feat: implement API security measures phase 1

api/jobs/models.py

@@ -1,5 +1,7 @@
 from django.db import models
 
+from accounts.models import User
+
 
 class StatusChoices(models.TextChoices):
     APPLIED = "APPLIED", "Applied"
@@ -11,6 +13,12 @@ class StatusChoices(models.TextChoices):
 
 
 class JobApplication(models.Model):
+    user = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="job_applications",
+        help_text="User who owns this job application.",
+    )
     company_name = models.CharField(max_length=255)
     position_title = models.CharField(max_length=255)
     status = models.CharField(
@@ -24,6 +32,12 @@ class JobApplication(models.Model):
 
     class Meta:
         ordering = ["-updated_at"]
+        constraints = [
+            models.UniqueConstraint(
+                fields=["user", "company_name", "position_title"],
+                name="unique_user_job_application",
+            )
+        ]
 
     def __str__(self) -> str:
         return f"{self.company_name} - {self.position_title}"
@@ -57,4 +71,4 @@ class JobUpdate(models.Model):
         verbose_name_plural = "Job Updates"
 
     def __str__(self) -> str:
-        return f"Update #{self.id}: {self.job_application.company_name} → {self.to_status}"
+        return f"Update #{self.id}: {self.job_application.company_name} -> {self.to_status}"