跪拜 Guibai
← All articles
Frontend Framework · Interview · Backend

MiniWho: Open-Source Resume Tool That Cuts the Paywall and Keeps Your Data

By Cosolar ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Resume tools routinely gate PDF export behind subscriptions and keep personal data on their servers. MiniWho eliminates both problems, and its pagination and template security approaches transfer directly to other document-generating web apps.

Summary

MiniWho rethinks the resume tool from the ground up. Content is organized into 18 fixed modules plus up to five custom ones, and templates are just JSON files with theme tokens and constrained CSS. Switching templates never loses content, and every layout shares the same pagination system: breakpoints are calculated on the A4 page and used identically by the on-screen preview, browser print, and server-rendered PDF. The page you see is the page you send.

Privacy is built into the sharing model. Share links use high-entropy random URLs with optional passwords, expiry, and print/download permissions. Fields you hide are stripped server-side, never reaching the visitor's browser. Resume photos go through HMAC-signed short-lived URLs. Diagnostics are rule-based and deterministic, scoring on five dimensions without any external AI. Deployment is a single Docker command with SQLite or MySQL, and the admin backend controls registration, quotas, and more.

The project is Apache 2.0 licensed, with a Vue 3 + Element Plus front end and Java 17 + Spring Boot 3 back end. It runs as one container and includes all templates and a headless Chromium for PDF rendering. For developers who want to host their own resume tool, it's a complete, self-contained solution.

Takeaways
— 36 A4 templates are included, with 30 built-in and community versions from a template center.
— 18 fixed modules plus up to 5 custom modules support drag-and-drop reordering, showing/hiding, and renaming.
— Pagination breakpoints are calculated on the A4 page and shared by screen, browser print, and server PDF output.
— Templates are JSON files containing theme tokens and constrained CSS; no HTML or JavaScript is allowed.
— Server-side PDF rendering uses headless Chrome, caches results for 24 hours, and falls back to browser print if needed.
— Share links are high-entropy random URLs with optional 4-20 digit passwords and 1-365 day expiry, plus print/download toggles.
— Hidden fields are removed at the server, so they never reach the visitor's browser; photos use HMAC-signed short-lived URLs.
— Diagnostics score on five dimensions: completeness (25), job match (25), expression quality (20), quantified results (15), and format (15).
— No external AI is used for diagnostics; results are reproducible across runs.
— Passwords are BCrypt-hashed; email verification uses 6-digit codes with 10-minute validity and single use.
— Account data can be exported as a zip, and account deletion hard-deletes attachments, avatars, and resumes after a grace period.
— The single Docker container runs with SQLite or MySQL 8; the admin backend controls registration, quotas, and site settings.
Conclusions

Rule-based, deterministic scoring gives resume diagnostics reproducibility and privacy, a deliberate contrast to the current AI-everywhere trend.

Limiting templates to constrained CSS with no HTML or JS creates a clean security boundary, letting community templates alter appearance without ever gaining code execution.

Using identical pagination breakpoints across screen, print, and server-rendered PDF is an exactness that most document-generating web apps don't achieve, and it's the core reason the exported PDF matches the preview.

Server-side stripping of hidden fields, rather than client-side hiding, is a privacy pattern that other tools should adopt; it guarantees sensitive data never leaves the server.

Concepts & terms
Template package
In MiniWho, a template package is a JSON file containing theme tokens and a restricted subset of CSS that defines a resume's layout. It can be exported, shared, and imported into any deployment, and since it contains no HTML or JavaScript, it cannot execute code on the importing server.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗