[Bug]: saveResume returns HTTP 200 success with a null resume when resumeId is invalid or not owned by the caller

[hariom888]

Bug Description

In saveResume (backend/controllers/resumeController.js), the update branch calls Resume.findOneAndUpdate({ _id: resumeId, user: userId }, { title, latexCode }, { new: true }). If no document matches (wrong ID, deleted resume, or resumeId belonging to another user), this resolves to null, but the handler does not check for that before responding with { success: true, resume: null }.

Steps to Reproduce

1. Authenticate as User A and obtain a valid resumeId belonging to User B (or use a resumeId that no longer exists).
2. POST to /api/resume/save with { title, latexCode, resumeId } using that resumeId while authenticated as User A.
3. Inspect the response.

Expected Behavior

The request should fail with a 404 (or 403) and a clear error message indicating the resume was not found or not owned by the caller — no misleading success response.

Actual Behavior

The endpoint returns HTTP 200 with { success: true, resume: null }. The client displays a save-confirmation even though nothing was persisted or updated, silently discarding the user's edits.

Severity

Medium

Screenshots / Screen Recording

No response

Browser

No response

Operating System

No response

Additional Context

No response

[hariom888]

Technical understanding: findOneAndUpdate returning null for "no matching document" is a normal, expected Mongoose behavior, but the handler treats any non-throwing return value as a success case without checking the doc actually exists — a validation/response-consistency gap rather than a crash.

Affected: backend/controllers/resumeController.js (saveResume).

Proposed fix approach: after the findOneAndUpdate branch, check if (!resume) return res.status(404).json({ success: false, message: "Resume not found or not owned by user" }) before responding. Consider also whether ownership-mismatch should return 403 vs 404 for consistency with other controllers (sessionController uses 401/403 for ownership failures).

Regression/unit tests: POST to /api/resume/save with a resumeId belonging to another user and assert a 404 (not 200 with null resume); assert existing valid-update and new-create paths are unaffected.

Requesting this as a GSSoC'26 assignment.

[palakgoda]

Hi project maintainers,

I am a contributor from the ECSoC '26 cohort and I'd love to claim this issue! The bug description makes total sense, and I can implement the null-check validation in backend/controllers/resumeController.js right away.

Could you please assign this to me? Thank you!