apps/registry/pages/api/letter.js (3)

Line range hint 1-32: Add input validation and rate limiting

The API endpoint lacks crucial security measures:

1. No validation for required fields (username, jobDescription, tone)
2. No rate limiting to prevent abuse
3. No maximum length checks for inputs

Consider implementing the following:

+ import rateLimit from 'express-rate-limit';
+ import { z } from 'zod';

+ const limiter = rateLimit({
+   windowMs: 15 * 60 * 1000, // 15 minutes
+   max: 5 // limit each IP to 5 requests per windowMs
+ });

+ const inputSchema = z.object({
+   username: z.string().min(1).max(100),
+   jobDescription: z.string().max(5000),
+   tone: z.string().max(100)
+ });

  export default async function handler(req, res) {
+   try {
+     await limiter(req, res);
+     const validatedInput = inputSchema.parse(req.body);
+     const { username, jobDescription, tone } = validatedInput;

---

Line range hint 3-7: Move sensitive configuration to environment variables

The Supabase URL is hardcoded in the source code. This should be moved to environment variables for better security and configuration management.

- const supabaseUrl = 'https://itxuhvvwryeuzuyihpkp.supabase.co';
+ const supabaseUrl = process.env.SUPABASE_URL;

---

Line range hint 13-62: Improve error handling and add response caching

The current implementation lacks proper error handling for API calls and database operations. Additionally, implementing caching could improve performance for repeated requests.

Consider implementing:

  export default async function handler(req, res) {
+   try {
+     // Add caching check
+     const cacheKey = `letter:${username}:${jobDescription}:${tone}`;
+     const cachedResponse = await redis.get(cacheKey);
+     if (cachedResponse) {
+       return res.status(200).json(JSON.parse(cachedResponse));
+     }

      const { data } = await supabase
        .from('resumes')
        .select()
        .eq('username', username);

+     if (!data || data.length === 0) {
+       return res.status(404).json({ error: 'Resume not found' });
+     }

      // ... rest of the code ...

      const gptRes = await gpt.sendMessage(prompt.join(''));
+     
+     // Cache the response
+     await redis.setex(cacheKey, 3600, JSON.stringify(gptRes.text));
      
      return res.status(200).send(gptRes.text);
+   } catch (error) {
+     console.error('Error generating letter:', error);
+     return res.status(500).json({ error: 'Failed to generate letter' });
+   }
  }

apps/registry/pages/api/suggestions.js (4)

Line range hint 61-65: Improve error handling to prevent information exposure

The current error handling could potentially expose sensitive system information to clients. The error object is returned directly without proper formatting or status code.

Apply this diff to improve error handling:

  try {
    const content = chat.choices[0].message.content;
    return res.status(200).send(content);
  } catch (e) {
    console.error(e);
-   return e;
+   return res.status(500).json({
+     error: 'Failed to generate suggestions',
+     message: process.env.NODE_ENV === 'development' ? e.message : undefined
+   });
  }

---

Line range hint 1-4: Move Supabase URL to environment variables

The Supabase URL should not be hardcoded in the source code. Move it to environment variables for better security and configuration management.

Apply this diff:

-const supabaseUrl = 'https://itxuhvvwryeuzuyihpkp.supabase.co';
+const supabaseUrl = process.env.SUPABASE_URL;

---

Line range hint 10-13: Add input validation and rate limiting

The API endpoint lacks input validation for the username parameter and rate limiting, which could lead to security issues and excessive costs.

Consider:

1. Adding input validation for the username parameter
2. Implementing rate limiting using a middleware like express-rate-limit
3. Adding request size limits

---

Line range hint 15-53: Move prompt template to a separate file

The large prompt template should be moved to a separate file for better maintainability and reusability.

Consider creating a prompts/suggestions.js file and importing the template:

// prompts/suggestions.js
export const getSuggestionsPrompt = (content) => `
  This is a persons resume in the JSON Resume format.
  ${content}
  // ... rest of the prompt
`;

apps/registry/pages/api/suggestions-beta.js (3)

Line range hint 159-164: Improve error handling and status codes.

The current error handling has several issues:

1. Returns 200 status code for errors, which is misleading
2. Generic "it failed" message isn't helpful for debugging
3. Lacks structured error response format

Consider this improvement:

  } catch (e) {
    console.error(e);
-   return res.status(200).send('it failed');
+   return res.status(500).json({
+     error: true,
+     message: 'Failed to process suggestions',
+     details: process.env.NODE_ENV === 'development' ? e.message : undefined
+   });
  }

---

Line range hint 42-43: Add input validation and rate limiting.

The handler accepts user input without proper validation, which could lead to security issues:

1. No validation of username format/length
2. No rate limiting to prevent abuse
3. No validation of brevity/sentiment values

Consider adding these safeguards:

export default async function handler(req, res) {
+ if (!req.body.username || typeof req.body.username !== 'string' || req.body.username.length > 100) {
+   return res.status(400).json({ error: 'Invalid username' });
+ }
+ if (req.body.brevity && !Object.values(BREVITY).includes(req.body.brevity)) {
+   return res.status(400).json({ error: 'Invalid brevity value' });
+ }
  const username = req.body.username || 'thomasdavis';
  const brevity = req.body.brevity || BREVITY.verbose;

---

Line range hint 9-23: Improve code structure and documentation.

The TODO comment indicates several pending improvements. Consider:

1. Moving configuration to a separate file
2. Adding TypeScript or JSDoc types for better maintainability
3. Implementing the suggested schema improvements

Example structure:

// config/suggestions.js
export const SUGGESTION_LEVELS = {
  CRITICAL: 'critical',
  WARNING: 'warning',
  INFO: 'info'
};

export const SUGGESTION_TYPES = {
  SPELLING: 'spelling',
  GRAMMAR: 'grammar',
  // ... other types
};

// types/suggestions.js
/**
 * @typedef {Object} SuggestionConfig
 * @property {string} level - One of SUGGESTION_LEVELS
 * @property {string} type - One of SUGGESTION_TYPES
 * @property {string} sentiment - Suggestion tone
 * @property {string} brevity - Suggestion length
 */

apps/registry/lib/calculations.js (1)

Line range hint 1-234: Consider additional architectural improvements.

While the error handling improvements are good, consider these architectural enhancements:

1. Input Validation: Consider adding a schema validation layer (e.g., using Zod or Joi) to validate the resume object structure at the entry point.
2. Error Logging: Implement structured error logging instead of silently handling invalid data.
3. Type Safety: Consider adding TypeScript for better type safety and developer experience.

apps/registry/scripts/jobs/gpted.js (2)

Line range hint 350-370: Enhance error handling robustness

The current error handling could be improved in several ways:

1. Add specific error types for better debugging
2. Implement retry logic for transient failures
3. Preserve error details in the database

Consider this improved implementation:

       } catch (e) {
         console.error(e);
+        const errorDetails = {
+          error: e.message,
+          timestamp: new Date().toISOString(),
+          type: e.name
+        };
         await supabase
           .from('jobs')
           .update({
-            gpt_content: 'FAILED',
+            gpt_content: 'FAILED',
+            error_details: JSON.stringify(errorDetails),
+            retry_count: (job.retry_count || 0) + 1
           })
           .eq('id', job.id);
+        
+        // Retry with exponential backoff if under max retries
+        if ((job.retry_count || 0) < 3) {
+          await new Promise(resolve => 
+            setTimeout(resolve, Math.pow(2, job.retry_count || 0) * 1000)
+          );
+          continue;
+        }
       }

---

Line range hint 1-400: Consider architectural improvements for better scalability

The current implementation has several areas for improvement:

1. Replace sequential processing with batch processing
2. Implement proper rate limiting
3. Add structured logging
4. Remove debug console.logs

Consider these improvements:

1. Add structured logging:

const winston = require('winston');
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.json(),
  transports: [
    new winston.transports.File({ filename: 'error.log', level: 'error' }),
    new winston.transports.File({ filename: 'combined.log' })
  ]
});

2. Implement batch processing:

async function processBatch(jobs, batchSize = 5) {
  const batches = chunk(jobs, batchSize);
  for (const batch of batches) {
    await Promise.all(batch.map(processJob));
    await rateLimiter.wait(); // Implement proper rate limiting
  }
}

3. Add progress tracking:

const progress = require('cli-progress');
const bar = new progress.SingleBar({}, progress.Presets.shades_classic);

Would you like me to create a separate issue to track these improvements?

Configuration used: CodeRabbit UI
Review profile: CHILL

#!/bin/bash
# Description: Check for consistency in model usage and any related configurations

# Check for other files using ChatGPT models
echo "Checking for model usage across the codebase:"
rg -l "model.*gpt-4" 

# Check for any model-specific configurations or tests
echo "Checking for model-specific configurations:"
rg -l "temperature.*0.85"

#!/bin/bash
# Check the actual model configurations across files
echo "=== Model configuration in letter.js ==="
rg "model.*gpt-4" apps/registry/pages/api/letter.js -A 2 -B 2

echo -e "\n=== Model configuration in suggestions.js ==="
rg "model.*gpt-4" apps/registry/pages/api/suggestions.js -A 2 -B 2

echo -e "\n=== Model configuration in suggestions-beta.js ==="
rg "model.*gpt-4" apps/registry/pages/api/suggestions-beta.js -A 2 -B 2

echo -e "\n=== Model configuration in gpted.js ==="
rg "model.*gpt-4" apps/registry/scripts/jobs/gpted.js -A 2 -B 2

#!/bin/bash
# Search for test cases and usages of totalExperience
rg -A 5 "totalExperience\(" --type js

# Search for any test data with undefined or invalid date ranges
rg -B 5 -A 5 '"work":\s*\[' --type json

#!/bin/bash
# Check the full implementation of totalExperience and related functions
ast-grep --pattern 'export function totalExperience($_) {
  $$$
}'

# Look for test files related to calculations
fd test calculations --exec cat {}

#!/bin/bash
# Look for test files related to calculations
fd test --extension js --extension ts --exec grep -l "calculations\|totalExperience" {} || true

# Check if there are any files that pass undefined or null work entries
rg "work.*\[\s*null|\[\s*undefined|\[\s*\]" --type js -B 2 -A 2