fix: validate req.body.code in compileResume middleware (#1622) - #1722
fix: validate req.body.code in compileResume middleware (#1622)#1722suhaniiz wants to merge 3 commits into
Conversation
|
Warning Review limit reached
Next review available in: 14 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughResume validation now uses shared Zod ChangesResume validation
Estimated code review effort: 3 (Moderate) | ~20 minutes Possibly related PRs
Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@backend/Input_validators/ValidateResume.js`:
- Around line 56-59: Update the validation failure path around
analyzeResumeSchema.safeParse to delete any uploaded temporary file before
returning handleValidationError. Reuse the existing upload cleanup mechanism, if
available, and ensure cleanup runs for rejected requests that include a file
without changing the validation response.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 6d4c3b79-4248-4885-8cde-bb421a14722b
📒 Files selected for processing (1)
backend/Input_validators/ValidateResume.js
| .string({ | ||
| required_error: "LaTeX code is required", | ||
| invalid_type_error: "LaTeX code must be a string", | ||
| }) |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🌐 Web query:
Zod 4 migration guide required_error invalid_type_error unified error parameter
💡 Result:
In Zod 4, error customization has been standardized under a single, unified error parameter, replacing the previously fragmented API [1][2]. Key migration points: 1. Unified Error Parameter: The legacy message parameter (often used for simple string overrides) has been deprecated in favor of the error parameter [1][2]. This new parameter accepts an error map function, allowing for consistent error handling across the library [3][4]. 2. Deprecation of Fragmented APIs: Previous approaches to customizing errors—such as passing separate error messages or using inconsistent configuration objects—have been cleaned up to improve cohesion [1][2]. 3. Error Maps: Error customization is now centrally managed through error maps. These functions receive an issue object (iss), which is a discriminated union of all possible issue types, allowing you to handle specific codes like invalid_type or too_small precisely [3][4]. 4. Migration Assistance: An unofficial community-maintained codemod (zod-v3-to-v4) is available to automate many of these breaking changes [1]. Official documentation suggests reading the Zod 4 migration guide thoroughly as it lists changes in order of impact [1][2]. To upgrade to Zod 4, install the latest version: npm install zod@^4.0.0 [5][6] For detailed customization examples, including per-parse and global configurations using the unified error approach, refer to the Zod 4 error customization documentation [3][4].
Citations:
- 1: https://zod.dev/v4/changelog
- 2: https://github.com/colinhacks/zod/blob/c7805073/packages/docs/content/v4/changelog.mdx
- 3: https://zod.dev/error-customization
- 4: https://github.com/colinhacks/zod/blob/v4.4.3/packages/docs/content/error-customization.mdx
- 5: https://zod.dev/v4
- 6: https://github.com/colinhacks/zod/blob/c7805073/packages/docs/content/v4/index.mdx
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- candidate files ---'
git ls-files | grep -E '(^|/)(ValidateResume\.js|package\.json|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)$' || true
printf '%s\n' '--- validator source ---'
file=$(git ls-files | grep 'backend/Input_validators/ValidateResume\.js$' | head -n 1)
if [ -n "${file:-}" ]; then
cat -n "$file"
fi
printf '%s\n' '--- Zod dependency declarations ---'
while IFS= read -r f; do
case "$f" in
*package.json|*package-lock.json|*yarn.lock|*pnpm-lock.yaml)
grep -nE '"zod"|(^|[[:space:]])zod([@[:space:]:]|$)' "$f" || true
;;
esac
done < <(git ls-files | grep -E '(^|/)(package\.json|package-lock\.json|yarn\.lock|pnpm-lock\.yaml)$')
printf '%s\n' '--- validator usages ---'
rg -n --glob '!node_modules' 'ValidateResume|resumeSchema|latexCode|title: z\.string' backend . || trueRepository: Canopus-Labs/PrepPilot
Length of output: 3460
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
import json
from pathlib import Path
for name in ["package.json", "backend/package.json", "frontend/package.json"]:
p = Path(name)
if not p.exists():
continue
data = json.loads(p.read_text())
deps = {}
deps.update(data.get("dependencies", {}))
deps.update(data.get("devDependencies", {}))
print(f"{name}: zod declaration = {deps.get('zod', '<absent>')}")
for name in ["package-lock.json", "backend/package-lock.json", "frontend/package-lock.json"]:
p = Path(name)
if not p.exists():
continue
data = json.loads(p.read_text())
versions = set()
packages = data.get("packages", {})
for key, value in packages.items():
if key.endswith("/node_modules/zod") or key == "node_modules/zod":
if "version" in value:
versions.add(value["version"])
if not versions:
root = data.get("dependencies", {}).get("zod", {})
if root.get("version"):
versions.add(root["version"])
print(f"{name}: locked zod versions = {sorted(versions) or '<absent>'}")
PY
printf '%s\n' '--- all Zod declarations/usages ---'
rg -n --glob '!node_modules' --glob '*package*.json' --glob '*lock*' '"zod"|node_modules/zod' . || trueRepository: Canopus-Labs/PrepPilot
Length of output: 662
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- validation error handling ---'
file=$(git ls-files | grep 'backend/Input_validators/ValidateQuestions\.js$' | head -n 1)
if [ -n "${file:-}" ]; then
cat -n "$file"
fi
printf '%s\n' '--- validation message consumers and tests ---'
rg -n --glob '!node_modules' 'LaTeX code is required|LaTeX code must be a string|Title is required|Title must be a string|required_error|invalid_type_error|validateCompileResume|validateSaveResume|handleValidationError' backend . || true
printf '%s\n' '--- Zod lockfile package metadata ---'
python3 - <<'PY'
import json
from pathlib import Path
p = Path("backend/package-lock.json")
data = json.loads(p.read_text())
for key, value in data.get("packages", {}).items():
if key.endswith("/node_modules/zod"):
print(key, value)
PYRepository: Canopus-Labs/PrepPilot
Length of output: 16477
🌐 Web query:
site:zod.dev/v4/changelog required_error invalid_type_error removed Zod 4
💡 Result:
In Zod 4, the previously used invalid_type_error and required_error parameters have been removed to standardize error customization [1]. These parameters were removed because they were inconsistent, conflicted with errorMap usage, and did not align with Zod's internal issue codes (as there is no native 'required' issue code) [1]. To replace this functionality, Zod 4 introduces a unified error parameter that accepts a function [1]. This function receives the ZodIssue object and allows for logic-based error message customization [1]. For example, to replicate the behavior of a required field error: z.string({ error: (issue) => issue.input === undefined? "This field is required": "Not a string" }); By returning undefined from this function, you can also signal Zod to fall back to the next error map in the chain [1].
Citations:
Replace the removed Zod 4 error options.
Use error customization for code, title, and latexCode. Zod 4 removed required_error and invalid_type_error, so these fields currently use default messages for missing and non-string inputs.
📍 Affects 1 file
backend/Input_validators/ValidateResume.js#L10-L13(this comment)backend/Input_validators/ValidateResume.js#L27-L34
|
@suhaniiz Address the coderabbit suggestions and resolve the merge conflicts |
|
@KaranUnique , resolved |
github-actions
Bot
added
merge ready
|
@suhaniiz, please resolve the commit so that it will be merged soon ...... |
2 participants
📝 Pull Request Description
Related Issue
Closes #1622
Summary
Fixes an issue where
POST /api/resume/compilereturned a500 Internal Server Errorinstead of a400 Bad Requestwhenreq.bodyorreq.body.codewas missing or undefined.Updated the validation middleware to use Zod's
safeParsewith an(req.body || {})fallback, ensuring missing body payloads are caught early and handled gracefully with proper standard 400 validation error responses.Type of Change
How Has This Been Tested?
POSTrequests to/api/resume/compilewith an empty JSON payload{}and confirmed it returns400 Bad Requestwith{"message": "LaTeX code is required"}instead of throwing an unhandledTypeError.{"code": 123}) trigger proper Zod validation error messages.Screenshots (if applicable)
N/A
Checklist
Looks good to me. Ready to merge.