From 52751e5b2b88ff54ded1489afd40b259d7b3924d Mon Sep 17 00:00:00 2001
From: pwklppg <123456@.com>
Date: Tue, 15 Sep 2026 09:35:18 +0800
Subject: [PATCH] fix: constrain skill projections by occupation category

---
 .../repository/OccupationSkillRepository.java |  2 ++
 .../skill/SkillTaxonomyRepositoryTest.java    | 36 +++++++++++++++++++
 2 files changed, 38 insertions(+)

diff --git a/mydreamjob-server/src/main/java/com/mydreamjob/skill/repository/OccupationSkillRepository.java b/mydreamjob-server/src/main/java/com/mydreamjob/skill/repository/OccupationSkillRepository.java
index 828fc02..d3c0de1 100644
--- a/mydreamjob-server/src/main/java/com/mydreamjob/skill/repository/OccupationSkillRepository.java
+++ b/mydreamjob-server/src/main/java/com/mydreamjob/skill/repository/OccupationSkillRepository.java
@@ -36,6 +36,7 @@ public interface OccupationSkillRepository extends JpaRepository<OccupationSkill
             FROM OccupationSkill os, Skill s, SkillCategory c
             WHERE os.skillId = s.id
               AND os.categoryId = c.id
+              AND c.occupationId = os.occupationId
               AND os.occupationId = :occupationId
             """)
     List<SkillCloudSkillProjection> findSkillProjectionsByOccupationId(
@@ -62,6 +63,7 @@ public interface OccupationSkillRepository extends JpaRepository<OccupationSkill
             FROM OccupationSkill os, Skill s, SkillCategory c
             WHERE os.skillId = s.id
               AND os.categoryId = c.id
+              AND c.occupationId = os.occupationId
               AND os.occupationId = :occupationId
               AND os.categoryId = :categoryId
             """)
diff --git a/mydreamjob-server/src/test/java/com/mydreamjob/skill/SkillTaxonomyRepositoryTest.java b/mydreamjob-server/src/test/java/com/mydreamjob/skill/SkillTaxonomyRepositoryTest.java
index 7f3dfe0..322abba 100644
--- a/mydreamjob-server/src/test/java/com/mydreamjob/skill/SkillTaxonomyRepositoryTest.java
+++ b/mydreamjob-server/src/test/java/com/mydreamjob/skill/SkillTaxonomyRepositoryTest.java
@@ -15,8 +15,10 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.test.mock.mockito.MockBean;
 import org.springframework.data.redis.core.RedisTemplate;
+import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.test.context.ActiveProfiles;
 import org.springframework.test.context.TestPropertySource;
+import org.springframework.transaction.annotation.Transactional;
 import org.hibernate.boot.model.relational.Namespace;
 import org.hibernate.boot.model.relational.Sequence;
 import org.hibernate.mapping.Table;
@@ -61,6 +63,9 @@ class SkillTaxonomyRepositoryTest {
     @Autowired
     private OccupationSkillRepository occupationSkillRepository;
 
+    @Autowired
+    private JdbcTemplate jdbcTemplate;
+
     @MockBean
     private RedisTemplate<String, Object> redisTemplate;
 
@@ -115,6 +120,37 @@ class SkillTaxonomyRepositoryTest {
                 .isEmpty();
     }
 
+    @Test
+    @Transactional
+    void projectionQueriesRejectCrossOccupationCategoryMismatch() {
+        jdbcTemplate.update("""
+                INSERT INTO occupation_skills (
+                    occupation_id, skill_id, category_id, importance,
+                    importance_source_code, importance_element_id,
+                    importance_is_proxy, relationship_type, source_version_id
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+                """,
+                1L, 1L, 201L, new BigDecimal("4.61"),
+                "15-1252.00", "4.A.3.b.1", 1, "ESSENTIAL", 2L);
+
+        List<SkillCloudSkillProjection> occupationOneSkills =
+                occupationSkillRepository.findSkillProjectionsByOccupationId(1L);
+
+        assertThat(occupationOneSkills)
+                .extracting(SkillCloudSkillProjection::skillId)
+                .contains(3L)
+                .doesNotContain(1L);
+
+        assertThat(occupationSkillRepository
+                .findSkillProjectionsByOccupationIdAndCategoryId(1L, 201L))
+                .isEmpty();
+
+        assertThat(occupationSkillRepository
+                .findSkillProjectionsByOccupationIdAndCategoryId(2L, 201L))
+                .extracting(SkillCloudSkillProjection::skillId)
+                .contains(1L);
+    }
+
     @Test
     void projectionCarriesOnetProvenanceNullImportanceAndSortOrders() {
         SkillCloudSkillProjection react = occupationSkillRepository