feat: LinkedIn profile search engine (Django + React + Elasticsearch + ELK)

Full-stack implementation of the Cyberyan full-stack trial task. Backend (Django 5 / DRF) - Normalised PostgreSQL model (Profile, Company, School, Skill, Experience, Education) as the source of truth, with GIN + trigram indexes. - Self-healing CSV reader: the supplied export carries an injected watermark column, missing columns, rows split by broken quoting and a duplicated header. A signature-scored Needleman-Wunsch alignment reconstructs 284 clean records out of 336 physical rows; only 10 rows parse correctly without it. - Pluggable search layer (Strategy): Elasticsearch by default, PostgreSQL full-text search as a fallback selected by a single environment variable. - Keyword search with per-field boosts, fuzziness and phrase boosting, six faceted filters (OR within a filter, AND across filters), an experience range, four sort orders, highlighting and facet aggregations. - JWT auth with rotation + blacklist, three roles, PII masking, scoped rate limits, a single error envelope, OpenAPI schema and health probes. Frontend (React 18 / TypeScript / Vite) - Debounced search with type-ahead, faceted filter panel, result cards, profile drawer, URL-synced search state, automatic token refresh. - Highlight snippets rendered without dangerouslySetInnerHTML. Infrastructure - Hardened multi-stage images (non-root, read-only rootfs, healthchecks). - docker-compose for the full stack plus dev and production overlays. - ELK: structured JSON logs shipped asynchronously to Logstash, routed per event type, with a composable index template and a Kibana setup script. Quality - 61 backend tests (85% coverage), ruff/black/bandit/mypy, ESLint + tsc, GitHub Actions running lint, tests and both image builds. - Persian documentation: README plus architecture, search, API, data, security and operations guides. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GnFo6fNaHCTAkJbfcdkqtG
2026-09-03 08:13:10 +00:00
commit a464e550c9
133 changed files with 17019 additions and 0 deletions
@@ -0,0 +1,113 @@
+"""Authentication, authorisation and PII masking at the API boundary."""
+
+from __future__ import annotations
+
+import pytest
+from django.urls import reverse
+
+from apps.accounts.models import Role, User
+from tests.conftest import PASSWORD
+
+pytestmark = pytest.mark.django_db
+
+
+def test_register_creates_a_viewer(api_client) -> None:  # noqa: ANN001
+    response = api_client.post(
+        reverse("v1:accounts:register"),
+        {
+            "email": "New.User@Example.com",
+            "full_name": "New User",
+            "password": PASSWORD,
+            "password_confirm": PASSWORD,
+        },
+        format="json",
+    )
+    assert response.status_code == 201
+    assert response.data["role"] == Role.VIEWER
+    # E-mails are normalised so "A@x.com" and "a@x.com" cannot both exist.
+    assert User.objects.get(email="new.user@example.com")
+
+
+def test_register_rejects_mismatched_and_weak_passwords(api_client) -> None:  # noqa: ANN001
+    url = reverse("v1:accounts:register")
+    mismatch = api_client.post(
+        url,
+        {"email": "a@example.com", "password": PASSWORD, "password_confirm": "other"},
+        format="json",
+    )
+    assert mismatch.status_code == 400
+    assert mismatch.data["error"]["code"] == "validation_error"
+
+    weak = api_client.post(
+        url,
+        {"email": "b@example.com", "password": "12345678", "password_confirm": "12345678"},
+        format="json",
+    )
+    assert weak.status_code == 400
+
+
+def test_login_returns_tokens_and_identity(api_client, viewer) -> None:  # noqa: ANN001
+    response = api_client.post(
+        reverse("v1:accounts:login"),
+        {"email": viewer.email, "password": PASSWORD},
+        format="json",
+    )
+    assert response.status_code == 200
+    assert {"access", "refresh", "user"} <= set(response.data)
+    assert response.data["user"]["role"] == Role.VIEWER
+
+
+def test_search_requires_authentication(api_client) -> None:  # noqa: ANN001
+    response = api_client.get(reverse("v1:search:search"))
+    assert response.status_code == 401
+    assert response.data["error"]["code"] in {"authentication_failed", "not_authenticated"}
+
+
+def test_reindex_is_admin_only(
+    auth_client, viewer, admin_user, monkeypatch
+) -> None:  # noqa: ANN001
+    url = reverse("v1:search:reindex")
+    assert auth_client(viewer).post(url).status_code == 403
+
+    monkeypatch.setattr(
+        "apps.search.indexing.rebuild_index", lambda *_args, **_kwargs: {"indexed": 0}
+    )
+    response = auth_client(admin_user).post(url)
+    assert response.status_code in {202, 503}
+
+
+@pytest.mark.parametrize(
+    ("role", "should_be_masked"),
+    [(Role.VIEWER, True), (Role.ANALYST, False), (Role.ADMIN, False)],
+)
+def test_contact_details_are_masked_for_unprivileged_roles(
+    auth_client, make_user, sample_profiles, role: str, should_be_masked: bool
+) -> None:  # noqa: ANN001
+    profile = sample_profiles[0]
+    profile.emails = [{"address": "sara.python@acme.com", "type": "professional"}]
+    profile.phone_numbers = ["+19402058928"]
+    profile.save(update_fields=["emails", "phone_numbers"])
+
+    user = make_user(f"{role}@example.com", role)
+    response = auth_client(user).get(reverse("v1:profiles:detail", args=[profile.id]))
+
+    assert response.status_code == 200
+    assert response.data["pii_masked"] is should_be_masked
+    address = response.data["emails"][0]["address"]
+    assert (address != "sara.python@acme.com") is should_be_masked
+
+
+def test_response_carries_a_request_id_header(api_client) -> None:  # noqa: ANN001
+    response = api_client.get(reverse("v1:core:liveness"))
+    assert response.status_code == 200
+    assert response["X-Request-ID"]
+
+
+def test_client_supplied_request_id_is_echoed(api_client) -> None:  # noqa: ANN001
+    response = api_client.get(reverse("v1:core:liveness"), HTTP_X_REQUEST_ID="abc-123")
+    assert response["X-Request-ID"] == "abc-123"
+
+
+def test_malicious_request_id_is_replaced(api_client) -> None:  # noqa: ANN001
+    response = api_client.get(reverse("v1:core:liveness"), HTTP_X_REQUEST_ID="<script>x</script>")
+    assert "<script>" not in response["X-Request-ID"]