cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

Merge Request — Wave 0 quick wins + Tier-1/Tier-2 features #1

Merged
cesnimda merged 26 commits from chore/wave0-quick-wins into main 2026-07-03 11:14:15 +02:00
Conversation 0 Commits 26 Files Changed 64
+36
1 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bd51c245d3 - Show all commits
JobTrackerApi.Tests/JobApplicationsAuthorizationTests.cs
+36
View File
@@ -38,6 +38,42 @@ public sealed class JobApplicationsAuthorizationTests
Assert.IsType<NotFoundResult>(result.Result);
}
[Fact]
public async Task GetMatchScore_returns_not_found_for_other_users_job()
{
var dbName = Guid.NewGuid().ToString();
await using var ownerDb = CreateDb(dbName, "owner-1");
var company = new Company { Name = "Acme", OwnerUserId = "owner-1" };
ownerDb.Companies.Add(company);
await ownerDb.SaveChangesAsync();
ownerDb.JobApplications.Add(new JobApplication { JobTitle = "Secret", CompanyId = company.Id, OwnerUserId = "owner-1", Description = "C# .NET" });
await ownerDb.SaveChangesAsync();
var jobId = await ownerDb.JobApplications.Select(j => j.Id).FirstAsync();
await using var attackerDb = CreateDb(dbName, "other-user");
var result = await CreateController(attackerDb).GetMatchScore(jobId, CancellationToken.None);
Assert.IsType<NotFoundResult>(result.Result);
}
[Fact]
public async Task GetStatusSuggestion_returns_not_found_for_other_users_job()
{
var dbName = Guid.NewGuid().ToString();
await using var ownerDb = CreateDb(dbName, "owner-1");
var company = new Company { Name = "Acme", OwnerUserId = "owner-1" };
ownerDb.Companies.Add(company);
await ownerDb.SaveChangesAsync();
ownerDb.JobApplications.Add(new JobApplication { JobTitle = "Secret", CompanyId = company.Id, OwnerUserId = "owner-1" });
await ownerDb.SaveChangesAsync();
var jobId = await ownerDb.JobApplications.Select(j => j.Id).FirstAsync();
await using var attackerDb = CreateDb(dbName, "other-user");
var result = await CreateController(attackerDb).GetStatusSuggestion(jobId, CancellationToken.None);
Assert.IsType<NotFoundResult>(result.Result);
}
private static JobTrackerContext CreateDb(string dbName, string? userId)
{
var options = new DbContextOptionsBuilder<JobTrackerContext>()