</Relationships>" })
+            {
+                await using var writer = new StreamWriter(archive.CreateEntry(entry.Key).Open());
+                await writer.WriteAsync(entry.Value);
+            }
+        }
+        bytes.Position = 0;
+        var file = new FormFile(bytes, 0, bytes.Length, "file", "synthetic.docx") { Headers = new HeaderDictionary(), ContentType = "application/vnd.openxmlformats-officedocument.wordprocessingml.document" };
+        Assert.IsType<BadRequestObjectResult>(await controller.Import(file));
+        Assert.Empty(db.CvUploadArtifacts);
+        Assert.Empty(Directory.EnumerateFiles(paths.CvArtifactsRoot, "*", SearchOption.AllDirectories));
+    }
     [Fact]
     public async Task Document_import_rejects_spoofed_pdf_without_storing_it()
     {