Test coderabbit 2

.claude/settings.local.json

@@ -1,6 +1,31 @@
 {
+  "permissions": {
+    "allow": [
+      "Bash(npm run:*)",
+      "Bash(mkdir:*)",
+      "Bash(curl:*)",
+      "Bash(git add:*)",
+      "Bash(git commit:*)",
+      "Bash(grep:*)",
+      "Bash(find:*)",
+      "Bash(NEXT_TELEMETRY_DISABLED=1 npm run build)",
+      "Bash(vercel:*)",
+      "Bash(git log:*)",
+      "Read(//tmp/**)",
+      "WebSearch",
+      "Bash(node:*)",
+      "Bash(npx tsc:*)",
+      "mcp__playwright__browser_navigate",
+      "mcp__playwright__browser_wait_for",
+      "mcp__playwright__browser_console_messages",
+      "mcp__playwright__browser_click",
+      "Bash(git push:*)",
+      "mcp__playwright__browser_close",
+      "Bash(npx ts-node:*)"
+    ]
+  },
+  "enableAllProjectMcpServers": true,
   "enabledMcpjsonServers": [
     "context7"
-  ],
-  "enableAllProjectMcpServers": true
+  ]
 }

.coderabbit.yaml

@@ -0,0 +1,133 @@
+# yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json
+language: "en-US"
+early_access: false
+enable_free_tier: true
+
+# Review Settings
+reviews:
+  profile: "assertive"  # More thorough reviews for production code
+  request_changes_workflow: true
+  high_level_summary: true
+  poem: false  # No poems needed for professional reviews
+  review_status: true
+  collapse_walkthrough: true
+
+  # Path-specific instructions for your project structure
+  path_instructions:
+    - path: "src/components/**"
+      instructions: |
+        - Ensure all components use shadcn/ui components, never raw HTML elements
+        - Verify proper TypeScript types and interfaces
+        - Check for proper React hook dependencies
+        - Ensure components follow the educator-v2 patterns when applicable
+
+    - path: "src/app/api/**"
+      instructions: |
+        - Verify authentication and authorization checks
+        - Ensure proper error handling with try-catch blocks
+        - Check for SQL injection prevention with parameterized queries
+        - Verify no console.log statements, only logger utility usage
+        - Check for proper database connection handling
+
+    - path: "src/lib/**"
+      instructions: |
+        - Ensure logger utility is used instead of console statements
+        - Check for performance optimizations
+        - Verify proper error handling
+        - Check for proper TypeScript typing
+
+    - path: "src/app/(educator)/**"
+      instructions: |
+        - Ensure amber theme colors are used (never blue/purple)
+        - Verify educator-v2 components are used
+        - Check TabNavigation component is used for tabs
+        - Ensure proper loading and empty states
+
+    - path: "scripts/**"
+      instructions: |
+        - Verify environment variables are loaded with dotenv
+        - Check for proper database connection handling
+        - Ensure destructive operations have confirmation prompts
+        - Verify proper error handling and logging
+
+# Auto Review Settings
+auto_review:
+  enabled: true
+  drafts: false  # Don't review draft PRs
+
+# Chat Settings
+chat:
+  auto_reply: true
+
+# Knowledge Base
+knowledge_base:
+  learnings:
+    scope: auto
+  issues:
+    scope: auto
+
+# Tools Configuration
+tools:
+  eslint:
+    enabled: true
+  prettier:
+    enabled: true
+  typescript:
+    enabled: true
+  biome:
+    enabled: false  # Using ESLint/Prettier instead
+
+# Custom Instructions
+tone_instructions: |
+  You are reviewing code for a Next.js 14 TypeScript project with these critical requirements:
+
+  Performance:
+  - MUST use logger utility from @/lib/logger instead of console.log/error/warn
+  - Check for proper performance optimizations, especially in timezone operations
+
+  UI Standards:
+  - MUST use shadcn/ui components, NEVER raw HTML form elements
+  - Educator pages MUST use amber colors and educator-v2 components
+  - MUST use TabNavigation component for tabs in educator panels
+
+  Security:
+  - Check for SQL injection prevention with parameterized queries
+  - Verify no hardcoded credentials or secrets
+  - Ensure proper authentication checks in API routes
+  - Check for XSS vulnerabilities in user input handling
+
+  Database:
+  - Verify POSTGRES_URL is used from environment variables
+  - Check for proper connection handling and cleanup
+  - Ensure snake_case is used in raw SQL, camelCase in Drizzle ORM
+
+  TypeScript:
+  - Ensure proper type definitions, avoid 'any' type
+  - Check for proper React hook dependencies
+  - Verify Next.js App Router patterns are followed
+
+  LightRAG Integration:
+  - Verify correct usage of track_id vs document_id
+  - Check proper status checking flow for document processing
+
+# Ignored Patterns
+ignored_titles:
+  - "WIP"
+  - "DO NOT REVIEW"
+  - "[skip-review]"
+  - "[skip review]"
+  - "Debug:"
+
+ignored_branches:
+  - "experimental/*"
+  - "temp/*"
+  - "test/*"
+
+# File patterns to ignore
+ignored_paths:
+  - "*.min.js"
+  - "*.min.css"
+  - "node_modules/**"
+  - ".next/**"
+  - "dist/**"
+  - "build/**"

.env.example

@@ -0,0 +1,124 @@
+# ============================================
+# PRODUCTION ENVIRONMENT VARIABLES
+# ============================================
+# Copy this file to .env.local and fill in your values
+# For Vercel deployment, add these in your Vercel dashboard
+
+# ============================================
+# DATABASE (Required)
+# ============================================
+# PostgreSQL connection string (use Neon, Supabase, or any PostgreSQL provider)
+POSTGRES_URL=
+
+# ============================================
+# AUTHENTICATION (Required)
+# ============================================
+# Generate using: openssl rand -base64 32
+BETTER_AUTH_SECRET=
+
+# ============================================
+# GOOGLE OAUTH (Required for social login)
+# ============================================
+# Get from Google Cloud Console: https://console.cloud.google.com
+GOOGLE_CLIENT_ID=
+GOOGLE_CLIENT_SECRET=
+
+# ============================================
+# AI INTEGRATION (Required for quiz generation)
+# ============================================
+# OpenAI API Key from https://platform.openai.com
+OPENAI_API_KEY=
+OPENAI_MODEL=gpt-4o-mini
+
+# Optional - for vector search
+OPENAI_EMBEDDING_MODEL=text-embedding-3-large
+
+# ============================================
+# LIGHTRAG API (Required for document processing)
+# ============================================
+LIGHTRAG_API_URL=
+LIGHTRAG_API_KEY=
+
+# ============================================
+# QUIZ GENERATION WEBHOOK (Required)
+# ============================================
+QUIZ_GENERATION_WEBHOOK_URL=
+
+# ============================================
+# EMAIL CONFIGURATION (Required for notifications)
+# ============================================
+# SMTP Settings
+# For Gmail: Use app-specific password from https://myaccount.google.com/apppasswords
+# For other providers: Use their SMTP settings
+SMTP_HOST=smtp.gmail.com
+SMTP_PORT=587
+SMTP_SECURE=false
+SMTP_USER=
+SMTP_PASS=
+EMAIL_FROM="YourApp <[email protected]>"
+
+# ============================================
+# APPLICATION BRANDING (Required)
+# ============================================
+# App name and branding used in emails and UI
+NEXT_PUBLIC_APP_NAME="Your App"
+NEXT_PUBLIC_APP_TAGLINE="Your Biblical Knowledge Quest"
+NEXT_PUBLIC_SUPPORT_EMAIL="[email protected]"
+
+# ============================================
+# ADMIN CONFIGURATION (Required)
+# ============================================
+# IMPORTANT: Change these in production!
+# Use strong, unique passwords and keys
+# Consider using a password manager to generate these
+[email protected]
+[email protected]
+# For development: Use plain text password
+SUPER_ADMIN_PASSWORD=ChangeThisStrongPassword123!
+# For production: Use bcrypt hash generated by scripts/generate-admin-password-hash.js
+# SUPER_ADMIN_PASSWORD_HASH=$2a$12$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+SUPER_ADMIN_SECRET_KEY=generate-a-random-32-character-string-here
+SUPER_ADMIN_2FA_ENABLED=false
+
+# ============================================
+# APPLICATION SETTINGS (Required)
+# ============================================
+# Your production URL (update after Vercel deployment)
+NEXT_PUBLIC_APP_URL=https://your-app.vercel.app
+
+# ============================================
+# RATE LIMITING (Optional but recommended)
+# ============================================
+# Upstash Redis for rate limiting (get from https://upstash.com)
+# Without these, in-memory rate limiting will be used (resets on restart)
+UPSTASH_REDIS_REST_URL=
+UPSTASH_REDIS_REST_TOKEN=
+
+# ============================================
+# DEVELOPMENT ONLY - NEVER USE IN PRODUCTION
+# ============================================
+# WARNING: Setting this to 'true' bypasses authentication
+# This should NEVER be enabled in production environments
+# NEXT_PUBLIC_DISABLE_AUTH=false
+
+# ============================================
+# FILE STORAGE (Optional)
+# ============================================
+# Vercel Blob storage token (if using file uploads)
+BLOB_READ_WRITE_TOKEN=
+
+# ============================================
+# MONITORING (Optional but recommended)
+# ============================================
+# Add your monitoring service keys here
+# SENTRY_DSN=
+# LOGFLARE_API_KEY=
+
+# ============================================
+# NOTES
+# ============================================
+# 1. Never commit your actual .env file to version control
+# 2. Use different values for development and production
+# 3. Rotate keys and passwords regularly
+# 4. Use Vercel's environment variables dashboard for production
+# 5. Enable 2FA for super admin in production (SUPER_ADMIN_2FA_ENABLED=true)

.eslintrc.json

@@ -0,0 +1,10 @@
+{
+  "extends": ["next/core-web-vitals", "next/typescript"],
+  "rules": {
+    "@typescript-eslint/no-explicit-any": "warn",
+    "@typescript-eslint/no-unused-vars": ["warn", { 
+      "argsIgnorePattern": "^_",
+      "varsIgnorePattern": "^_"
+    }]
+  }
+}

.gitignore

@@ -32,11 +32,62 @@ yarn-error.log*
 .pnpm-debug.log*
 
 # env files (can opt-in for committing if needed)
-.env*
+.env
+.env.local
+.env.production
+.env.development
+# Keep .env.example for documentation
+!.env.example
 
 # vercel
 .vercel
 
 # typescript
 *.tsbuildinfo
 next-env.d.ts
+
+# Test scripts - for local development only
+scripts/tests/
+# Keep the README for documentation
+!scripts/README.md
+!../scripts/README.md
+
+# Test files that may contain credentials
+test-*.js
+test-*.ts
+*test*.js
+*test*.ts
+
+# Database dumps and backups
+*.sql.bak
+*.db.bak
+backup/
+dumps/
+
+# Log files that might contain sensitive data
+logs/
+*.log
+
+# IDE and editor files that might store sensitive data
+.vscode/settings.json
+.idea/
+*.swp
+*.swo
+
+# OS generated files
+Thumbs.db
+.DS_Store?
+._*
+
+# Temporary files
+temp/
+tmp/
+*.tmp
+
+# Phase 1 Backup Archives
+scripts_backup_phase1_complete_*.tar.gz
+docs_backup_phase1_complete_*.tar.gz
+
+# Organized backup and log directories
+backups/
+logs/