fix: review issues - enforce IsAuthenticated for API, secure CORS via env vars

api/jobs/views.py

@@ -1,5 +1,6 @@
 from django.db.models import Count, Q
-from rest_framework import permissions, viewsets
+from rest_framework import viewsets
+from rest_framework.permissions import IsAuthenticated
 from rest_framework.decorators import action
 from rest_framework.request import Request
 from rest_framework.response import Response
@@ -15,13 +16,13 @@ from .serializers import (
 class JobApplicationViewSet(viewsets.ModelViewSet):
     queryset = JobApplication.objects.all().prefetch_related("updates")
     serializer_class = JobApplicationSerializer
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [IsAuthenticated]
 
 
 class JobUpdateViewSet(viewsets.ModelViewSet):
     queryset = JobUpdate.objects.select_related("job_application").all()
     serializer_class = JobUpdateSerializer
-    permission_classes = [permissions.AllowAny]
+    permission_classes = [IsAuthenticated]
 
     @action(detail=False, methods=["get"])
     def latest(self, request: Request) -> Response: