Donate to Postulo/postulo

• https://buymeacoffee.com/tiagoagueda

---

See the documentation for more details on donation links.

Record, change and delete offers through the API #1232

Closed

tiagoagueda wants to merge 0 commits from f-1101 into main

pull from: f-1101

merge into: Postulo:main

Postulo:main

Postulo:weblate

Postulo:b9-1165

Postulo:f-1100

Postulo:f-1102

Postulo:0.5.0

Postulo:0.3.0

Conversation 1 Commits - Files changed - +461 -92

tiagoagueda commented 2026-11-11 22:21:38 +00:00

Owner

• Copy link
• Copy Markdown

Closes #1101: offers can be recorded, changed and deleted through the API, not only read.

• POST /api/v1/offers, PATCH /api/v1/offers/{id}, DELETE /api/v1/offers/{id}, under the write scope like interviews and reminders.
• Every write goes through the page's own OfferForm, then record_offer, revise_offer or withdraw_offer, so the checks, the timeline entry (signed by the token's name) and the answer-by reminder are the page's. A form refusal is the usual validation-failed problem document, with the form's messages in the token owner's language.
• PATCH changes only the fields sent; null clears one.
• The isolation sweep covers the new calls with someone else's offer and someone else's application.
• postulo-mcp is untouched and keeps offering no delete tool.

Not done: the page pre-fills a new offer from the advertised salary, the API does not (the client sends the terms); no Idempotency-Key (only captures have one).

Tested: the six new tests fail without the change; offers, API, API problems, isolation sweep and the usual guards pass. No migration, no new string.

The wiki's The capture API gains the three rows once this is merged.

🤖 Generated with Claude Code

Closes #1101: offers can be recorded, changed and deleted through the API, not only read. - `POST /api/v1/offers`, `PATCH /api/v1/offers/{id}`, `DELETE /api/v1/offers/{id}`, under the `write` scope like interviews and reminders. - Every write goes through the page's own `OfferForm`, then `record_offer`, `revise_offer` or `withdraw_offer`, so the checks, the timeline entry (signed by the token's name) and the answer-by reminder are the page's. A form refusal is the usual `validation-failed` problem document, with the form's messages in the token owner's language. - `PATCH` changes only the fields sent; `null` clears one. - The isolation sweep covers the new calls with someone else's offer and someone else's application. - postulo-mcp is untouched and keeps offering no delete tool. Not done: the page pre-fills a new offer from the advertised salary, the API does not (the client sends the terms); no `Idempotency-Key` (only captures have one). Tested: the six new tests fail without the change; offers, API, API problems, isolation sweep and the usual guards pass. No migration, no new string. The wiki's *The capture API* gains the three rows once this is merged. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda added 2 commits 2026-11-11 22:21:38 +00:00

Record, change and delete offers through the API ... f9b654c052

Offers could be read through the API and not written: the router said
recording one was the interface's "for now (#237)", and #237 is closed.
An agent that moved an application to Offer could not write down what
was offered.

POST /offers, PATCH /offers/{id} and DELETE /offers/{id} now take the
write scope, as interviews and reminders do. Each hands the body to the
interface's own OfferForm, so the page and the API refuse alike, and the
form's refusal is answered as a validation-failed problem document with
the form's messages in `errors`. Recording goes through record_offer
(timeline entry signed by the token, answer-by reminder, the move to
Offer), a change through revise_offer with the form's changed fields (a
revision only when a term changed; the reminder follows a moved date),
and a delete through withdraw_offer, which ticks the reminder off. A
PATCH reads only the fields sent, and a null clears one.

The isolation sweep covers the two new addresses and the application_id
in the body; the unscoped-queries list names the application lookup.
postulo-mcp is untouched and keeps offering no delete tool.

Closes #1101

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Record #1101 in the changelog ... 5eb0a495c6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-11 23:18:34 +00:00

Extract the catalogues for the offers' new place in the API ... 31fde5ac50

The API's offer calls reuse sentences the catalogues already hold, so
their source references gained the router's file; without extracting,
the catalogue checks found the files out of step with the code.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda added 1 commit 2026-11-12 01:46:57 +00:00

Run CI again: data.forgejo.org answered 502 to the browser job ... c0baf6afa7

The browser job stopped before its first step, fetching actions/cache
from data.forgejo.org, which answered 502. Nothing in the change was
tested by it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tiagoagueda force-pushed f-1101 from c0baf6afa7 to bb8e386489 2026-11-12 01:52:33 +00:00 Compare

tiagoagueda referenced this pull request 2026-11-12 02:11:06 +00:00

Offers in the API, CV export formats, and plugin dashboard widgets #1237

tiagoagueda commented 2026-11-12 02:11:10 +00:00

Author

Owner

• Copy link
• Copy Markdown

Superseded by #1237, which stacks this branch with two other features so they share one CI run (each merge here is fast-forward-only, so landing them one by one would mean a CI run each after every rebase). The commits are the same.

🤖 Generated with Claude Code

Superseded by #1237, which stacks this branch with two other features so they share one CI run (each merge here is fast-forward-only, so landing them one by one would mean a CI run each after every rebase). The commits are the same. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

tiagoagueda closed this pull request 2026-11-12 02:11:12 +00:00

All checks were successful

Hide checks

CI / Unit tests and coverage (Python 3.14) (pull_request) Successful in 15m13s

Details

CI / Checks: lint, migrations, catalogues, settings, built files (pull_request) Successful in 2m15s

Details

CI / Database tests on PostgreSQL (pull_request) Successful in 4m11s

Details

CI / Security audit (pull_request) Successful in 21s

Details

CI / Browser tests (Chromium) (pull_request) Successful in 36m11s

Details

Pull request closed

Please reopen this pull request to perform a merge.

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

accessibility

Usable by everyone, including people with disabilities: one of the project's stated missions

  

authentication

Signing in, and proving who you are

  

breaking change

Changes behaviour or data in a way operators must act on

  

bug

Something does not do what it says it does

  

documentation

The wiki, the docs, or the words in the interface

  

enhancement

An improvement or a new capability

  

interface

The shape of the pages: what is where, and how it reads

  

internationalisation

Languages, regions, and the formats and symbols that go with them

  

observability

What an operator can see about a running instance: metrics, logs, health

  

performance

Uses fewer resources, or is more reliable, with no loss of features or accessibility

  

security

Keeping the code and the data secure: one of the project's stated missions

  

tier

1

Easy: small, self-contained, no prerequisites

  

tier

2

High-severity security: account access, personal data, the boundaries

  

tier

3

Foundations: prerequisite work that unblocks other issues

  

tier/4

Later: large features and long-horizon work

No labels

accessibility

authentication

breaking change

bug

documentation

enhancement

interface

internationalisation

observability

performance

security

tier

1

tier

2

tier

3

tier/4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

Postulo/postulo!1232

No description provided.