Claude/deploy to railway jn j ez

[daler91]

No description provided.

[gemini-code-assist]

Code Review

This pull request transitions the SBA data conversion tool into a full-stack application by adding a Next.js web interface and a FastAPI worker service. The update includes a Dockerized environment, database-backed job tracking, and enhanced conversion logic. Feedback focuses on improving system robustness and security, specifically by adopting an asynchronous processing model for conversions, implementing email normalization for authentication, and sanitizing file uploads to prevent path traversal. Further suggestions include using stream-based file handling to optimize memory usage and improving error logging across the API routes.

[gemini-code-assist]

This route handler performs a blocking HTTP call to the worker service. Depending on the size of the CSV, the conversion process could exceed the default timeout of the server or the client's connection. Consider making this process asynchronous by returning a 'processing' status immediately and having the worker update the job status via a webhook or shared database state.

[gemini-code-assist]

Email addresses should be normalized (e.g., lowercased) before performing a unique check and before saving to the database to prevent duplicate accounts with different casing (e.g., 'User@Example.com' and 'user@example.com').

    const normalizedEmail = email.toLowerCase();
    const existing = await prisma.user.findUnique({ where: { email: normalizedEmail } });

[gemini-code-assist]

The error is caught but not logged. Swallowing errors without logging makes it difficult to diagnose issues in production. Consider logging the error object before returning the 500 response.

  } catch (error) {
    console.error("Signup error:", error);
    return NextResponse.json(
      { error: "Internal server error" },
      { status: 500 }
    );
  }

[gemini-code-assist]

Using .replace(".csv", ".xml") will only replace the first occurrence of ".csv". If a filename contains multiple occurrences (e.g., data.csv.backup.csv), the result might be incorrect. Use a regular expression with the end-of-string anchor to ensure only the extension is replaced.

Suggested change

	const fileName = job.inputFileName.replace(".csv", ".xml");
	const fileName = job.inputFileName.replace(/\.csv$/i, ".xml");

[gemini-code-assist]

The file.name is used directly in path.join. While it is prefixed by a unique job.id directory, it is still best practice to sanitize the filename to remove any potentially malicious characters or sequences that could interfere with the filesystem.

Suggested change

	const filePath = path.join(uploadDir, file.name);
	const sanitizedFileName = path.basename(file.name).replace(/[^a-zA-Z0-9._-]/g, '_');
	const filePath = path.join(uploadDir, sanitizedFileName);

[gemini-code-assist]

Reading the entire file into memory using file.arrayBuffer() can lead to high memory consumption for large files (e.g., the 50MB limit mentioned in the UI). Consider using a stream-based approach to write the file directly to disk.

[gemini-code-assist]

Email normalization should be applied here as well to ensure users can log in regardless of the casing used during registration or login.

        const user = await prisma.user.findUnique({
          where: { email: (credentials.email as string).toLowerCase() },
        });

[gemini-code-assist]

Returning a default value of "0" on a ValueError or TypeError silently ignores malformed data. It is better to log a warning or return None so the caller can handle the validation failure appropriately.

Suggested change

	except (ValueError, TypeError):
	raise ValueError(f"Invalid percentage value: {value}")
	return "0"
	except (ValueError, TypeError):
	return "0" # Consider logging this as a validation warning