Fix 45 audit findings across 7 workstreams

docs/audit-findings.md

@@ -8,7 +8,8 @@ files, line references, root cause, and fix instructions. A cleared session can
 work through these top-to-bottom.
 
 > **CRITICAL items (1–4) were fixed in PR `fix/critical-security-fixes`.**
-> Start from HIGH (#5) onward.
+> **HIGH items #5 and #6 also fixed** on the same branch.
+> Start from HIGH (#7) onward.
 
 ---
 
@@ -20,6 +21,31 @@ work through these top-to-bottom.
 4. Run `pnpm tsc --noEmit` after each change.
 5. Group related findings into one branch/PR where noted.
 
+### Parallelization Guide
+
+The remaining findings can be split across independent agents/branches:
+
+| Agent | Branch | Findings | Files touched |
+|-------|--------|----------|---------------|
+| **A: Remaining HIGH** | `fix/critical-security-fixes` (continue) | #7–#11 | `store.ts`, `tailor/save/route.ts`, `ImportJobModal.tsx`, `analyze/route.ts`, `tailor/route.ts`, `middleware.ts` |
+| **B: Redundancies** | `refactor/extract-shared-helpers` | #12–#18 | New: `src/lib/usage.ts`, `src/lib/auth-helpers.ts`, `src/components/pipeline/use-pipeline-editing.ts`, `src/lib/pipeline-constants.ts`. Modified: all API routes, server actions, pipeline components |
+| **C: Inconsistencies** | `fix/consistency-cleanup` | #19–#26 | `tailor/route.ts`, `extract/route.ts`, `dashboard/actions.ts`, `pipeline/actions.ts`, `validations.ts`, admin actions, `(dashboard)/layout.tsx` |
+| **D: Performance** | `perf/query-optimization` | #27–#33 | New migration, `match-sql.ts`, `adzuna.ts`, `usajobs.ts`, `actions-sync.ts`, `JobFeed.tsx`, `scrape/route.ts` |
+| **E: Data Syncing** | `fix/sync-gaps` | #34–#39 | `dashboard/actions.ts`, `scrape/route.ts`, `analyze/route.ts`, `match-pipeline.ts`, `store.ts`, `ProfileSwitcher.tsx` |
+| **F: Security** | `fix/security-hardening` | #40–#43 | `OnboardingWizard.tsx`, `middleware.ts`, `rate-limit.ts`, `analyze/route.ts`, `match/route.ts` |
+| **G: Low cleanup** | `chore/opportunistic-cleanup` | #44–#60 | Scattered small changes across many files |
+
+**Conflict zones:** Agents A, B, C, and E all touch `dashboard/actions.ts` and `store.ts`. Run A first, then B+C+D+E+F+G can run in parallel if they each create their own branch. Merge A first, then rebase others.
+
+**Safest parallel split:** D (performance), F (security), and G (cleanup) have minimal overlap with each other and the rest. B (redundancies) and C (inconsistencies) touch many of the same files but different lines.
+
+### Important context for agents
+
+- **`retryServerAction<T>` now returns `T | null`** (not `boolean`). Callers must check `result === null` for failure (not `!result`), because `void` actions return `undefined` on success which is falsy.
+- **`JobWithApplication` type changed.** `jobPool` is now a select subset (no `description`, no `rawData`). The `jobPoolSummarySelect` constant in `src/types/index.ts` defines the selected fields. Any code needing `description` must fetch it separately (see job detail page pattern: server component passes `description` prop).
+- **`ApplicationWithJob` type also changed** — its nested `job.jobPool` uses the same summary select.
+- **Store `partialize`** no longer strips `rawData` manually since the data never arrives from the server.
+
 ---
 
 ## CRITICAL — Fixed in `fix/critical-security-fixes`
@@ -69,57 +95,22 @@ now fail if any client component imports this module.
 
 ### 5. Over-fetching `jobPool.description` + `rawData` on every dashboard load
 
-**Files:** `src/app/(dashboard)/actions-sync.ts:39-48`
-
-**Problem:** `include: { jobPool: true }` fetches ALL columns including
-`description` (5-20KB) and `rawData` (10-50KB) per job. For 200 jobs = 2-10MB
-per page load. This data is never displayed on the dashboard.
-
-**Fix:**
-1. In `fetchDashboardData()`, replace `include: { jobPool: true }` with:
-   ```ts
-   include: {
-     jobPool: {
-       select: {
-         id: true, title: true, company: true, location: true,
-         locationType: true, url: true, source: true, postedAt: true,
-         skills: true, salaryMin: true, salaryMax: true, currency: true,
-         jobType: true, country: true,
-       },
-     },
-     application: { select: { status: true } },
-   }
-   ```
-2. Do the same for the applications query's nested `job.jobPool`.
-3. In `src/lib/store.ts` `partialize` function (~line 594), also strip
-   `description` from persisted jobs (currently only strips `rawData`).
-4. Update the `JobWithApplication` type in `src/types/index.ts` if needed
-   (may need a `JobPoolSummary` type without `description`/`rawData`).
+**Status: FIXED**
 
-**Impact:** Biggest single performance win — reduces dashboard data transfer
-by 80-90%.
+Created `jobPoolSummarySelect` constant in `src/types/index.ts`. Updated
+`fetchDashboardData()`, `getMoreJobs()`, and both type definitions to use
+selective `jobPool` queries excluding `description` and `rawData`. Job detail
+page now receives `description` as a server-component prop. Store `partialize`
+simplified since heavy fields are never fetched.
 
 ### 6. Optimistic application ID never replaced after `toggleSaveJob`
 
-**Files:** `src/lib/store.ts:230,273-274`
-
-**Problem:** Saving a job creates an optimistic application with
-`id: "optimistic-{jobId}"`. The server returns `{ applicationId }` with the
-real DB ID, but the store never swaps it in. If the user immediately opens
-Pipeline and edits that application, server actions fail.
+**Status: FIXED**
 
-**Fix:** In the `toggleSaveJob` store action's `.then()` callback (around line
-273), after the server action succeeds, update the application's ID:
-```ts
-// After successful save, replace optimistic ID with real one
-if (result.applicationId) {
-  set((state) => ({
-    applications: state.applications.map((app) =>
-      app.id === `optimistic-${jobId}` ? { ...app, id: result.applicationId! } : app
-    ),
-  }));
-}
-```
+`retryServerAction` is now generic (`<T>`) returning `T | null` instead of
+`boolean`. The `toggleSaveJob` callback captures the server response and swaps
+`optimistic-{jobId}` with the real `applicationId`. All other store callers
+updated to check `result === null` for failure.
 
 ### 7. `updateAppStatus` doesn't mirror server-side `feedStatus: ARCHIVED`
 

prisma/migrations/20260325000000_add_trgm_indexes/migration.sql

@@ -0,0 +1,8 @@
+-- Enable pg_trgm extension for trigram-based indexing
+CREATE EXTENSION IF NOT EXISTS pg_trgm;
+
+-- Trigram GIN index on job_pool.title for LIKE ANY(...) in match-sql.ts
+CREATE INDEX idx_job_pool_title_trgm ON job_pool USING gin (title gin_trgm_ops);
+
+-- Trigram GIN index on job_pool.location for LIKE ANY(...) in match-sql.ts
+CREATE INDEX idx_job_pool_location_trgm ON job_pool USING gin (location gin_trgm_ops);

src/app/(admin)/actions.ts

@@ -19,39 +19,43 @@ async function requireAdmin() {
 
 export async function adminAdjustUsageLimit(data: unknown) {
   await requireAdmin();
-  const parsed = adminAdjustUsageLimitSchema.parse(data);
+  const parsed = adminAdjustUsageLimitSchema.safeParse(data);
+  if (!parsed.success) throw new Error("Invalid input");
   await prisma.usage.update({
-    where: { userId: parsed.userId },
-    data: { monthlyLimitInputTokens: parsed.monthlyLimitInputTokens },
+    where: { userId: parsed.data.userId },
+    data: { monthlyLimitInputTokens: parsed.data.monthlyLimitInputTokens },
   });
   revalidatePath("/admin/users");
 }
 
 export async function adminDisableUser(data: unknown) {
   await requireAdmin();
-  const { userId } = adminUserIdSchema.parse(data);
+  const parsed = adminUserIdSchema.safeParse(data);
+  if (!parsed.success) throw new Error("Invalid input");
   await prisma.user.update({
-    where: { id: userId },
+    where: { id: parsed.data.userId },
     data: { disabledAt: new Date() },
   });
   revalidatePath("/admin/users");
 }
 
 export async function adminEnableUser(data: unknown) {
   await requireAdmin();
-  const { userId } = adminUserIdSchema.parse(data);
+  const parsed = adminUserIdSchema.safeParse(data);
+  if (!parsed.success) throw new Error("Invalid input");
   await prisma.user.update({
-    where: { id: userId },
+    where: { id: parsed.data.userId },
     data: { disabledAt: null },
   });
   revalidatePath("/admin/users");
 }
 
 export async function adminResetMonthlyUsage(data: unknown) {
   await requireAdmin();
-  const { userId } = adminUserIdSchema.parse(data);
+  const parsed = adminUserIdSchema.safeParse(data);
+  if (!parsed.success) throw new Error("Invalid input");
   await prisma.usage.update({
-    where: { userId },
+    where: { userId: parsed.data.userId },
     data: { currentMonthInputTokens: 0, currentMonthOutputTokens: 0 },
   });
   revalidatePath("/admin/users");
@@ -82,7 +86,9 @@ export async function adminCopyProfileToAdmin(
   data: unknown,
 ): Promise<{ profileId: string; jobsCopied: number; applicationsCopied: number }> {
   const adminUserId = await requireAdmin();
-  const { profileId, mode } = adminCopyProfileSchema.parse(data);
+  const parsed = adminCopyProfileSchema.safeParse(data);
+  if (!parsed.success) throw new Error("Invalid input");
+  const { profileId, mode } = parsed.data;
 
   const sourceProfile = await prisma.profile.findUnique({
     where: { id: profileId },

src/app/(admin)/admin/feedback/page.tsx

@@ -1,8 +1,11 @@
 import Link from "next/link";
 import { formatDistanceToNow } from "date-fns";
+import type { Metadata } from "next";
 
 import { getAdminFeedbackList } from "@/lib/admin-queries";
 
+export const metadata: Metadata = { title: "Feedback" };
+
 type FeedbackMetadata = {
   pathname?: string;
   profileName?: string;

src/app/(admin)/admin/page.tsx

@@ -1,6 +1,9 @@
 import { formatDistanceToNow } from "date-fns";
+import type { Metadata } from "next";
 
 import { AdminStatCard } from "@/components/admin/AdminStatCard";
+
+export const metadata: Metadata = { title: "Admin Overview" };
 import {
   getAdminOverviewStats,
   getRecentScrapeRuns,

src/app/(admin)/admin/users/[userId]/page.tsx

@@ -1,8 +1,11 @@
 import Link from "next/link";
 import { notFound } from "next/navigation";
 import { format, formatDistanceToNow } from "date-fns";
+import type { Metadata } from "next";
 
 import { env } from "@/env";
+
+export const metadata: Metadata = { title: "User Detail" };
 import { getAdminUserDetail } from "@/lib/admin-queries";
 import { AdminStatCard } from "@/components/admin/AdminStatCard";
 import { CopyProfileButton } from "@/components/admin/CopyProfileButton";

src/app/(admin)/admin/users/page.tsx

@@ -1,10 +1,11 @@
 import Link from "next/link";
 import { formatDistanceToNow } from "date-fns";
+import type { Metadata } from "next";
 
 import { getAdminUserList } from "@/lib/admin-queries";
 import { UserSearchBar } from "@/components/admin/UserSearchBar";
 
-export const metadata = { title: "Users" };
+export const metadata: Metadata = { title: "Users" };
 
 export default async function AdminUsersPage({
   searchParams,

src/app/(dashboard)/actions-sync.ts

@@ -4,6 +4,7 @@ import { auth } from "@clerk/nextjs/server";
 import { prisma } from "@/lib/prisma";
 import { getActiveProfile } from "@/lib/get-active-profile";
 import { getFollowUpCount } from "@/app/(dashboard)/pipeline/actions";
+import { jobPoolSummarySelect } from "@/types";
 
 /**
  * Fetches all dashboard data for the authenticated user.
@@ -38,12 +39,17 @@ export async function fetchDashboardData() {
       }),
       prisma.job.findMany({
         where: { profileId: activeProfile.id },
-        include: { jobPool: true, application: { select: { status: true } } },
+        include: {
+          jobPool: { select: jobPoolSummarySelect },
+          application: { select: { status: true } },
+        },
         orderBy: { createdAt: "desc" },
       }),
       prisma.application.findMany({
         where: { profileId: activeProfile.id },
-        include: { job: { include: { jobPool: true } } },
+        include: {
+          job: { include: { jobPool: { select: jobPoolSummarySelect } } },
+        },
         orderBy: { updatedAt: "desc" },
       }),
       getFollowUpCount(userId),