0.8.0: a resume is public, the way to reach the person is not
A resume is public, the way to reach the person is not
Anyone could read a published resume and take the candidate's email address and phone number out of it. Walking /candidates and following each link produced a mailing list with phone numbers attached, which is not what somebody agreed to by publishing a resume in order to be hired.
Contact channels now need a session or a token. Everything else about the resume stays public, because a candidate directory nobody can read is a candidate directory nobody uses.
What counts as a channel falls out of the parse rather than a list of field names, so it does not go stale as people invent new fields. A contact bullet that produced a link (mailto:, tel:, a profile URL) is a way to reach someone and is withheld. One that did not is a plain fact and stays, so Location: Lisbon and Work Authorization: EU Citizen survive. The directory already prints the location on every card and filtering on it is the point.
Withheld, not silently dropped. The bullets are replaced by - **Contact**: shared with signed-in members, and the JSON carries contactRedacted: true. A caller that cannot tell a redacted document from a resume with no contact details will report the second as the first.
Every representation, because they all render the same Markdown: the page, /api/v1/candidates/:slug, and resume.md, .html, .pdf, .docx. An original uploaded PDF or DOCX cannot be redacted, so an anonymous caller no longer gets those bytes and gets a copy generated from the redacted Markdown instead.
The gate is "signed in", nothing more. A person with a session and an agent with a device token are the same caller, since an agent reading resumes for its owner is the traffic this board exists to serve.
On the version number
v0.7.0 was tagged and published to npm before this work merged, so 0.7.0 names two different builds: the release and the npm package carry the employer decision flow but not the contact gate. 0.8.0 is the first version that has it. If you installed 0.7.0 expecting this, upgrade.
Full changelog: v0.7.0...v0.8.0