vivekananda0010/Progeni_Atlus

PrepApp — Interview Prep Platform

Working, deployable MVP: auth, DSA (static + AI-generated questions, brute/good/optimal solutions, sandboxed code execution), Aptitude (topic-wise/mixed tests, dual solutions), and a profile/progress page. Build verified clean (npx next build — 0 type errors, 0 compile errors) before handoff.

1. Deploy in ~15 minutes

Step 1 — Supabase (database + auth)

1. 1.Create a project at supabase.com (free tier is enough to start).
2. 2.Open SQL Editor → paste and run supabase/schema.sql.
3. 3.Then paste and run supabase/seed.sql (gives you a few real questions on day one).
4. 4.Authentication → Providers: enable Email, and enable Google if you want Google sign-in (needs a Google OAuth client ID/secret — Supabase's docs walk through this).
5. 5.Authentication → URL Configuration: add your deployed URL (and http://localhost:3000 for local dev) to Redirect URLs.
6. 6.Copy from Project Settings → API: Project URL, anon public key, and service_role secret key.

Step 2 — LLM key

Get an API key from console.anthropic.com. (Question generation still works without this — the static seed bank is always available — but AI-generated questions/solutions need it.)

Step 3 — Deploy to Vercel

1. 1.Push this folder to a GitHub repo.
2. 2.Import it in vercel.com.
3. 3.Add environment variables (copy from .env.example):
4. 4.NEXT_PUBLIC_SUPABASE_URL
5. 5.NEXT_PUBLIC_SUPABASE_ANON_KEY
6. 6.SUPABASE_SERVICE_ROLE_KEY
7. 7.ANTHROPIC_API_KEY
8. 8.Deploy. Done — you have a live URL.

Local development

npm install
cp .env.example .env.local   # fill in real values
npm run dev

2. What's genuinely ready vs. what's next

Ready today:

• —Email + Google auth, protected routes via middleware
• —DSA: static bank, AI generation, three-level solutions, code execution against test cases (via the public Piston API), attempt/submission logging
• —Aptitude: topic-wise/mixed test generation, scoring, per-question correctness
• —Profile: solved count, accuracy, average aptitude score
• —Full RLS on every table — every user can only read/write their own rows; questions/solutions are shared read-only content written only by the server
• —Rate limiting on every LLM-calling endpoint — per-user daily caps (20 question generations, 30 solution generations, 5 AI-assisted test builds), enforced atomically in Postgres so it can't be raced. Tune the numbers in lib/rateLimit.ts once you see real usage/cost.

Deliberately deferred (flagged, not hidden):

• —System Design / SQL / NoSQL / ML / DL / CV / RAG — DB schema already supports these topics (topic enum includes them), UI shows them as "coming soon." Wiring up content generation for each is the same pattern as DSA — copy app/dsa and the two question/solution API routes, change the topic value and prompt.
• —Production code sandbox — currently uses the free public Piston API (rate-limited, fine for early users/testing). Before real traffic, self-host Piston (one docker run, see their repo) and point PISTON_URL at it.
• —RAG / vector DB — not wired up. Needed for the "conceptual Q&A" module; add pgvector to Supabase (it's a one-click extension) when you build that module.
• —AI code review (beyond pass/fail) — the schema has an ai_feedback column on submissions ready for it; not called yet.

3. Security notes

• —SUPABASE_SERVICE_ROLE_KEY bypasses Row Level Security — it's used only in server-side API routes, never sent to the browser. Keep it out of any NEXT_PUBLIC_* variable.
• —User code submissions never execute on your server — they're forwarded to the Piston sandbox API. Your server only sends/receives text.
• —All protected pages check auth server-side (middleware + per-page checks), so there's no client-only gate that could be bypassed by disabling JS.

4. Tech stack

Next.js 14 (App Router, TypeScript) · Supabase (Postgres + Auth) · Anthropic API (question/solution generation) · Piston API (code execution) · Tailwind CSS