- Ya
- 4 Septemba 2026, 00:34 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 2404893
The public job board reads this. It is the only surface in Careers with no session, so the safety comes from the QUERY rather than from a rights check: PublicCareersService loads through a repository predicate that filters on publishExternally and the two visible statuses, so an archived or internal-only req is never fetched — not fetched and then blanked, which is one forgotten field away from publishing a confidential backfill. A miss is 404, never 403; refusing by name confirms the posting exists. An unpublished pay range is likewise never WRITTEN to the DTO rather than blanked at render time, because a number on the wire is one devtools tab away from being read. Filtering and faceting happen in memory over the org's visible set. That is a deliberate trade: a careers board is tens of adverts, not a catalogue, and holding the set means the facet counts are exact and free-text search can reach into the advert BODY — flattened through RichTextValues, which is the only honest way to search a Lexical document. A LIKE over the raw column would match "paragraph" in every advert. Also: listedAt is stamped when a posting ENTERS available and never on an ordinary edit, so re-listing restarts the applicant window while changing a salary line does not silently zero a count HR is reading. CareersPublicController is a separate class from the member one on purpose. Adding a permit-all mapping beside gated ones puts the leak one copy-pasted annotation away; here the absence of a guard is the class's stated contract. 23 tests: what the anonymous surface may see, and the listedAt invariants.