Fix resume preview failing to load in the browser - #379
Conversation
Sync: dev to main
Stop decodeURIComponent from crashing Settings on a truncated filename, wait for the matching ZIP entry instead of the previous one, and keep volunteer accounts from counting as staff. Analytics now uses unexpired memberships and chronological bootcamp terms.
The edge proxy sent X-Frame-Options: DENY on /api/resume, so Chrome's PDF viewer reported a failed load for a file that was already on disk. Preview now fetches the PDF as a blob, and uploads keep the original bytes instead of a pdf-lib rewrite that can corrupt real resumes. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
Force the blob to application/pdf, reject non-PDF bodies, and add an Open-in-new-tab path so Chrome's viewer is not the only way to see a stored resume. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
cursor
Bot
changed the title
Dependency ReviewThe following issues were found:
|
|
Visit the preview URL for this PR (updated for commit d140df2): https://hacklytics2027--pr-379-10oww4s6.web.app (expires Mon, 14 Sep 2026 17:51:54 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: c48ba34db61581e25fe2978355160b5eefe0e83f |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d140df2. Configure here.
|
|
||
| const result = row[0] ?? null; | ||
| ctx.cache.set(cacheKey, result, 60); | ||
| return result; |
There was a problem hiding this comment.
Empty resume cache never hits
Low Severity
resume.me stores null when the caller has no row, but cache.get also returns null on a miss. The cached !== null guard therefore treats a cached empty result as a miss and queries member_resume on every settings load.
Reviewed by Cursor Bugbot for commit d140df2. Configure here.
1 participant
Automated PR tracking changes from
hotfix-fix-main-review-issues-9d3dintodev.Note
Medium Risk
Touches production deploy config, new PII storage (resumes), schema pushes, and staff permission semantics (
isAdminexcludes volunteers); audit log API removal may break any remaining/admin/auditconsumers.Overview
This PR adds member resume book infrastructure (metadata in Postgres, PDFs in Cloud Storage via
RESUME_BUCKETinapphosting.yaml), aresumetRPC router and sharedresume-listqueries for staff filtering/ZIP downloads, plus docs indocs/resume-book.md. Club projects move to aclub_projecttable with a Fall 2026db:seed:club-projectsscript so/and/projectsare DB-driven instead of stale static data.Club project applications now require a pitch and can attach an optional PDF resume on
requestToJoin(uploadProcedure); leaders fetch resumes viaapplicantResumewithout loading PDFs in the applicant list. Copy and glossary shift from “initiative” to “club project” where member-facing.Operational and performance fixes dominate the API layer:
CacheService.getOrSetcollapses cache stampedes; cheaperdeletePatternand rate-limit/cache eviction; negative caching for non–project-leaders;admin.isAdmintreats volunteers as non-staff; newadmin.growthinsights; hot paths (events, hackathons, analytics, portal hackathon resolution) usegetOrSet. TheaudittRPC router is removed (and its router test). Monitoring adds p99 tRPC latency (histogram buckets, Grafana, Prometheus recording rules +PortalApiTailSlowalert).CI upgrades
pnpm/action-setupto v5 and stops pinning pnpm in workflows sopackageManager/pnpm-workspace.yamlsettings apply. Docs adddocs/club-project.mdand bump documented pnpm to 12.3.4.Reviewed by Cursor Bugbot for commit d140df2. Bugbot is set up for automated code reviews on this repo. Configure here.