How codeforgeai-io/codeforge-ai works
Purpose and Runtime
CodeForge AI is a single full-stack coding-interview preparation platform: problem solving, code execution, frontend challenges, AI mentoring, contests, learning plans, community, billing, and administration. It runs as a Next.js 15 App Router application with React 19 and TypeScript, deployable to Vercel.
• Entrypoints: src/app/layout.tsx, src/app/page.tsx, src/middleware.ts
• Public, authenticated platform, and admin route surfaces are separated under src/app/, notably src/app/(platform)/layout.tsx and src/app/admin/layout.tsx.
Request Boundary, Auth, and API
Middleware is the first security boundary: session gating, public-route access, origin/CORS checks for mutations, and security headers. Route handlers implement the HTTP API; handlers should remain orchestration layers over schemas, auth/rate-limit utilities, and services.
• src/middleware.ts
• src/app/api/auth/me/route.ts
• src/lib/api-auth.ts
• src/lib/rate-limit.ts
Auth is Supabase-based with email/password, OAuth, and WebAuthn passkeys. Auth callback and passkey flows are explicit API endpoints.
• src/lib/supabase/server.ts
• src/lib/webauthn.ts
• src/app/api/auth/passkey/register/verify/route.ts
Product UI and Client State
The App Router pages compose feature modules into three major experiences: public marketing/content, the authenticated learning workspace, and back-office administration. Shared providers and navigation establish application-wide client concerns; workspace-local state uses Zustand.
• src/app/(platform)/dashboard/page.tsx
• src/components/providers.tsx
• src/features/workspace/workspace.tsx
• src/store/workspace.ts
Domain Services and Persistence
Business logic resides in src/services, decoupling API/UI from persistence and provider implementations. Supabase Postgres is the primary data system, modeled by SQL migrations and TypeScript models; Supabase Storage handles user and career uploads. data-backend preserves a module-selectable Mongo rollback path.
• src/services/questions.ts
• src/services/submissions.ts
• src/lib/data-backend.ts
• supabase/migrations/0001_init_core.sql
• src/models/User.ts
Core persisted domains include users/profiles, questions, submissions/progress, contests, discussions, subscriptions, AI usage, and spaced repetition.
Coding Execution Pipeline
DSA workspace and standalone compiler submit source, language, and stdin to server APIs. The execution service selects Paiza, Judge0, or self-hosted Piston at runtime, normalizes results, and lets submission flows persist outcomes and gamification effects.
• src/app/api/execute/route.ts
• src/app/api/compiler/route.ts
• src/services/execution/index.ts
• src/services/execution/normalize.ts
• src/services/execution/paiza.ts
This is an important external-trust boundary: code never executes in the Next.js process; it is delegated to configured execution providers.
AI, Learning, and Engagement Flows
AI routes accept workspace/tool context and delegate prompt orchestration and streaming model access to the AI service. Usage/credits and feature access constrain paid or metered capabilities. Learning outcomes feed analytics, weakness detection, revision, badges, and activity tracking.
• src/app/api/ai/chat/route.ts
• src/services/ai/groq.ts
• src/services/ai-credits.ts
• src/services/gamification/index.ts
• src/services/roadmaps.ts
Groq is the primary LLM integration; missing credentials should disable only AI capabilities.
Commerce, Operations, and External Infrastructure
Razorpay subscription handlers manage order, verification, cancellation, and webhooks; billing state is stored behind dedicated services. Admin pages and APIs operate content, users, submissions, prompts, campaigns, and reporting. Redis/Upstash supports rate limiting and hot leaderboard caching, with fallback behavior. PostHog and OpenTelemetry provide product analytics and observability.
• src/app/api/subscription/webhook/route.ts
• src/lib/razorpay.ts
• src/services/billing-store.ts
• src/app/api/admin/analytics/route.ts
• src/lib/redis.ts
• src/instrumentation.ts
Main entry points: route.ts API route handlers · data-backend.ts Data backend selector · layout.tsx App entrypoints · middleware.ts Security middleware
Components 21
Next.js Runtime
- App entrypoints · Root layout and public entry surface.
src/app/layout.tsx - Security middleware · Gates sessions, mutations, origins, and headers.
src/middleware.ts - API route handlers · Routes delegate auth, validation, and domain work.
src/app/api/auth/me/route.ts
Product Experiences
- Learning workspace · Platform layout and dashboard experience.
src/app/(platform)/layout.tsx - DSA workspace
src/features/workspace/workspace.tsx - Workspace state
src/store/workspace.ts - Admin operations · Content, users, reporting, and operations.
src/app/admin/layout.tsx
Domain Services
- Supabase auth · Email, OAuth, and passkey authentication.
src/lib/supabase/server.ts - API auth & rate limits
src/lib/api-auth.ts - Execution service · Selects and normalizes remote execution providers.
src/services/execution/index.ts - AI service · Streams contextual mentoring and tool responses.
src/services/ai/groq.ts - Learning & engagement · Roadmaps, gamification, revision, and progress outcomes.
src/services/gamification/index.ts - Billing service
src/services/billing-store.ts
Data & Infrastructure
- Data backend selector · Supports Supabase primary storage and Mongo rollback.
src/lib/data-backend.ts - Supabase Postgres · Core product domains and billing state.
supabase/migrations/0001_init_core.sql - Supabase Storage · User and career uploads.
- Redis / Upstash · Caches leaderboards with fallback behavior.
src/lib/redis.ts - Analytics & telemetry · PostHog product analytics and OpenTelemetry instrumentation.
src/instrumentation.ts
External Providers
- Execution providers · Paiza, Judge0, or self-hosted Piston execute untrusted code.
src/services/execution/paiza.ts - Groq · AI is disabled without credentials.
- Razorpay
src/lib/razorpay.ts
Connections 24
- App entrypoints → Security middleware: incoming requests
- Security middleware → Learning workspace: authorized pages
- Security middleware → API route handlers: protected API
- App entrypoints → Admin operations: admin routes
- Learning workspace → DSA workspace: composes
- DSA workspace → Workspace state: local state
- API route handlers → API auth & rate limits: auth and limits
- API auth & rate limits → Supabase auth: validates session
- API route handlers → Execution service: execute and compile
- Execution service → Execution providers: delegates untrusted code
- API route handlers → AI service: AI chat
- AI service → Groq: streams model access
- API route handlers → Billing service: subscription webhooks
- Billing service → Razorpay: orders and verification
- API route handlers → Learning & engagement: learning outcomes
- Learning workspace → Data backend selector: reads product data
- Learning & engagement → Data backend selector: persists progress
- Billing service → Data backend selector: persists billing state
- Data backend selector → Supabase Postgres: primary persistence
- Data backend selector → Supabase Storage: uploads
- API auth & rate limits → Redis / Upstash: rate-limit counters
- Learning & engagement → Redis / Upstash: leaderboard cache
- App entrypoints → Analytics & telemetry: instrumented runtime
- Admin operations → API route handlers: admin APIs