[$40] Resume link support token with redirect

[maxceem]

background

We have a page where we are showing Job Candidate resume link https://platform.topcoder-dev.com/taas/myteams/18361/positions/684d1d9b-32b5-4e0c-bb2c-e031db694c75/candidates/to-review

This is some third-party link, when we click it, the download is started.

Though we need to track when user downloads this resume. For this purpose we implemented a special endpoint ${config.API.V5}/jobCandidates/{jobCandidateId}/resume which should be called using user token as all other endpoints. This endpoint would internally track this call and redirect to the real third-party resume URL.

We cannot just replace URL in this link to the ${config.API.V5}/jobCandidates/{jobCandidateId}/resume because we also have to pass JWT token in the header.

Task

We have to update this link so it works like this:

• it should not be a real link so user cannot copy it or open it in a new window
• it should still look like a link, and when we click it it should internally call endpoint ${config.API.V5}/jobCandidates/{jobCandidateId}/resume get the URL where this endpoint redirected and open that URL in a new window.
• NOTE: that this link should be only visible if resume is not null as it's done now
• axios looks like support disabling redirects Fixing #211 axios/axios#307, so the logic could be like this:
  • using axios get URL ${config.API.V5}/jobCandidates/{jobCandidateId}/resume
  • disalbe redirects to avoid downloading of actual resume
  • get the URL where it was redirected to and open in a new tab/window

[maxceem]

Current approach appeared to have some drawbacks, so we have to find a better to handle it in general and implement it a different way in the API too.

browsers always follow redirects (redirects from XHR/fetch requests cannot be prevented). Axios' "maxRedirects" option works only in Node.js. From axios docs:
maxRedirects defines the maximum number of redirects to follow in node.js
As a result the endpoint "/jobCandidates/{jobCandidateId}/resume" seems to be unusable since it both requires a token that must be set in JS (which prevents the use of this endpoint in anchor elements) and does the redirect (which will most probably cause CORS error at the very least).
I ended up creating a PR anyway. #493

[maxceem]

paid via https://www.topcoder.com/challenges/d3268b32-ad9a-486a-90e8-194eb5f326f4

[maxceem]

For now I've merged the current implementation, but we will try come up with a better solution during cool down period. Will track it via #495

[sdgun]

Verified resume downloading in dev and prod.