feature/api-security-phase-1
main
Implements API Security Phase 1 (Issue #7).
rest_framework_simplejwt.token_blacklist
is_admin
UserRateThrottle
AuthRateThrottle
SanitizedCharField
{error, code}
JobApplication.user
POST /api/auth/logout/
POST /api/auth/token/refresh/
GET /api/auth/me/
<ProtectedRoute>
<PublicRoute>
docs/backend/api-security-phase-1.md
No dependencies set.
The note is not visible to the blocked user.
Implements API Security Phase 1 (Issue #7).
Changes
Backend
rest_framework_simplejwt.token_blacklistis_adminproperty checks Django groups; ownership filtering on JobApplication/JobUpdate viewsUserRateThrottle(60/min) +AuthRateThrottle(5/min on login/register)SanitizedCharFieldstrips control chars and null bytes across all serializers{error, code}formatJobApplication.userFK with unique constraint on (user, company, position)POST /api/auth/logout/,POST /api/auth/token/refresh/(with rotation),GET /api/auth/me/Frontend
<ProtectedRoute>and<PublicRoute>components in App.tsxPOST /api/auth/logout/to blacklist refresh tokenDocumentation
docs/backend/api-security-phase-1.md— full spec covering all changes