Ryan/Reactive-Resume
1
0
Fork 0
mirror of https://github.com/AmruthPillai/Reactive-Resume.git synced 2026-07-13 22:37:14 +10:00
Code Issues Packages Projects Releases Wiki Activity

fix(api): allow empty name in public resume output schema (#3012)

Browse Source 
The redactResumeForViewer helper intentionally blanks the dashboard
title for non-owner viewers (the title can leak owner-only context like
"Senior Eng @ Foo - final draft"), but the getBySlug output schema
inherits name.min(1) from resumeSchema. Zod rejects the redacted
payload, oRPC throws Output validation failed, and every public resume
URL returns HTTP 500.

Relax the constraint to z.string() on the getBySlug output only -
ownership-gated procedures (getById, update, patch, list, ...) keep
min(1).

Fixes #3011

Co-authored-by: Amruth Pillai <im.amruth@gmail.com>
This commit is contained in:
Donovan Watts
2026-05-09 10:49:43 -06:00
committed by GitHub
parent fa38f3e84a
commit fabe22089d
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/api/src/dto/resume.ts
+7 -1
View File
@@ -39,7 +39,13 @@ export const resumeDto = {
getBySlug: {
input: z.object({ username: z.string(), slug: z.string() }),
output: resumeSchema.omit({ password: true, userId: true, createdAt: true, updatedAt: true }),
// `name` is the owner-chosen dashboard title and is intentionally redacted
// to an empty string for non-owner viewers (see redactResumeForViewer in
// helpers/resume-access-policy.ts). Relax the `min(1)` constraint here so
// the redacted public response passes output validation.
output: resumeSchema
.omit({ name: true, password: true, userId: true, createdAt: true, updatedAt: true })
.extend({ name: z.string() }),
},
create: {