LeetCode-style DSA problems · An instant online compiler · Frontend sandbox challenges · Live contests · Personalized roadmaps · Spaced-repetition revision · A community forum · Local mock interviews · A real-time streaming AI Mentor — all in one cohesive developer workspace.
Getting Started · Features · Tech Stack · Changelog · Deployment
CodeForge AI is a single Next.js 15 (App Router) application that serves the UI, the API, and background work from one codebase. It follows a layered design — route handlers → service layer → data/integration layer — so that providers (code runners, AI, payments) are swappable behind interfaces and the app degrades gracefully when any optional integration is absent.
graph TD
User(["User Browser"]) -->|HTTPS / SSE| Edge
subgraph Client ["Client (React 19)"]
Editor["Monaco Editor — DSA"]
Sandbox["Sandpack — Frontend"]
AIChat["AI Mentor Panel (streamed)"]
UI["Pages • Zustand • React Query"]
end
User --> Client
Edge["Edge Middleware<br/>auth gate • CORS • security headers"]
Client -->|Server Actions / fetch| Edge
Edge --> Routes["Route Handlers (/api/*)"]
Routes --> Auth["Supabase Auth<br/>Email/Password • Google • GitHub • Passkeys"]
Routes --> Services["Service Layer"]
subgraph Services2 ["Service Layer (src/services)"]
Q["questions / contests / challenges"]
Exec["execution (provider router)"]
AIsvc["ai (Groq prompts + stream)"]
Game["gamification (XP • badges • streaks)"]
Stats["stats / roadmaps / companies"]
end
Services --> Services2
Services2 --> DB[("Supabase Postgres<br/>33 tables · RLS")]
Services2 --> Storage[("Supabase Storage<br/>résumés • covers • avatars")]
Services2 --> Redis[("Upstash Redis<br/>rate-limit • leaderboard cache")]
Exec --> Paiza["Paiza.io (default)"]
Exec --> Judge0["Judge0 CE (RapidAPI)"]
Exec --> Piston["Piston (self-hosted)"]
AIsvc --> Groq["Groq — Llama 3 (streaming)"]
Routes --> Razorpay["Razorpay (subscriptions)"]
Routes --> Mailer["Nodemailer / SMTP"]
Routes --> GH["GitHub Issues (feedback)"]
- Edge middleware (src/middleware.ts) runs first on every request. It validates the Supabase Auth session (
getClaims) against a public-route allowlist, enforces same-origin/CORS on mutating requests, and attaches security headers (CSP, HSTS,X-Frame-Options: DENY). - Route handlers under
src/app/api/*validate input with Zod, resolve the session, and apply rate limiting (Upstash sliding window, with an in-memory fallback) before doing work. - Service layer (
src/services/*) holds the business logic — question/contest queries, the execution-provider router, AI prompt orchestration, gamification, and stats — keeping handlers thin. Each data module reads/writes through abackendFor()flag, a legacy of the MongoDB→Supabase migration that still allows an instant rollback. - Data & integrations — Supabase Postgres persists state (33 tables, row-level security, service-role backend) and Supabase Storage holds uploads; Redis caches hot reads (leaderboards) and rate-limit counters; external providers (Groq, Razorpay, SMTP, GitHub, code runners) are called through small adapter modules in
src/libandsrc/services.
| Layer | Location | Responsibility |
|---|---|---|
| Client | src/app/(platform), src/features, src/components |
React 19 UI, Monaco/Sandpack workspaces, Zustand workspace store, React Query server-state cache |
| Edge | src/middleware.ts, src/lib/supabase/middleware.ts |
Supabase-Auth gating, CORS/origin guard, security headers, cookie policy |
| API | src/app/api/* |
Route handlers: validation (Zod), authz (lib/api-auth), rate-limit, response shaping |
| Services | src/services/* |
Domain logic: questions, contests, execution, AI, gamification, stats, roadmaps + dual-backend stores |
| Integrations | src/lib/* |
supabase/*, storage, webauthn, redis, mailer, github, site-config, rate-limit, openapi |
| Data | supabase/migrations/* (33 Postgres tables, RLS) |
Users, Questions, Submissions, Contests, Discussions, Subscriptions, SpacedRepetition, Badges, WebAuthn credentials, etc. |
sequenceDiagram
participant U as User
participant API as /api/execute
participant R as Execution Router
participant P as Provider (Paiza / Judge0 / Piston)
participant DB as Supabase Postgres
U->>API: source + language + stdin (test cases)
API->>API: Zod validate • auth • rate-limit
API->>R: run(language, source, input)
R->>P: submit job (selected by EXECUTION_PROVIDER)
P-->>R: stdout / stderr / status
R->>R: normalize verdict (AC / WA / TLE / RE)
R-->>API: per-test results
API->>DB: persist Submission (+ XP, streak, badges)
API-->>U: verdict + diff + metrics
The provider is chosen at runtime by EXECUTION_PROVIDER; all providers conform to one interface in src/services/execution, and outputs pass through a normalize step so verdicts are consistent regardless of backend. The standalone Online Compiler at /api/compiler reuses the same provider router — it executes a single program with optional stdin and returns raw stdout/stderr plus runtime and memory, skipping the test-case/verdict step.
The AI panels post the problem, code buffer, and runtime output to streaming routes under /api/ai/*. The ai service composes a system prompt (progressive-hint policy) and forwards to Groq (Llama 3), relaying tokens to the client over Server-Sent Events for real-time rendering. If GROQ_API_KEY is absent, the routes short-circuit and the UI shows inline setup guidance instead of failing.
Every external dependency is optional and isolated, so a missing key degrades one feature rather than breaking the app: no Redis → in-memory rate-limit + on-demand leaderboard from Mongo; no Groq → AI panels show setup help; no Razorpay → billing hidden; no SMTP/GitHub → feedback and emails fall back or no-op; DB unreachable at build → robots.txt/sitemap.xml render dynamically rather than crashing the build.
|
|
|
|
|
|
|
|
|
|
|
|
Accounts, Auth & Settings — Supabase Auth with email/password, Google & GitHub OAuth, and passwordless passkeys (Face ID / Touch ID / security keys). A guided onboarding flow, a working forgot/reset-password flow, and a comprehensive 7-tab Settings hub: Profile (avatar + cover photo with a safe-zone guide), Account (linked methods + change password), Security (passkeys), Appearance (light/dark/system), Editor, Notifications, and Billing.
Docs & Transparency — Browsable OpenAPI/Swagger docs at
/docs, plus first-class Changelog, Pricing, Privacy & Terms pages.
| Layer | Technology / Packages | Purpose |
|---|---|---|
| Framework | Next.js 15.5 (App Router) | Core full-stack web framework (SSG/SSR, Server Actions, API routes) |
| Language | TypeScript 5 (Strict) | Compile-time type safety across client and server |
| State Management | Zustand 5 & React Query 5 | Client-side store & server-state caching/fetching |
| Styling | Tailwind CSS v4 & Framer Motion 12 | Zero-runtime styling, custom themes, and smooth micro-animations |
| Database | Supabase (Postgres) + postgres.js |
Relational store — 33 tables with row-level security; a backendFor() flag keeps a Mongoose/MongoDB path for instant rollback |
| File Storage | Supabase Storage | Résumés, profile avatars and cover photos (served from public buckets) |
| Cache & Rate-Limits | Upstash Redis & Upstash Ratelimit 2 | Leaderboards caching, rate-limiting middleware |
| Authentication | Supabase Auth + @supabase/ssr · Passkeys (@simplewebauthn) · bcryptjs |
Cookie sessions, email/password + Google/GitHub OAuth, passwordless passkey (WebAuthn) sign-in |
| AI Mentoring | Groq SDK (Llama 3) & LangSmith | Real-time streaming AI advice, model prompts, and evaluation/tracing |
| Payments | Razorpay SDK | Subscriptions, billing checkout, and order verification |
| Editor / Sandbox | Monaco Editor, Monaco Vim & Sandpack | DSA code editor (with Vim keys/Emmet) and client-side web sandbox |
| Analytics & Telemetry | PostHog & OpenTelemetry SDK | Product-use analytics, performance tracing, and application logging |
| Form Handling | React Hook Form & Zod | Client/server form validation and input schema sanitization |
| API Documentation | Swagger UI (swagger-ui-dist) |
Interactive OpenAPI/Swagger documentation page at /docs |
| Markdown Rendering | React Markdown, rehype-sanitize & remark-gfm | Safe, sanitized GFM markdown rendering on client |
| UI Components | Radix UI primitives & Sonner | Headless, accessible UI elements and customizable toast notifications |
| Email Delivery | Nodemailer | Transactional emails (password-reset, beta confirmations) |
| Data Viz / Icons | Recharts & Font Awesome SVG | Dynamic analytics dashboards and consistent icon sets |
- Node.js ≥ 18.x
- A Supabase project (the free tier is plenty)
- Redis (optional — falls back to in-memory store)
- Groq API Key (optional — enables AI mentor & tools)
# 1. Install dependencies
npm install
# 2. Configure environment
cp .env.example .env.localSet the required variables in .env.local:
# Database connection
MONGODB_URI="mongodb+srv://..."
# Auth secret — generate with: openssl rand -base64 32
AUTH_SECRET="your-generated-auth-secret"# 3. (optional) Seed starter questions
npm run seed
# 4. Start the dev server
npm run devOpen http://localhost:3000 to preview the app.
- Become an admin — add your email to
ADMIN_EMAILS, then register at/register. - Add questions — in Admin → Questions: Generate with AI, Upload JSON, or run
npm run seed. - Publish — flip the Published switch on questions to make them visible.
- Test run — open a problem at
/problems, pick a language, and Run Code.
Important
Question I/O Contract — Execution runs full programs reading stdin and writing stdout. A test case's input is the raw stdin stream and expected is the raw stdout stream. Keep this consistent when authoring or generating questions.
| Variable | Scope | Status | Purpose / Fallback |
|---|---|---|---|
NEXT_PUBLIC_SUPABASE_URL |
Core | Required | Supabase project URL (client + server). |
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY |
Core | Required | Supabase publishable (anon) key for the browser/SSR client. |
SUPABASE_SERVICE_ROLE_KEY |
Core | Required | Server-only service-role key — the data + storage backend (bypasses RLS). |
SUPABASE_DB_URL |
Core | Optional | Direct Postgres connection for migrations & scripts. |
DATA_BACKEND |
Core | Optional | supabase (default in prod) or mongo (rollback). Per-module: DATA_BACKEND_<MODULE>. |
MONGODB_URI |
Rollback | Optional | Legacy MongoDB, kept for the dual-backend rollback path. |
GROQ_API_KEY |
AI | Optional | Streams hints, explanations & AI tools. Panels show setup help if omitted. |
UPSTASH_REDIS_REST_URL / _TOKEN |
Cache | Optional | Rate-limiting & leaderboards. Falls back to in-memory. |
GOOGLE_CLIENT_ID / _SECRET |
Auth | Optional | Google one-click sign-in. |
GITHUB_CLIENT_ID / _SECRET |
Auth | Optional | GitHub one-click sign-in. |
EXECUTION_PROVIDER |
Execution | Optional | paiza (default), judge0, or piston. |
JUDGE0_API_KEY |
Execution | Optional | Required when EXECUTION_PROVIDER=judge0. |
PISTON_URL |
Execution | Optional | Required when EXECUTION_PROVIDER=piston. |
RAZORPAY_KEY_ID / _SECRET |
Billing | Optional | Subscriptions, trials & the beta Go Plan. |
SMTP_* |
Optional | Beta confirmation & password-reset email. | |
ADMIN_EMAILS |
Admin | Optional | Comma-separated emails auto-promoted to admin on signup. |
A single ExecutionProvider interface wraps multiple backends — switch instantly via EXECUTION_PROVIDER:
- Paiza (default) — zero-config, no API key. Great for local dev.
- Judge0 CE — high-concurrency sandbox via RapidAPI. Needs
JUDGE0_API_KEY. - Piston (self-hosted) — isolated, Dockerized cluster. Needs
PISTON_URL.
- No Groq → AI panels show inline setup help; editor, runs & metrics still work.
- No Redis → in-process cache; rankings computed from Postgres on demand.
- No Razorpay → payments disabled gracefully; free/beta flows still work.
- No OAuth → provider buttons hidden; email/password remains.
npm test # Unit & component tests (Jest)
npm run test:e2e # End-to-end tests (Playwright)
npm run lint # Static analysis (ESLint)
npm run typecheck # Type-check without emittingThe complete, always-current release history lives in-app — currently v3.3.0:
View the Changelog (or /changelog on your deployment)
Every release — new features, improvements and fixes — is documented there with version, date and tags. Recent highlights: the full MongoDB → Supabase migration (Postgres, Auth, Storage), passwordless passkeys, a redesigned auth experience, profile avatar + cover photos, and a 7-tab Settings hub.
Optimized for Vercel out of the box:
- Import your GitHub repository to Vercel.
- Add all required environment variables.
- Deploy — the bundled
vercel.jsonconfigures Serverless Function timeouts for execution and streaming AI routes.
CodeForge AI is founded, designed and built by Nitheesh Rajendran — Founder & Developer — under Setups Works.
Founder of CodeForge AI (codeforgeai.io).
Founder of Setups Works (setups.works).