LEANDERANTONY
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 4 additions & 0 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 4 additions & 0 deletions
diff --git a/‎backend/routers/workspace.py‎
Lines changed: 127 additions & 11 deletions b/‎backend/routers/workspace.py‎
Lines changed: 127 additions & 11 deletions
diff --git a/‎backend/services/resume_builder_tools.py‎
Lines changed: 10 additions & 13 deletions b/‎backend/services/resume_builder_tools.py‎
Lines changed: 10 additions & 13 deletions
@@ -71,6 +71,10 @@ jobs:
         working-directory: frontend
         run: npm run lint
 
+      - name: Test
+        working-directory: frontend
+        run: npm test
+
       - name: Build
         working-directory: frontend
         run: npm run build
@@ -148,6 +148,46 @@ def _event_identity(access_token: str, refresh_token: str) -> tuple[str, str]:
     return (str(getattr(app_user, "id", "") or ""), resolve_user_tier(app_user))
 
 
+def _require_user_id(access_token: str, refresh_token: str) -> str:
+    """Resolve the authenticated caller's ``user_id`` or raise 401.
+
+    Used by the analysis-job status / cancel routes to enforce
+    object-level ownership. The ``job_id`` in the URL is a uuid4 that
+    leaks via access logs / Referer / telemetry and is NOT an
+    authorization token on its own (this was an unauthenticated BOLA —
+    SECURITY-1). Resolving STRICTLY (a 401 on any failure, never an
+    empty id) guarantees the downstream ownership comparison can never
+    be skipped fail-open — a best-effort empty id would match a job with
+    no owner and re-open the hole.
+    """
+    try:
+        auth_context = resolve_authenticated_context(
+            access_token=access_token,
+            refresh_token=refresh_token,
+        )
+    except InputValidationError:
+        raise HTTPException(
+            status_code=401,
+            detail="Your session has expired. Sign in again to continue.",
+        )
+    except AppError as error:
+        # Non-credential AppError (backend integration, etc.) → canonical
+        # status code instead of a generic 500.
+        _raise_http_error(error)
+    if auth_context is None:
+        raise HTTPException(
+            status_code=401,
+            detail="Couldn't resolve your session. Sign in again to continue.",
+        )
+    user_id = str(getattr(getattr(auth_context, "app_user", None), "id", "") or "")
+    if not user_id:
+        raise HTTPException(
+            status_code=401,
+            detail="No user identity available for this session.",
+        )
+    return user_id
+
+
 def _file_extension(filename: str | None) -> str:
     """Lower-cased file extension without the dot, or "" when absent."""
     name = str(filename or "")
@@ -390,7 +430,7 @@ def upload_job_description(
     # the parse so an over-budget request has no side effects.
     _enforce_request_llm_budget(access_token or "", refresh_token or "")
     try:
-        return parse_job_description_upload(
+        result = parse_job_description_upload(
             filename=payload.filename,
             mime_type=payload.mime_type,
             content_base64=payload.content_base64,
@@ -399,6 +439,27 @@ def upload_job_description(
             access_token=access_token or "",
             refresh_token=refresh_token or "",
         )
+        # PostHog funnel event (review OBS-2): JD parse sits between
+        # job_searched and analysis_started — the most failure-prone
+        # step — and previously emitted nothing, so the funnel couldn't
+        # measure drop-off there. The paste path (unified through this
+        # route in d93ddc4) sends a synthetic "pasted.txt"; everything
+        # else is a real upload.
+        user_id, tier = _event_identity(access_token or "", refresh_token or "")
+        capture_event(
+            distinct_id=user_id,
+            event="jd_parsed",
+            properties={
+                "source": (
+                    "paste"
+                    if str(payload.filename or "").lower() == "pasted.txt"
+                    else "upload"
+                ),
+                "tier": tier,
+                "file_type": _file_extension(payload.filename),
+            },
+        )
+        return result
     except AppError as error:
         _raise_http_error(error)
 
@@ -518,12 +579,23 @@ def generate_resume_builder_route(
             refresh_token=refresh_token or "",
             session_id=payload.session_id,
         )
-        return _attach_persistence_status(
+        result = _attach_persistence_status(
             response,
             persist_result,
             access_token=access_token or "",
             refresh_token=refresh_token or "",
         )
+        # PostHog funnel event (review OBS-2): the agentic résumé-build
+        # path emitted nothing, so only résumé *upload* was measurable,
+        # never a build. `step` distinguishes the structuring pass
+        # (generate) from the finalize (commit).
+        user_id, tier = _event_identity(access_token or "", refresh_token or "")
+        capture_event(
+            distinct_id=user_id,
+            event="resume_built",
+            properties={"tier": tier, "step": "generate"},
+        )
+        return result
     except ValueError as error:
         raise HTTPException(status_code=400, detail=str(error))
 
@@ -624,6 +696,14 @@ def commit_resume_builder_route(
             access_token=access_token or "",
             refresh_token=refresh_token or "",
         )
+        # PostHog funnel event (review OBS-2) — the finalize step of the
+        # agentic résumé build (see the generate route for the rationale).
+        user_id, tier = _event_identity(access_token or "", refresh_token or "")
+        capture_event(
+            distinct_id=user_id,
+            event="resume_built",
+            properties={"tier": tier, "step": "commit"},
+        )
         return response
     except ValueError as error:
         raise HTTPException(status_code=400, detail=str(error))
@@ -754,6 +834,12 @@ def start_workspace_analysis_job_route(
     auth_tokens=Depends(get_required_auth_tokens),
 ):
     access_token, refresh_token = auth_tokens
+    # Resolve the caller once: the user_id binds OWNERSHIP onto the job
+    # (so only this user can later poll / cancel it — SECURITY-1) and
+    # also identifies the funnel event. Best-effort here (never raises);
+    # an unresolvable caller binds owner=None, which fails CLOSED on the
+    # status/cancel routes (no one can read a job with no owner).
+    user_id, tier = _event_identity(access_token or "", refresh_token or "")
     try:
         result = start_workspace_analysis_job(
             resume_text=payload.resume_text,
@@ -764,10 +850,11 @@ def start_workspace_analysis_job_route(
             premium=payload.premium,
             access_token=access_token or "",
             refresh_token=refresh_token or "",
+            owner_user_id=user_id or None,
+            tier=tier,
         )
         # PostHog funnel event — async variant of the supervised
         # pipeline. Emitted once the job is accepted onto the queue.
-        user_id, tier = _event_identity(access_token or "", refresh_token or "")
         capture_event(
             distinct_id=user_id,
             event="analysis_started",
@@ -951,8 +1038,16 @@ def get_workspace_quota_route(auth_tokens=Depends(get_optional_auth_tokens)):
     "/analyze-jobs/{job_id}",
     response_model=WorkspaceAnalyzeJobStatusResponseModel,
 )
-def get_workspace_analysis_job_route(job_id: str):
-    payload = get_workspace_analysis_job(job_id)
+def get_workspace_analysis_job_route(
+    job_id: str,
+    auth_tokens=Depends(get_required_auth_tokens),
+):
+    # Object-level authorization (SECURITY-1): the job_id is a uuid4 in
+    # the URL, not a secret. Require login and only return a job to its
+    # owner; a non-owner gets the same 404 as an unknown id.
+    access_token, refresh_token = auth_tokens
+    user_id = _require_user_id(access_token or "", refresh_token or "")
+    payload = get_workspace_analysis_job(job_id, owner_user_id=user_id)
     if payload is None:
         # `_JOBS` is process-local, so a container restart mid-run drops
         # the job state permanently. The frontend polling hook surfaces
@@ -973,15 +1068,25 @@ def get_workspace_analysis_job_route(job_id: str):
     "/analyze-jobs/{job_id}/cancel",
     response_model=WorkspaceAnalyzeJobStatusResponseModel,
 )
-def cancel_workspace_analysis_job_route(job_id: str):
+def cancel_workspace_analysis_job_route(
+    job_id: str,
+    auth_tokens=Depends(get_required_auth_tokens),
+):
     # Cooperative cancel: sets the flag and returns immediately. The
     # job typically comes back still "running" (the worker observes
     # the flag at its next stage boundary); the frontend keeps polling
     # GET /analyze-jobs/{job_id} until it sees the terminal
-    # "cancelled". Idempotent for already-terminal jobs. Same
-    # job_id-scoped access model as the status route (the id is an
-    # unguessable uuid4 hex; no extra auth surface added).
-    payload = cancel_workspace_analysis_job(job_id)
+    # "cancelled". Idempotent for already-terminal jobs.
+    #
+    # Object-level authorization (SECURITY-1): require login and scope
+    # the cancel to the job's owner. The job_id is a uuid4 in the URL
+    # that leaks via logs / Referer / telemetry, so it is NOT an
+    # authorization token — a non-owner must not be able to stop a
+    # stranger's in-flight run. A mismatch returns the same 404 as an
+    # unknown id.
+    access_token, refresh_token = auth_tokens
+    user_id = _require_user_id(access_token or "", refresh_token or "")
+    payload = cancel_workspace_analysis_job(job_id, owner_user_id=user_id)
     if payload is None:
         raise HTTPException(
             status_code=404,
@@ -1169,10 +1274,21 @@ def export_workspace_artifact_route(
     # (best-effort; anon/expired -> "free") and block the DOCX /
     # non-classic_ats entitlement with the canonical 429 upgrade
     # nudge. PDF + classic_ats is unchanged for every tier incl. anon.
+    # Gate ONLY the theme that actually renders the artifact being
+    # exported. The service renders artifacts[artifact_kind] with its OWN
+    # theme, so a résumé export is unaffected by the cover-letter theme
+    # (and vice-versa). Passing BOTH themes let an unrelated custom
+    # cover-letter theme block a Free user's default-theme résumé PDF
+    # with a misleading "Pro+ feature" 429 (review HIGH / FLOW-3).
+    export_theme = (
+        payload.resume_theme
+        if payload.artifact_kind == "tailored_resume"
+        else payload.cover_letter_theme
+    )
     enforce_export_entitlement(
         _resolve_export_tier(access_token or "", refresh_token or ""),
         export_format=payload.export_format,
-        themes=(payload.resume_theme, payload.cover_letter_theme),
+        themes=(export_theme,),
     )
     try:
         result = export_workspace_artifact(
 
@@ -353,16 +353,16 @@ def _web_search(
                 "to describe the external context directly."
             ),
         }
-    client = getattr(openai_service, "_client", None)
-    if client is None:
-        return {
-            "ok": False,
-            "error": "no_openai_client",
-            "message": "OpenAI client is not initialized.",
-        }
-
+    # Route the inner call through the OpenAIService accounting layer
+    # (review LLM-1) instead of reaching into ._client directly. The
+    # service's run_builtin_web_search records token usage + a cost-trace
+    # row AND enforces the session budget, so web_search spend is no
+    # longer invisible to the weekly meter / COGS report. It also applies
+    # WEB_SEARCH_TIMEOUT_SECONDS to the call (previously the 30s constant
+    # was dead and the search ran at the 120s client default — LLM-2).
     try:
-        response = client.responses.create(
+        response = openai_service.run_builtin_web_search(
+            cleaned_query,
             model="gpt-5.4-mini",
             instructions=(
                 "You are a research assistant. Use the web_search tool to "
@@ -371,11 +371,8 @@ def _web_search(
                 "max. If the search returns nothing useful, say so plainly "
                 "instead of inventing."
             ),
-            input=cleaned_query,
-            store=False,
             max_output_tokens=600,
-            tools=[{"type": "web_search"}],
-            tool_choice="auto",
+            timeout=WEB_SEARCH_TIMEOUT_SECONDS,
         )
     except Exception as exc:
         LOGGER.exception("web_search dispatch failed.")