Fix 45 audit findings across 7 workstreams

[mojoro]

Summary

Addresses 45 of 60 codebase audit findings from docs/audit-findings.md, organized into 7 parallel workstreams executed by isolated agents and merged into a single integration branch.

56 files changed, 974 insertions, 953 deletions (net +21 lines)

Workstream A — HIGH priority (#5-11)

• Job detail: score should populate after analysis without requiring a manual refresh #5 Select only needed jobPool columns, cutting dashboard payload 80-90%
• Job detail: accessibility on job description text color in light mode. Text is too light #6 Replace optimistic application ID with real server ID after save
• Settings: Needs a sign out button #7 Mirror feedStatus: ARCHIVED in Zustand when status becomes APPLIED
• Add onboarding wizard for new user profile setup #8 Revalidate dashboard/pipeline after resume export
• Add landing page #9 Sync Zustand store after job import
• Flow: Sign-in and sign-up now redirect to landing page, should redirect to dashboard or onboarding #10 Wrap usage limit checks in transactions to prevent race conditions; per-job increment in batch analyze
• Fix UX issues and credit exhaustion error handling #11 Restrict CORS to specific Chrome extension ID from env var

Workstream B — Redundancy extraction (#12-18)

• Add manual job import with AI extraction #12+Add animated hero demo preview to landing page #16 New src/lib/usage.ts — shared incrementUsage() + checkUsageLimit() (replaces 9 copies)
• UI overhaul: sidebar nav, feed redesign, pipeline polish #13 New src/lib/auth-helpers.ts — shared requireProfile() + requireProfileWithUsage() (replaces 15+ copies)
• Landing page overhaul: monochrome dark design #14 New src/components/pipeline/use-pipeline-editing.ts — shared hook (~160 duplicated lines removed from each of PipelineTable and KanbanBoard)
• Unify app design system with landing page #15 New src/lib/pipeline-constants.ts — unified TERMINAL_STATUSES (replaces 3 definitions)
• Performance and security overhaul #17 Generalized parseAiJsonResponse<T>() in ai-analysis.ts
• Add Playwright E2E smoke test suite #18 Extracted rematchAndRevalidate() in settings actions

Workstream C — Consistency (#19-26)

• Add client-side data layer with Zustand #19 Standardize on max_completion_tokens
• Add client-side data layer with Zustand #20 Response.json() over NextResponse.json()
• Add Kanban board view to the pipeline and set up playwright in Github Actions #21 Validated env.ADMIN_USER_ID in layout
• Add Vitest unit tests and migrate static checks from Playwright #22 findUnique for PK lookups
• Add usage monitor wheel to sidebar and settings #23 Missing statusUpdatedAt in createApplication
• Add feedback form with rate limiting to settings #24 safeParse() in admin actions
• Add delete account with usage preservation and confirmation #25 updateCustomJob throws instead of returning error objects
• Add advanced AI model settings with OpenRouter presets #26 z.string().cuid() for profileId in analyzeSchema

Workstream D — Performance (#27-33)

• Add USAJobs, Adzuna, and Arbeitnow scrapers #27-28 pg_trgm GIN indexes on job_pool.title and job_pool.location
• Custom job imports pollute the shared pool — need quality gate or isolation #29 NOT EXISTS over NOT IN in match-sql
• Copy personal info and resume when creating a new profile #30 Parallelize Adzuna + USAJobs search configs with Promise.allSettled()
• Audit: remove dead code, consolidate duplicates, clean dependencies #31 Narrow jobPool select in applications query (via jobPoolSummarySelect)
• Wire getModels into AI routes and remove unused scraper params #32 Pre-built Map replaces O(n²) indexOf in virtualizer
• Allow production Clerk domain in Content Security Policy #33 Parallel pool insert chunks in scrape route

Workstream E — Data syncing (#34-39)

• Add Clerk webhook for user email sync and backfill existing users #34 batchSaveJobs now creates Application records
• Auto-remap user accounts by email on production Clerk signup #35 updateJobNotes revalidation
• Eliminate JS matching — all matching now runs in SQL #36 revalidatePath("/dashboard") in match + analyze routes
• Various UX and UI improvements #37 Recalculate followUpCount after followUpAt changes
• Split settings page into Profile and Account tabs and Update seed data and test protocols #38 Correct pendingMatchCount by using capped length
• Install Vercel Web Analytics #39 Sync generation counter discards stale mutation callbacks on profile switch

Workstream F — Security hardening (#40-43)

• Feature Request: AI Job Coach chat bot #40 shortlist-onboarded cookie set server-side with HttpOnly
• bug: syncing issues #41 shortlist-active cookie TTL reduced to 60s with HttpOnly
• feature: Preview full job title when mousing over job in pipeline view #42 Rate limiter cold-start limitation documented
• UX: Allow sorting by job source #43 Profile ownership verification in analyze + match API routes

Workstream G — Cleanup (#44-53, 57-60)

• Feature: Create payment system to increase usage allocation #44 Removed dead rematchProfileSql export
• UX: AI summary should be visible on job drawer from pipeline. #45 URL_RE deduplicated to validations.ts
• UX: link to external job listing should be clickable from pipeline entry #46 New src/lib/html-to-markdown.ts — shared TurndownService
• Feature: Admin panel for easier overview and management of users, feedback, and usage data #47 New src/lib/ai-logging.ts — shared logAiContext() with strict host check (Add Chrome extension for one-click job imports #59)
• Feature: trash bin where jobs will truly be deleted after 30 days #48 New src/lib/score-utils.ts — shared score label helpers
• Add three-tier matching pipeline #50-52 PageProps naming, Metadata types, metadata exports
• Add admin dashboard #53 Webhook deletion error logging
• Stale profile data in dashboard after sign-out and sign-in #60 Dev seed route comment fix

Intentionally skipped

• Sync CLAUDE.md with current repo state #49 Unused enum values (requires schema migration)
• Fix null skills constraint in pool normalizers #54 Feed pagination duplicates (known limitation of cursor + changing sort)
• Add point-and-click content selector to Chrome extension #55 DB constraint on status transitions (needs design discussion)
• Improve job extraction with golden test fixtures #56 Cross-tab sync (feature, not cleanup)
• Dynamic Adzuna searches derived from user profiles #57 getActiveProfile over-fetch (marginal — only 2 callers, deduped by cache())
• Add copy profile to admin account on user detail page #58 Sequential ScrapeRun logging (sequential by design — each depends on prior catch)

Verification

• pnpm tsc --noEmit — zero type errors
• pnpm test:unit — 143/143 tests passing
• pnpm lint — no new errors (11 pre-existing from minified extension file)
• Migration file created for trigram indexes (needs prisma migrate deploy)

Test plan

• Verify dashboard loads correctly with narrow jobPool select
• Test job import → feed updates immediately
• Test resume export → dashboard/pipeline reflect APPLIED/ARCHIVED
• Test batch save → pipeline shows saved jobs
• Test profile switch mid-mutation → no data corruption
• Verify CHROME_EXTENSION_ID env var controls CORS
• Run cron scrape + analyze → dashboard revalidates
• Apply trigram migration and verify match-sql query performance

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
shortlist	Ready	Preview, Comment	Apr 8, 2026 6:05pm