Fix resume preview failing to load in the browser - #378
Fix resume preview failing to load in the browser#378github-actions[bot] wants to merge 2 commits into
Conversation
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
|
||
| const result = row[0] ?? null; | ||
| ctx.cache.set(cacheKey, result, 60); | ||
| return result; |
There was a problem hiding this comment.
Missing resume is never cached
Low Severity
resume.me stores a missing row as null, but cache.get also returns null on a miss, so cached !== null never treats “no resume” as a hit. Every profile load for a member without a resume repeats the lookup. The same commit caches an absent project-leader row as false to avoid this trap.
Reviewed by Cursor Bugbot for commit e3ed7d8. Configure here.
e3ed7d8 to
e3b1640
Compare
cursor
Bot
changed the title
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Visit the preview URL for this PR (updated for commit d140df2): https://hacklytics2027--pr-378-idyywqzy.web.app (expires Mon, 14 Sep 2026 17:51:52 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: c48ba34db61581e25fe2978355160b5eefe0e83f |
| .values(values) | ||
| .returning({ id: S.initiatives.id }); | ||
|
|
||
| return created.id; |
There was a problem hiding this comment.
Seed resets live project leadership
Medium Severity
Re-running db:seed:club-projects updates existing initiative rows by title and always writes leaderUserId back to OWNER_EMAIL and status to open. The club-project docs present that command as a safe republish that never deletes. A second run after real leads have taken over reassigns ownership and reopens closed projects.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit e3b1640. Configure here.
The edge proxy sent X-Frame-Options: DENY on /api/resume, so Chrome's PDF viewer reported a failed load for a file that was already on disk. Preview now fetches the PDF as a blob, and uploads keep the original bytes instead of a pdf-lib rewrite that can corrupt real resumes. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
Force the blob to application/pdf, reject non-PDF bodies, and add an Open-in-new-tab path so Chrome's viewer is not the only way to see a stored resume. Co-authored-by: Aamogh <aamoghS@users.noreply.github.com>
cursor
Bot
changed the title
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
There are 3 total unresolved issues (including 2 from previous reviews).
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d140df2. Configure here.
| className="w-full h-[70vh] min-h-[420px] rounded-sm border border-[var(--border-subtle)] bg-[var(--bg-secondary)]" | ||
| /> | ||
| )} | ||
| {preview && <ResumePreview src="/api/resume/me" title="Your resume" />} |
There was a problem hiding this comment.
Stale resume preview after replace
Medium Severity
ResumePreview snapshots /api/resume/me into a blob and only refetches when src changes. Replacing a resume while preview is open invalidates metadata (name, size, date) but leaves src unchanged, so the framed blob stays the previous file. The settings UI then shows the new upload next to the old PDF.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit d140df2. Configure here.
1 participant
Automated PR tracking changes from
hotfix-fix-main-review-issues-9d3dintodev.Note
Medium Risk
Relaxes framing/CSP (
SAMEORIGIN,blob:) site-wide via proxy and next.config, and changes resume storage from re-encoded PDFs to originals—preview fixes are solid but header policy shifts warrant a quick smoke test on payments and other embedded frames.Overview
Fixes broken inline resume previews on settings and admin resume book by no longer framing
/api/resumedirectly. A newResumePreviewcomponent fetches the PDF, validates bytes, builds aapplication/pdfblob URL, and loads that in an iframe—with loading and error states plus a fallback “open in new tab” link. Admin and member UIs also get explicit Open links to the resume API.Upload behavior changes: the API still uses pdf-lib to reject unreadable PDFs, but it stores the original file bytes instead of re-saving through pdf-lib (which was shrinking some resumes but corrupting others with forms/fonts).
Security headers are aligned with previews: edge
X-Frame-Optionsmoves from DENY to SAMEORIGIN, and CSP addsblob:toframe-srcand relaxesobject-srcto'self' blob:so Chrome’s PDF viewer works when CSP enforcement is turned on.Reviewed by Cursor Bugbot for commit d140df2. Bugbot is set up for automated code reviews on this repo. Configure here.