Main

[RikepilB]

Summary by CodeRabbit

• New Features

  • Added stricter access checks for resume downloads and previews so only the owning workspace can open stored resumes.

• Bug Fixes

  • Resume requests now return clearer responses when a user is not signed in, lacks access, or the file can’t be found.
  • Resume file serving now runs in the correct server environment and preserves the existing PDF delivery behavior.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
scoutlane	Ready	Preview, Comment	Jun 25, 2026 5:03am

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: c63820a3-5c0e-4576-84fb-51c72c4bafbb

📥 Commits

Reviewing files that changed from the base of the PR and between 7a42262 and 67f14ca.

📒 Files selected for processing (6)

• src/app/api/resumes/[...objectName]/route.test.ts
• src/app/api/resumes/[...objectName]/route.ts
• src/app/api/resumes/preview/[...objectName]/route.ts
• src/lib/resume/access.test.ts
• src/lib/resume/access.ts
• src/lib/storage/upload.test.ts

---

📝 Walkthrough

Walkthrough

The PR adds a shared resume access helper, updates both resume-serving routes to use it, adds route and helper tests, and expands a storage upload test’s Prisma/auth mocks.

Changes

Resume access authorization

Layer / File(s)	Summary
Shared access helper and test mocks src/lib/resume/access.ts, src/lib/resume/access.test.ts, src/lib/storage/upload.test.ts	resumeObjectBelongsToOrg and authorizeResumeRequest add org-scoped resume checks, and the Vitest node mocks cover the new Prisma/auth calls in node tests.
Resume routes use shared authorization src/app/api/resumes/[...objectName]/route.ts, src/app/api/resumes/preview/[...objectName]/route.ts, src/app/api/resumes/[...objectName]/route.test.ts	The download route now runs in Node.js and both resume routes call authorizeResumeRequest before reading or converting stored files; the route test covers 401, 404, and 200 responses.

Sequence Diagram(s)

sequenceDiagram
  participant ResumeRoute as GET /api/resumes/[...objectName]
  participant AuthorizeResumeRequest as authorizeResumeRequest
  participant Auth as auth()
  participant PrismaUserFindUnique as prisma.user.findUnique
  participant ResumeObjectBelongsToOrg as resumeObjectBelongsToOrg
  participant PrismaApplicantFindFirst as prisma.applicant.findFirst
  participant ReadResumeObject as readResumeObject

  ResumeRoute->>AuthorizeResumeRequest: authorizeResumeRequest(storedObjectName)
  AuthorizeResumeRequest->>Auth: auth()
  AuthorizeResumeRequest->>PrismaUserFindUnique: lookup session.user.email
  AuthorizeResumeRequest->>ResumeObjectBelongsToOrg: verify object ownership
  ResumeObjectBelongsToOrg->>PrismaApplicantFindFirst: find matching resumeUrl
  AuthorizeResumeRequest-->>ResumeRoute: ok or error status
  ResumeRoute->>ReadResumeObject: read stored object on success

Loading

Possibly related issues

• Harden the resume-serving API route — require auth + ownership #102: The PR adds the shared resume authorization guard, route wiring, and tests described by the issue.

Poem

Hop, hop — the resume gate is set just right,
I sniff the org tag in the moonlit night.
PDFs stay tucked, previews bloom with grace,
A bunny approves this safer file-space. 🐇

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (1 warning, 1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 60.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check	❓ Inconclusive	The title is too vague and does not convey the change made in this pull request.	Use a concise, specific title that summarizes the main change, such as adding resume access control and route authorization.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch main

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}