Add auth and ownership checks to cv-process function

[dogussyaman]

Motivation

• Ensure the CV processing endpoint authenticates callers using the Supabase JWT passed in the Authorization header.
• Prevent users from processing CVs that do not belong to them by validating ownership against cvs.developer_id.
• Return appropriate HTTP status codes (401/403) for missing/invalid credentials or forbidden access.

Description

• Read SUPABASE_ANON_KEY from environment and require an Authorization header, returning 401 when missing.
• Create an auth client using createClient(SUPABASE_URL, SUPABASE_ANON_KEY) with the incoming Authorization header and call auth.getUser() to verify the token.
• Extract the authenticated user id and compare it to the CV record's developer_id, returning 403 when they do not match.
• Preserve existing flow for downloading and parsing the CV when authentication and ownership checks pass.

Testing

• No automated tests were run for this change.

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
code-crafters	Ready	Preview, Comment	Feb 4, 2026 10:05am