Files
jobtrackingapp/docs/audits/2026-09-07/source-index.md
T
cesnimda 0954876295 fix(security): enforce audited account, network and resource boundaries
Implement B01-B06 with regression coverage and retained validation evidence. Preserve the production ingress preflight; F04 runtime verification remains open.
2026-09-09 18:21:47 +02:00

37 lines
4.7 KiB
Markdown
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
# Source navigation index
These are the primary source locations cited in [F01–F21](findings.md), at the audit baseline. This is a navigation aid, not an exhaustive endpoint or file inventory. Line numbers in the findings refer to that baseline; source will move as fixes land. Other assessed boundaries and unverified inventories are stated in [coverage.md](coverage.md).
| Source | Assessment boundary |
|---|---|
| [JobTrackerApi/Controllers/AdminAuditController.cs](../../../JobTrackerApi/Controllers/AdminAuditController.cs) | F13 — global activity access |
| [JobTrackerApi/Controllers/ApplicationCalendarController.cs](../../../JobTrackerApi/Controllers/ApplicationCalendarController.cs) | F21 — DateTime to ICS conversion |
| [JobTrackerApi/Controllers/AttachmentsController.cs](../../../JobTrackerApi/Controllers/AttachmentsController.cs) | F10 — quota check and staged upload |
| [JobTrackerApi/Controllers/BillingController.cs](../../../JobTrackerApi/Controllers/BillingController.cs) | F02 — checkout/webhook/role updates |
| [JobTrackerApi/Controllers/ClientErrorsController.cs](../../../JobTrackerApi/Controllers/ClientErrorsController.cs) | F16 — client URL/message/stack logging |
| [JobTrackerApi/Controllers/CvVariantController.cs](../../../JobTrackerApi/Controllers/CvVariantController.cs) | F01/F03 — save contract and PDF entry point |
| [JobTrackerApi/Controllers/ExportController.cs](../../../JobTrackerApi/Controllers/ExportController.cs) | F05/F10 — CSV escaping and export materialization |
| [JobTrackerApi/Controllers/UsersController.cs](../../../JobTrackerApi/Controllers/UsersController.cs) | F13 — account and role mutations |
| [JobTrackerApi/Data/JobTrackerContext.cs](../../../JobTrackerApi/Data/JobTrackerContext.cs) | F01/F10 — filters, indexes and persisted invariants |
| [JobTrackerApi/Program.cs](../../../JobTrackerApi/Program.cs) | F06/F19 — middleware order, rate policy and provider defaults |
| [JobTrackerApi/Services/AccountDeletionService.cs](../../../JobTrackerApi/Services/AccountDeletionService.cs) | F02/F13 — purge stages and external lifecycle |
| [JobTrackerApi/Services/AiOperationQueue.cs](../../../JobTrackerApi/Services/AiOperationQueue.cs) | F20 — outer worker loop exception boundary |
| [JobTrackerApi/Services/CareerProfileService.cs](../../../JobTrackerApi/Services/CareerProfileService.cs) | F01 — career aggregate update boundary |
| [JobTrackerApi/Services/CvVariantService.cs](../../../JobTrackerApi/Services/CvVariantService.cs) | F01 — revision increments and history |
| [JobTrackerApi/Services/DatabaseBackupRunner.cs](../../../JobTrackerApi/Services/DatabaseBackupRunner.cs) | F12 — SQLite snapshot primitive |
| [JobTrackerApi/Services/FollowUpReminderHostedService.cs](../../../JobTrackerApi/Services/FollowUpReminderHostedService.cs) | F07/F21 — delivery/commit and scheduling |
| [JobTrackerApi/Services/ForwardedProxyConfiguration.cs](../../../JobTrackerApi/Services/ForwardedProxyConfiguration.cs) | F04 — trusted hop/network configuration |
| [JobTrackerApi/Services/JobImport/JobImportService.cs](../../../JobTrackerApi/Services/JobImport/JobImportService.cs) | F11 — URL/DNS validation versus connection |
| [JobTrackerApi/Services/PlaywrightCvPdfExporter.cs](../../../JobTrackerApi/Services/PlaywrightCvPdfExporter.cs) | F03/F15 — browser process and output lifecycle |
| [JobTrackerApi/Services/SmtpEmailSender.cs](../../../JobTrackerApi/Services/SmtpEmailSender.cs) | F07/F16 — suppressed outcomes and private logs |
| [JobTrackerApi/Services/StripeBillingGateway.cs](../../../JobTrackerApi/Services/StripeBillingGateway.cs) | F02 — provider request identity |
| [deploy/deploy.sh](../../../deploy/deploy.sh) | F12/F18 — live backup, rollback and readiness checks |
| [docker-compose.yml](../../../docker-compose.yml) | F03/F04/F18 — exposed ports, networks and container limits |
| [docs/architecture/current.md](../../../docs/architecture/current.md) | F17 — architecture documentation drift |
| [job-tracker-ui/e2e/accessibility.spec.ts](../../../job-tracker-ui/e2e/accessibility.spec.ts) | F14 — existing axe route coverage |
| [job-tracker-ui/nginx.conf.template](../../../job-tracker-ui/nginx.conf.template) | F04/F15 — forwarding and response headers |
| [job-tracker-ui/src/App.tsx](../../../job-tracker-ui/src/App.tsx) | F08/F09 — auth lifecycle and mounted private views |
| [job-tracker-ui/src/auth.ts](../../../job-tracker-ui/src/auth.ts) | F08 — client auth notifications and storage |
| [job-tracker-ui/src/interview-prep.test.tsx](../../../job-tracker-ui/src/interview-prep.test.tsx) | F17 — standalone TypeScript failure |
| [job-tracker-ui/src/views/CvBuilderEditor.tsx](../../../job-tracker-ui/src/views/CvBuilderEditor.tsx) | F01/F09/F14/F15 — save queue, preview, state and clipboard |