Home

Resume API — Backend Wiki

Node.js/TypeScript REST API for managing candidate CVs/resumes: auth (JWT + i18n), CRUD for 7 CV sections, PDF export, Redis-backed rate limiting/token blacklist, and multi-language resume content.

Version: 1.1.0 · Author: DatVT · License: ISC · Live: nodejs-resume-api-ts.onrender.com

Pages

• Getting Started — clone, env setup, run locally, all npm scripts
• Architecture — project structure, request/middleware flow, module layout
• API Reference — every endpoint, grouped by area
• Authentication — JWT flow, token blacklist, i18n messages
• Data Models — Candidate + 7 CV sections, multi-language content shape
• Security — protections in place, invariants, past incidents and fixes
• Deployment — Render + GitHub Actions pipeline, known gotchas
• Contributing — branch/PR conventions, testing, issue tracker

Tech stack at a glance

Layer	Tech
Runtime	Node.js >=20.19.0 <23.0.0 + TypeScript 5.5 (strict, CommonJS)
Framework	Express 4.19
Database	MongoDB + Mongoose 8.4
Cache / Blacklist	Redis 4.6 (in-memory fallback if unset/unreachable)
Auth	JWT (access + refresh), Bcrypt (12 rounds)
Validation	Joi 17.13
PDF	Puppeteer 22.13 + PDFKit 0.15 + Pug 3.0
Logging	Winston 3.19 + daily-rotate-file
Testing	Jest 29 + ts-jest
i18n	Hand-rolled (Accept-Language, vi default / en opt-in)

What's new in 1.1.0

A full API regression pass (2026-08-21) found and fixed 5 bugs — including a critical broken-access-control (IDOR) vulnerability that let any authenticated user read/write/delete any other candidate's data — plus shipped multi-language resume content and the start of API-message i18n. See Security for the incident writeups and Data Models for the localization shape. Full technical evidence for every change lives in the repo at agent-hub/evidence/.