TexFolio

Prerequisites

• Node.js >= 18
• MongoDB (Local or Atlas)
• Redis (Local or Docker) — Required for BullMQ queues and distributed rate limiting
• LaTeX Distribution (MiKTeX or TeX Live) OR Docker (for containerized pdflatex rendering) — Recommended
• Groq API Key (for AI features)
• Clerk API Keys (for Auth)

TexFolio - AI-Powered LaTeX Resume Builder

Build professional, ATS-friendly resumes in minutes with the power of LaTeX rendering and AI assistance.

Features • Tech Stack • Getting Started • Architecture • API Documentation • RBAC • GDPR • Contributing

</div>

---

🚀 Getting Started

Follow these steps to set up TexFolio locally.

Installation

1. Clone the repository

   git clone https://github.com/theunstopabble/TexFolio.git
   cd TexFolio
   

1. Install Dependencies

   npm install
   

3. Environment Setup Copy .env.example files and fill in your keys:

   cp apps/api/.env.example apps/api/.env
   cp apps/web/.env.example apps/web/.env
   

apps/api/.env

   # Core
   NODE_ENV=development
   PORT=5000
   MONGODB_URI=your_mongodb_connection_string
   REDIS_URL=redis://localhost:6379
   CORS_ORIGIN=http://localhost:5173

   # Auth
   CLERK_SECRET_KEY=your_clerk_secret_key
   CLERK_PUBLISHABLE_KEY=your_clerk_publishable_key

   # AI (at least one required)
   NVIDIA_API_KEY=your_nvidia_nim_key
   GROQ_API_KEY=your_groq_api_key
   GOOGLE_AI_API_KEY=your_google_gemini_key

   # PDF (set to true if using Docker for LaTeX)
   PDFLATEX_PATH=pdflatex
   USE_DOCKER_LATEX=true

   # Payments
   RAZORPAY_KEY_ID=your_razorpay_key_id
   RAZORPAY_KEY_SECRET=your_razorpay_secret
   RAZORPAY_WEBHOOK_SECRET=your_razorpay_webhook_secret

   # Email
   BREVO_API_KEY=your_brevo_api_key
   SENDER_EMAIL=hello@texfolio.app

   # Service-to-Service API Keys (optional but recommended)
   API_KEY_SECRET=your_random_64_char_secret_for_hmac_signing
   

apps/web/.env

   VITE_API_URL=http://localhost:5000/api
   VITE_CLERK_PUBLISHABLE_KEY=your_clerk_publishable_key
   

4. Run the Application Run both frontend and backend concurrently:

   npm run dev
   

• Frontend: http://localhost:5173
• Backend: http://localhost:5000

---

📸 Screenshots

Note: Add your screenshots to a docs/ folder in the root directory.

---

Backend (`apps/api`)

• Server: Hono v4 (Node.js adapter) — Ultra-fast web standard framework with middleware pipeline
• Database: MongoDB (Mongoose) with connection pooling, compound indexes, and multi-document transactions
• AI Engine: LangChain + LangGraph (Resume Coach Agent with 4-stage pipeline)
• LLM Providers: NVIDIA NIM (Primary), Google Gemini, Groq (Fallback chain)
• PDF Engine: pdflatex via Docker container (texfolio-latex) or local MiKTeX, with spawn-based command injection prevention
• Job Queue: BullMQ backed by Redis for async PDF generation with progress tracking, retries, and worker concurrency limits
• Rate Limiting: Distributed fixed-window counters via ioredis (survives restarts, scales horizontally)
• Caching: Redis for session-adjacent data and queue state
• Integrations: Razorpay (Payments), Brevo (Emails), Clerk (Auth)
• Middleware: Request ID propagation, tiered rate limiting, Clerk JWT auth, RBAC role enforcement, API key auth (HMAC), structured logging, CORS, CSP
• CI/CD: GitHub Actions with automated security audits + TypeScript build verification

---

📚 API Documentation

All protected routes strictly require a Clerk Bearer token, unless noted otherwise.

**Resumes API (`/api/resumes`)**

**AI Services (`/api/ai` & `/api/agents`)**

**Organizations API (`/api/organizations`)**

Organization context is resolved via X-Organization-Id header or inferred from route params.

**API Keys (`/api/api-keys`)**

Usage: Include key in X-API-Key header or Authorization: ApiKey <key>. Supported scopes: read:resumes, write:resumes, read:analytics, admin.

**GDPR & Data (`/api/me`)**

**Audit Logs (`/api/audit-logs`)**

**Payments (`/api/payments`)**

Right to Data Portability (`/api/me/export`)

Returns a complete JSON dump containing:

• All personal resumes
• Audit log history
• Organizations owned
• Organization memberships

Right to Erasure (`/api/me/delete`)

• Resumes: Titles, names, emails, phones, locations, and all content sections are replaced with [REDACTED] or [DELETED].
• Organization Memberships: Status changed to pending (effectively revoked).
• Audit Logs: Actor IDs anonymized with [DELETED:<userId>] marker.
• Hard Deletion: A background job (not yet automated) should permanently remove records after a 30-day buffer.

---

PDF Generation Pipeline (Async via BullMQ)

1. Request Arrival: Client requests PDF generation (/api/resumes/:id/pdf).
2. Job Enqueue: Server enqueues a BullMQ job with resumeId, userId, and optional organizationId.
3. Progress Tracking: Client polls /api/resumes/:id/pdf-status for job progress (10% → 30% → 100%).
4. Worker Processing: Dedicated worker fetches resume + org branding (template lock, color, font overrides).
5. Transformation: PDFService escapes LaTeX, applies org branding, and maps to Mustache tags.
6. Compilation: pdflatex (Docker or local) compiles .tex → .pdf with spawn (no exec).
7. Delivery: Worker returns the output path; client receives download URL.

Frontend Organization Integration

App.tsx
  → OrganizationProvider (context)
    → organizationStore (Zustand, persist)
      → Header: OrganizationSwitcher dropdown
      → Dashboard: org context banner + CTA
      → /organizations        → Organizations.tsx    (list, create)
      → /organizations/:id    → OrganizationDetail.tsx (overview, resumes)
      → /organizations/:id/settings → OrganizationSettings.tsx (branding, locked template)
      → /organizations/:id/members  → OrganizationMembers.tsx (invite, roles, remove)
      → API calls → Axios interceptor injects X-Organization-Id header dynamically