Upload 26 files

Dockerfile

@@ -0,0 +1,11 @@
+FROM python:3.11
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+# Hugging face runs on port 7860 by default
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "7860"]

config/database.py

@@ -0,0 +1,16 @@
+from supabase import create_client, Client
+from config.settings import get_settings
+
+settings = get_settings()
+
+def get_supabase() -> Client:
+    return create_client(
+        settings.supabase_url,
+        settings.supabase_anon_key
+    )
+
+def get_supabase_admin() -> Client:
+    return create_client(
+        settings.supabase_url,
+        settings.supabase_service_key
+    )

config/settings.py

@@ -0,0 +1,35 @@
+from pydantic_settings import BaseSettings
+from functools import lru_cache
+
+class Settings(BaseSettings):
+    supabase_url: str = ""
+    supabase_anon_key: str = ""
+    supabase_service_key: str = ""
+    jwt_secret: str = ""
+    admin_secret_url: str = ""
+    frontend_url: str = ""
+    environment: str = "development"
+    gemini_api_key: str = ""
+    groq_api_key: str = ""
+    openrouter_api_key: str = ""
+    openrouter_model: str = "openrouter/free"
+    huggingface_api_token: str = ""
+    huggingface_free_models: list[str] = [
+        "meta-llama/Llama-3.2-3B-Instruct",
+        "Qwen/Qwen2.5-7B-Instruct",
+        "mistralai/Mistral-7B-Instruct-v0.3",
+        "google/gemma-2-9b-it"
+    ]
+    resend_api_key: str = ""
+    piston_api_url: str = "https://emkc.org/api/v2/piston"
+    jdoodle_client_id: str = ""
+    jdoodle_client_secret: str = ""
+    admin_emails: list[str] = ["farhanahmad4709@gmail.com"]
+
+    class Config:
+        env_file = ".env"
+        case_sensitive = False
+
+@lru_cache()
+def get_settings():
+    return Settings()

main.py

@@ -0,0 +1,37 @@
+from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
+from config.settings import get_settings
+from routers import auth, analyze, challenges, user, support, share, admin
+
+settings = get_settings()
+
+app = FastAPI(title="CodeNexus API", version="1.0.0")
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[
+        settings.frontend_url,
+        "http://localhost:3000",
+        "https://codenexus-ea4.pages.dev",
+        "https://codenexus.qzz.io",
+    ],
+    allow_credentials=True,
+    allow_methods=["GET", "POST", "PATCH", "PUT", "DELETE", "OPTIONS"],
+    allow_headers=["Content-Type", "Authorization", "X-Admin-Secret"],
+)
+
+app.include_router(auth.router)
+app.include_router(analyze.router)
+app.include_router(challenges.router)
+app.include_router(user.router)
+app.include_router(support.router)
+app.include_router(share.router)
+app.include_router(admin.router)
+
+@app.get("/")
+def root():
+    return {"status": "CodeNexus API is running"}
+
+@app.get("/health")
+def health():
+    return {"status": "healthy"}

middleware/admin_guard.py

@@ -0,0 +1,39 @@
+from fastapi import Request, HTTPException
+from middleware.auth_guard import get_current_user
+from config.database import get_supabase_admin
+
+
+async def get_admin_user(request: Request):
+    """
+    Verifies user is authenticated AND has admin role.
+    Also verifies the secret admin prefix from the URL matches the one in DB.
+    """
+    # 1. Verify User Role
+    user = await get_current_user(request)
+    admin_client = get_supabase_admin()
+    
+    try:
+        profile = admin_client.table("users").select("role").eq("id", str(user.id)).single().execute()
+        if not profile.data or profile.data.get("role") != "admin":
+            raise HTTPException(status_code=403, detail="Admin access required")
+    except Exception:
+        raise HTTPException(status_code=403, detail="Admin access required")
+
+    # 2. Verify Secret URL Segment (X-Admin-Secret header or similar)
+    # To avoid changing all routes to {secret}, we'll check it from DB.
+    # The Admin Panel will send the current secret in the X-Admin-Secret header.
+    
+    provided_secret = request.headers.get("X-Admin-Secret")
+    
+    # Fallback to hardcoded if DB call fails or is empty for bootstrapping
+    # But ideally it should be in DB.
+    settings_res = admin_client.table("site_settings").select("value").eq("key", "admin_secret_url").single().execute()
+    db_secret = settings_res.data.get("value") if settings_res.data else "cn-admin-nc-0947"
+    
+    if provided_secret != db_secret:
+        # We also allow the secret to be part of the path if we use the old prefix
+        # for backward compatibility during transition.
+        if "cn-admin-nc-0947" not in request.url.path and provided_secret != db_secret:
+            raise HTTPException(status_code=403, detail="Invalid admin secret")
+
+    return user

middleware/auth_guard.py

@@ -0,0 +1,58 @@
+from fastapi import Request, HTTPException
+from config.database import get_supabase_admin
+
+
+async def get_current_user(request: Request):
+    """
+    Check for token in two places:
+    1. httpOnly cookie 'access_token' (email/password login)
+    2. Authorization: Bearer header (GitHub/Google OAuth)
+    """
+    token = request.cookies.get("access_token")
+
+    if not token:
+        auth_header = request.headers.get("Authorization", "")
+        if auth_header.startswith("Bearer "):
+            token = auth_header[7:]
+
+    if not token:
+        raise HTTPException(status_code=401, detail="Not authenticated")
+
+    try:
+        admin_client = get_supabase_admin()
+        user_response = admin_client.auth.get_user(token)
+        if not user_response or not user_response.user:
+            raise HTTPException(status_code=401, detail="Invalid or expired session")
+        
+        user = user_response.user
+        
+        # New: Automatically ensure user exists in public table
+        from services.user_sync import ensure_user_exists
+        await ensure_user_exists(user)
+        
+        # New: Fetch role from public.users table
+        from config.settings import get_settings
+        settings = get_settings()
+        
+        profile = admin_client.table("users").select("role").eq("id", str(user.id)).single().execute()
+        
+        # Force admin role for configured emails (Case-Insensitive)
+        admin_list = [e.lower() for e in settings.admin_emails]
+        user_role = "admin" if user.email.lower() in admin_list else (profile.data.get("role", "").lower() if profile.data else "free")
+        
+        # Attach role to the user object (patch it)
+        user.role = user_role
+        
+        return user
+    except HTTPException:
+        raise
+    except Exception:
+        raise HTTPException(status_code=401, detail="Invalid or expired session")
+
+
+async def get_current_user_optional(request: Request):
+    """Returns user if logged in, None if not. Never raises."""
+    try:
+        return await get_current_user(request)
+    except HTTPException:
+        return None

middleware/rate_limit.py

@@ -0,0 +1,39 @@
+from fastapi import Request, HTTPException
+from datetime import datetime, timedelta
+from collections import defaultdict
+import asyncio
+
+# In-memory store: {key: [timestamp, ...]}
+_request_log: dict = defaultdict(list)
+_lock = asyncio.Lock()
+
+LIMITS = {
+    "guest":  {"analyze": 3,  "run": 10, "challenge": 2},
+    "free":   {"analyze": 15, "run": 50, "challenge": 10},
+    "pro":    {"analyze": 999, "run": 999, "challenge": 999},
+    "admin":  {"analyze": 999, "run": 999, "challenge": 999},
+}
+
+
+async def check_rate_limit(request: Request, action: str, user=None, role: str = "guest"):
+    """Check if user/IP has exceeded their daily limit for a given action."""
+    if role in ("admin", "pro"):
+        return  # Unlimited
+
+    identifier = str(user.id) if user else request.client.host
+    key = f"{identifier}:{action}"
+    now = datetime.utcnow()
+    window_start = now - timedelta(hours=24)
+
+    async with _lock:
+        # Remove entries older than 24h
+        _request_log[key] = [t for t in _request_log[key] if t > window_start]
+        count = len(_request_log[key])
+        limit = LIMITS.get(role, LIMITS["guest"]).get(action, 5)
+
+        if count >= limit:
+            raise HTTPException(
+                status_code=429,
+                detail=f"Daily limit of {limit} {action}s reached. Upgrade to Pro for unlimited access."
+            )
+        _request_log[key].append(now)

models/analysis.py

@@ -0,0 +1,18 @@
+from pydantic import BaseModel
+from typing import Optional, List
+
+class RunRequest(BaseModel):
+    language: str
+    version: str = ""
+    code: str
+
+class AnalyzeRequest(BaseModel):
+    language: str
+    code: str
+
+class AnalysisResult(BaseModel):
+    time_complexity: str
+    space_complexity: str
+    issues: List[str]
+    suggestions: List[str]
+    optimized_code: str

models/challenge.py

@@ -0,0 +1,22 @@
+from pydantic import BaseModel
+from typing import Optional, List, Dict, Any
+
+class ChallengeSubmit(BaseModel):
+    language: Optional[str] = None
+    code: Optional[str] = None
+    selected_option: Optional[int] = None
+    selected_options: Optional[List[int]] = None
+
+class ChallengeCreate(BaseModel):
+    title: str
+    description: str
+    difficulty: str = "easy"
+    category: str = "arrays"
+    type: str = "coding"
+    options: List[str] = []
+    correct_option: Optional[int] = None
+    questions: Optional[List[Dict[str, Any]]] = []
+    company_tag: str = ""
+    is_interview_question: bool = False
+    starter_code: Dict[str, str] = {}
+    test_cases: List[Dict[str, Any]] = []

models/support.py

@@ -0,0 +1,11 @@
+from pydantic import BaseModel, EmailStr
+from typing import Optional
+
+class SupportTicket(BaseModel):
+    user_email: EmailStr
+    category: str
+    message: str
+    screenshot_url: Optional[str] = None
+
+class TicketReply(BaseModel):
+    reply: str

models/user.py

@@ -0,0 +1,6 @@
+from pydantic import BaseModel
+from typing import Optional
+
+class ProfileUpdate(BaseModel):
+    display_name: Optional[str] = None
+    theme: Optional[str] = None

routers/admin.py

@@ -0,0 +1,183 @@
+from fastapi import APIRouter, HTTPException, Request
+from config.database import get_supabase_admin
+from middleware.admin_guard import get_admin_user
+from services.email import send_ticket_reply_to_user
+
+router = APIRouter(prefix="/api/cn-admin-nc-0947", tags=["admin"])
+
+
+@router.get("/stats")
+async def get_stats(request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    users     = db.table("users").select("id", count="exact").execute()
+    analyses  = db.table("analyses").select("id", count="exact").execute()
+    tickets   = db.table("support_tickets").select("id", count="exact").eq("status", "open").execute()
+    subs      = db.table("challenge_submissions").select("id", count="exact").execute()
+    return {
+        "total_users":       users.count or 0,
+        "total_analyses":    analyses.count or 0,
+        "open_tickets":      tickets.count or 0,
+        "total_submissions": subs.count or 0,
+    }
+
+
+@router.get("/users")
+async def get_users(request: Request, page: int = 1):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    offset = (page - 1) * 50
+    result = db.table("users").select("*").order("created_at", desc=True).range(offset, offset + 49).execute()
+    return result.data or []
+
+
+@router.patch("/users/{user_id}/ban")
+async def ban_user(user_id: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("users").update({"is_banned": body.get("is_banned", True)}).eq("id", user_id).execute()
+    return {"message": "User ban status updated"}
+
+
+@router.patch("/users/{user_id}/role")
+async def change_role(user_id: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("users").update({"role": body.get("role", "free")}).eq("id", user_id).execute()
+    return {"message": "Role updated"}
+
+
+@router.delete("/users/{user_id}")
+async def delete_user(user_id: str, request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    db.table("analyses").delete().eq("user_id", user_id).execute()
+    db.table("challenge_submissions").delete().eq("user_id", user_id).execute()
+    db.table("users").delete().eq("id", user_id).execute()
+    try:
+        db.auth.admin.delete_user(user_id)
+    except Exception:
+        pass
+    return {"message": "User deleted"}
+
+
+@router.post("/challenges")
+async def create_challenge(request: Request):
+    user = await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    body["created_by"] = str(user.id)
+    body.setdefault("status", "published")
+    body.setdefault("starter_code", {})
+    body.setdefault("test_cases", [])
+    result = db.table("challenges").insert(body).execute()
+    return result.data[0] if result.data else {}
+
+
+@router.patch("/challenges/{challenge_id}")
+async def update_challenge(challenge_id: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("challenges").update(body).eq("id", challenge_id).execute()
+    return {"message": "Challenge updated"}
+
+
+@router.delete("/challenges/{challenge_id}")
+async def delete_challenge(challenge_id: str, request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    db.table("challenges").delete().eq("id", challenge_id).execute()
+    return {"message": "Challenge deleted"}
+
+
+@router.get("/tickets")
+async def get_tickets(request: Request, status: str = ""):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    query = db.table("support_tickets").select("*").order("created_at", desc=True)
+    if status:
+        query = query.eq("status", status)
+    return query.execute().data or []
+
+
+@router.patch("/tickets/{ticket_id}/reply")
+async def reply_ticket(ticket_id: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    reply = body.get("reply", "")
+    db = get_supabase_admin()
+    ticket = db.table("support_tickets").select("*").eq("id", ticket_id).single().execute()
+    if not ticket.data:
+        raise HTTPException(status_code=404, detail="Ticket not found")
+    db.table("support_tickets").update({"admin_reply": reply, "status": "resolved"}).eq("id", ticket_id).execute()
+    try:
+        await send_ticket_reply_to_user(ticket.data["user_email"], reply)
+    except Exception:
+        pass
+    return {"message": "Reply sent"}
+
+
+@router.post("/blog")
+async def create_blog_post(request: Request):
+    user = await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    body["author_id"] = str(user.id)
+    body.setdefault("status", "draft")
+    result = db.table("blog_posts").insert(body).execute()
+    return result.data[0] if result.data else {}
+
+
+@router.patch("/blog/{post_id}")
+async def update_blog_post(post_id: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("blog_posts").update(body).eq("id", post_id).execute()
+    return {"message": "Post updated"}
+
+
+@router.delete("/blog/{post_id}")
+async def delete_blog_post(post_id: str, request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    db.table("blog_posts").delete().eq("id", post_id).execute()
+    return {"message": "Post deleted"}
+
+
+@router.post("/announcements")
+async def create_announcement(request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("announcements").update({"is_active": False}).eq("is_active", True).execute()
+    result = db.table("announcements").insert({"message": body.get("message"), "is_active": True}).execute()
+    return result.data[0] if result.data else {}
+
+
+@router.get("/security-logs")
+async def get_security_logs(request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    result = db.table("security_logs").select("*").order("created_at", desc=True).limit(200).execute()
+    return result.data or []
+
+
+@router.get("/settings")
+async def get_site_settings(request: Request):
+    await get_admin_user(request)
+    db = get_supabase_admin()
+    result = db.table("site_settings").select("*").execute()
+    return result.data or []
+
+
+@router.patch("/settings/{key}")
+async def update_site_setting(key: str, request: Request):
+    await get_admin_user(request)
+    body = await request.json()
+    db = get_supabase_admin()
+    db.table("site_settings").update({"value": body.get("value")}).eq("key", key).execute()
+    return {"message": f"Setting {key} updated"}

routers/analyze.py

@@ -0,0 +1,156 @@
+from fastapi import APIRouter, HTTPException, Request
+from pydantic import BaseModel
+import httpx
+import logging
+from config.settings import get_settings
+from services.ai_router import route_analysis
+from services.quotas import check_quota, check_guest_quota
+
+logger = logging.getLogger(__name__)
+
+router = APIRouter(prefix="/api/analyze", tags=["analyze"])
+settings = get_settings()
+
+JDOODLE_LANGUAGE_MAP = {
+    "python": {"language": "python3", "versionIndex": "4"},
+    "javascript": {"language": "nodejs", "versionIndex": "4"},
+    "typescript": {"language": "typescript", "versionIndex": "1"},
+    "java": {"language": "java", "versionIndex": "4"},
+    "c++": {"language": "cpp17", "versionIndex": "1"},
+    "c": {"language": "c", "versionIndex": "5"},
+    "go": {"language": "go", "versionIndex": "4"},
+    "rust": {"language": "rust", "versionIndex": "4"},
+    "ruby": {"language": "ruby", "versionIndex": "4"},
+    "php": {"language": "php", "versionIndex": "4"},
+}
+
+class RunRequest(BaseModel):
+    language: str
+    version: str
+    code: str
+    stdin: str = ""
+
+class AnalyzeRequest(BaseModel):
+    model_config = {"protected_namespaces": ()}
+    language: str
+    code: str
+    model_choice: str = "auto"
+
+@router.get("/config")
+async def get_ai_config():
+    from services.settings import is_ai_enabled
+    return {"ai_features_enabled": is_ai_enabled()}
+
+@router.post("/run")
+async def run_code(data: RunRequest):
+    try:
+        lang_config = JDOODLE_LANGUAGE_MAP.get(data.language.lower())
+        if not lang_config:
+            raise HTTPException(status_code=400, detail=f"Language {data.language} not supported")
+        async with httpx.AsyncClient(timeout=30.0) as client:
+            response = await client.post(
+                "https://api.jdoodle.com/v1/execute",
+                json={
+                    "clientId": settings.jdoodle_client_id,
+                    "clientSecret": settings.jdoodle_client_secret,
+                    "script": data.code,
+                    "stdin": data.stdin,
+                    "language": lang_config["language"],
+                    "versionIndex": lang_config["versionIndex"],
+                }
+            )
+            result = response.json()
+            output = result.get("output", "No output")
+            return {"output": output}
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Analysis failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="AI analysis failed. Please try again later.")
+
+@router.post("/analyze")
+async def analyze_code(data: AnalyzeRequest, request: Request):
+    from services.settings import is_ai_enabled
+    from middleware.auth_guard import get_current_user_optional, get_current_user
+    
+    if not is_ai_enabled():
+        raise HTTPException(status_code=403, detail="AI analysis features are currently disabled by the administrator.")
+
+    try:
+        # Get user
+        user = await get_current_user_optional(request)
+        
+        # 1. Tier Enforcement
+        # Free Tier (4 Models + Auto): 'auto', 'gemma-4-31b', 'llama-3.1', 'qwen-2.5', 'nemotron-120b'
+        # Pro Tier (4 Elite Models): 'minimax-2.5', 'mistral-large', 'groq-70b', 'gemini-flash'
+        effective_model = data.model_choice
+        user_role = user.role if user else "guest"
+        
+        free_models = ["auto", "gemma-4-31b", "llama-3.1", "qwen-2.5", "nemotron-120b"]
+        
+        if user_role != "pro" and data.model_choice not in free_models:
+            logger.info(f"User {user.id if user else 'guest'} requested {data.model_choice} but is not Pro. Defaulting to auto.")
+            effective_model = "auto"
+
+        # 2. Quota Check
+        if user:
+            await check_quota(str(user.id), "analysis")
+        else:
+            await check_guest_quota(request.client.host, "analysis")
+
+        prompt = f"""[CRITICAL: ELITE SYSTEMS ARCHITECT PERSONA]
+Analyze this {data.language} code with the precision of a Lead Performance Engineer.
+
+CODE TO ANALYZE:
+{data.code}
+
+RETURN ONLY THIS JSON STRUCTURE:
+{{
+  "time_complexity": "string (Big O)",
+  "time_explanation": "Elite technical insight (e.g. 'Constant time access via hash map—Excellent speed.')",
+  "space_complexity": "string (Big O)",
+  "space_explanation": "Elite technical insight (e.g. 'Minimal auxiliary space—Optimal memory footprint.')",
+  "issues": ["list of sharp technical issues"],
+  "suggestions": ["list of architectural improvements - MINIMUM 3"],
+  "optimized_code": "string (the superior solution)",
+  "optimized_time_complexity": "string (Big O of optimized version)",
+  "optimized_time_explanation": "Technical optimization insight",
+  "optimized_space_complexity": "string (Big O of optimized version)",
+  "optimized_space_explanation": "Memory optimization insight"
+}}
+[NOTE: Return valid JSON only. If the code is already optimally written, structure/format it securely into standard format for `optimized_code`, and return the same complexities.]"""
+
+        # Using the robust AI router with Smart Recovery Failover
+        result_with_meta = await route_analysis(prompt, model_choice=effective_model)
+        
+        # Extract the actual model used from the metadata
+        actual_model = result_with_meta.get("_actual_model", effective_model)
+        
+        # Remove internal metadata before returning to frontend
+        parsed = {k: v for k, v in result_with_meta.items() if not k.startswith("_")}
+
+        # Save to DB if logged in
+        if user:
+            try:
+                from config.database import get_supabase_admin
+                admin_client = get_supabase_admin()
+                admin_client.table("analyses").insert({
+                    "user_id": str(user.id),
+                    "language": data.language,
+                    "code": data.code,
+                    "ai_result": parsed,
+                    "time_complexity": parsed.get("time_complexity", ""),
+                    "space_complexity": parsed.get("space_complexity", ""),
+                    "model_used": actual_model # Use the ACTUAL model that responded
+                }).execute()
+                logger.info(f"Analysis saved for user {user.id} (Actual model: {actual_model})")
+            except Exception as save_err:
+                logger.error(f"Failed to save analysis to DB for user {user.id}: {save_err}")
+
+        # Return result with actual model name so frontend can know
+        return {**parsed, "actual_model_used": actual_model}
+    except HTTPException:
+        raise
+    except Exception as e:
+        logger.error(f"Analysis process failed: {str(e)}")
+        raise HTTPException(status_code=500, detail="AI analysis failed. Please try again later.")

routers/auth.py

@@ -0,0 +1,108 @@
+from fastapi import APIRouter, HTTPException, Response, Request
+from pydantic import BaseModel, EmailStr
+from config.database import get_supabase, get_supabase_admin
+from config.settings import get_settings
+
+router = APIRouter(prefix="/api/auth", tags=["auth"])
+settings = get_settings()
+
+class RegisterRequest(BaseModel):
+    email: EmailStr
+    password: str
+    display_name: str = ""
+
+class LoginRequest(BaseModel):
+    email: EmailStr
+    password: str
+
+@router.post("/register")
+async def register(data: RegisterRequest):
+    supabase = get_supabase()
+    try:
+        response = supabase.auth.sign_up({
+            "email": data.email,
+            "password": data.password,
+            "options": {
+                "data": {
+                    "full_name": data.display_name or data.email.split("@")[0]
+                }
+            }
+        })
+        if response.user is None:
+            raise HTTPException(status_code=400, detail="Registration failed")
+        
+        # Sync to public users table
+        admin_db = get_supabase_admin()
+        admin_db.table("users").insert({
+            "id": response.user.id,
+            "email": data.email,
+            "display_name": data.display_name or data.email.split("@")[0],
+            "role": "free"
+        }).execute()
+
+        return {"message": "Registration successful. Please check your email to verify your account."}
+    except Exception as e:
+        error_msg = str(e)
+        if "23505" in error_msg or "users_pkey" in error_msg:
+            raise HTTPException(status_code=400, detail="An account with this email already exists.")
+        
+        # Hide raw database dictionary strings if they slip through
+        if error_msg.startswith("{") and "'code'" in error_msg:
+            import ast
+            try:
+                err_dict = ast.literal_eval(error_msg)
+                if isinstance(err_dict, dict) and "message" in err_dict:
+                    # Still, we might not want to expose raw DB messages, but it's better than the dict
+                    raise HTTPException(status_code=400, detail=err_dict["message"])
+            except (ValueError, SyntaxError):
+                pass
+            raise HTTPException(status_code=400, detail="An error occurred during registration.")
+
+        raise HTTPException(status_code=400, detail=error_msg)
+
+@router.post("/login")
+async def login(data: LoginRequest, response: Response):
+    supabase = get_supabase()
+    try:
+        auth_response = supabase.auth.sign_in_with_password({
+            "email": data.email,
+            "password": data.password
+        })
+        if auth_response.user is None:
+            raise HTTPException(status_code=401, detail="Invalid email or password")
+
+        response.set_cookie(
+            key="access_token",
+            value=auth_response.session.access_token,
+            httponly=True,
+            secure=True,
+            samesite="lax",
+            max_age=604800
+        )
+        return {
+            "message": "Login successful",
+            "user": {
+                "id": str(auth_response.user.id),
+                "email": auth_response.user.email,
+                "display_name": auth_response.user.user_metadata.get("full_name", "")
+            }
+        }
+    except Exception as e:
+        raise HTTPException(status_code=401, detail="Invalid email or password")
+
+@router.post("/logout")
+async def logout(response: Response):
+    response.delete_cookie("access_token")
+    return {"message": "Logged out successfully"}
+
+@router.post("/forgot-password")
+async def forgot_password(email: EmailStr):
+    supabase = get_supabase()
+    try:
+        supabase.auth.reset_password_email(
+            email,
+            options={"redirect_to": f"{settings.frontend_url}/auth/reset-password"}
+        )
+        return {"message": "Password reset email sent"}
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))

routers/challenges.py

@@ -0,0 +1,248 @@
+from fastapi import APIRouter, HTTPException, Request, Depends
+from config.database import get_supabase_admin
+from middleware.auth_guard import get_current_user, get_current_user_optional
+from models.challenge import ChallengeSubmit
+from services.ai_router import route_analysis
+from services.code_runner import run_code
+
+router = APIRouter(prefix="/api/challenges", tags=["challenges"])
+
+
+@router.get("/all")
+async def get_challenges(difficulty: str = "", category: str = "", company: str = ""):
+    db = get_supabase_admin()
+    query = db.table("challenges").select("*").eq("status", "published")
+    if difficulty:
+        query = query.eq("difficulty", difficulty)
+    if category:
+        query = query.eq("category", category)
+    if company:
+        query = query.eq("company_tag", company)
+    result = query.order("created_at", desc=True).execute()
+    return result.data or []
+
+
+@router.get("/interview")
+async def get_interview_questions(company: str = ""):
+    db = get_supabase_admin()
+    query = db.table("challenges").select("*").eq("status", "published").eq("is_interview_question", True)
+    if company:
+        query = query.eq("company_tag", company)
+    result = query.execute()
+    return result.data or []
+
+
+@router.get("/{challenge_id}")
+async def get_challenge(challenge_id: str):
+    db = get_supabase_admin()
+    result = db.table("challenges").select("*").eq("id", challenge_id).eq("status", "published").single().execute()
+    if not result.data:
+        raise HTTPException(status_code=404, detail="Challenge not found")
+    return result.data
+
+
+@router.post("/{challenge_id}/submit")
+async def submit_challenge(challenge_id: str, data: ChallengeSubmit, request: Request):
+    user = await get_current_user_optional(request)
+    db = get_supabase_admin()
+
+    # Get challenge
+    ch = db.table("challenges").select("*").eq("id", challenge_id).single().execute()
+    if not ch.data:
+        raise HTTPException(status_code=404, detail="Challenge not found")
+    challenge = ch.data
+
+    # Scenario 1: MCQ Challenge (Quiz or Single)
+    if challenge.get('type') == 'mcq':
+        questions = challenge.get('questions', [])
+        
+        # Multi-question Quiz Logic
+        if questions and len(questions) > 0:
+            if data.selected_options is None or len(data.selected_options) != len(questions):
+                raise HTTPException(status_code=400, detail=f"selected_options array is required and must match questions length ({len(questions)})")
+            
+            results = []
+            correct_count = 0
+            for i, q in enumerate(questions):
+                sel = data.selected_options[i]
+                # Flexible key for backward compatibility or different bulk upload formats
+                cor = q.get('correct_index')
+                if cor is None:
+                    cor = q.get('correct_option', 0)
+                
+                is_correct = sel == cor
+                if is_correct:
+                    correct_count += 1
+                
+                results.append({
+                    "question_index": i,
+                    "selected": sel,
+                    "correct": cor,
+                    "passed": is_correct,
+                    "explanation": q.get('explanation', "No explanation provided.")
+                })
+            
+            score = round((correct_count / len(questions)) * 100, 2)
+            passed = correct_count == len(questions)
+            
+            ai_feedback = {
+                "feedback": f"You scored {correct_count}/{len(questions)} ({score}%). " + 
+                           ("Perfect! You've mastered this topic." if passed else "Good effort! Review the explanations below to improve."),
+                "quiz_results": results,
+                "score": score,
+                "time_complexity": "N/A",
+                "space_complexity": "N/A",
+            }
+            
+            if user:
+                try:
+                    # Final sanity check on fields
+                    insert_data = {
+                        "user_id": str(user.id),
+                        "challenge_id": challenge_id,
+                        "challenge_type": "mcq",
+                        "passed": passed,
+                        "ai_feedback": ai_feedback or {},
+                        "metadata": {
+                            "score": score, 
+                            "selected_options": data.selected_options,
+                            "quiz_length": len(questions)
+                        }
+                    }
+                    db.table("challenge_submissions").insert(insert_data).execute()
+                except Exception as db_err:
+                    import logging
+                    logger = logging.getLogger(__name__)
+                    logger.error(f"Failed to save MCQ submission: {str(db_err)}")
+
+            return {
+                "passed": passed,
+                "score": score,
+                "ai_feedback": ai_feedback,
+            }
+
+        # Single Question MCQ Logic (Backward compatibility)
+        if data.selected_option is None:
+            raise HTTPException(status_code=400, detail="selected_option is required for single-question MCQ")
+        
+        correct_idx = challenge.get('correct_option', 0)
+        passed = data.selected_option == correct_idx
+        
+        ai_feedback = {
+            "feedback": "Correct! You have a good understanding of this concept." if passed else "Incorrect. Review the concept and try again.",
+            "correct_approach": f"The correct answer is option index {correct_idx}.",
+            "time_complexity": "N/A",
+            "space_complexity": "N/A",
+            "improvements": []
+        }
+        
+        if user:
+            try:
+                db.table("challenge_submissions").insert({
+                    "user_id": str(user.id),
+                    "challenge_id": challenge_id,
+                    "challenge_type": "mcq",
+                    "selected_option": data.selected_option,
+                    "passed": passed,
+                    "ai_feedback": ai_feedback,
+                    "metadata": {"score": 100 if passed else 0}
+                }).execute()
+            except Exception as db_err:
+                import logging
+                logger = logging.getLogger(__name__)
+                logger.error(f"Failed to save Single MCQ submission: {str(db_err)}")
+
+        return {
+            "passed": passed,
+            "correct_option": correct_idx,
+            "ai_feedback": ai_feedback,
+        }
+
+    # Scenario 2: Coding Challenge
+    if not data.code:
+        raise HTTPException(status_code=400, detail="code is required for coding challenges")
+
+    try:
+        output = await run_code(data.language, data.code)
+    except Exception as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+    # Check test cases
+    test_cases = challenge.get("test_cases", [])
+    passed = True
+    test_results = []
+    for tc in test_cases:
+        expected = str(tc.get("output", "")).strip()
+        actual = output.strip()
+        ok = expected in actual
+        test_results.append({"input": tc.get("input"), "expected": expected, "actual": actual, "passed": ok})
+        if not ok:
+            passed = False
+
+    # Get AI feedback
+    from services.settings import is_ai_enabled
+    if is_ai_enabled():
+        prompt = f"""A user submitted this {data.language} code for a coding challenge.
+Challenge: {challenge.get('title')}
+Description: {challenge.get('description')}
+Code:
+{data.code}
+Output: {output}
+Tests passed: {passed}
+
+Respond in JSON only:
+{{
+  "feedback": "2-3 sentence explanation of their solution quality",
+  "correct_approach": "brief explanation of the optimal approach",
+  "time_complexity": "O(?)",
+  "space_complexity": "O(?)",
+  "improvements": ["improvement 1", "improvement 2"]
+}}"""
+
+        try:
+            ai_feedback = await route_analysis(prompt)
+        except Exception:
+            ai_feedback = {"feedback": "Good attempt! Keep practicing.", "correct_approach": "", "improvements": []}
+    else:
+        ai_feedback = {
+            "feedback": "Submission processed. Detailed AI analysis is currently disabled by administrator.",
+            "correct_approach": "AI analysis is required to generate the optimal approach.",
+            "time_complexity": "N/A",
+            "space_complexity": "N/A",
+            "improvements": []
+        }
+
+    # Save submission if logged in
+    if user:
+        try:
+            db.table("challenge_submissions").insert({
+                "user_id": str(user.id),
+                "challenge_id": challenge_id,
+                "challenge_type": "coding",
+                "code": data.code,
+                "language": data.language,
+                "passed": passed,
+                "ai_feedback": ai_feedback,
+            }).execute()
+        except Exception:
+            pass
+
+    return {
+        "passed": passed,
+        "output": output,
+        "test_results": test_results,
+        "ai_feedback": ai_feedback,
+    }
+
+
+@router.get("/{challenge_id}/submissions")
+async def get_my_submissions(challenge_id: str, request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+    result = db.table("challenge_submissions") \
+        .select("*") \
+        .eq("user_id", str(user.id)) \
+        .eq("challenge_id", challenge_id) \
+        .order("submitted_at", desc=True) \
+        .execute()
+    return result.data or []

routers/share.py

@@ -0,0 +1,66 @@
+import random
+import string
+from fastapi import APIRouter, HTTPException, Request
+from config.database import get_supabase_admin
+from middleware.auth_guard import get_current_user
+
+router = APIRouter(prefix="/api/share", tags=["share"])
+
+
+def _generate_code(length=8) -> str:
+    return ''.join(random.choices(string.ascii_letters + string.digits, k=length))
+
+
+@router.post("/create")
+async def create_share(request: Request):
+    user = await get_current_user(request)
+    body = await request.json()
+    analysis_id = body.get("analysis_id")
+    if not analysis_id:
+        raise HTTPException(status_code=400, detail="analysis_id is required")
+
+    db = get_supabase_admin()
+
+    # Verify the analysis belongs to this user
+    analysis = db.table("analyses").select("id").eq("id", analysis_id).eq("user_id", str(user.id)).single().execute()
+    if not analysis.data:
+        raise HTTPException(status_code=404, detail="Analysis not found")
+
+    # Generate unique short code
+    for _ in range(5):
+        code = _generate_code()
+        existing = db.table("shared_analyses").select("id").eq("short_code", code).execute()
+        if not existing.data:
+            break
+
+    result = db.table("shared_analyses").insert({
+        "analysis_id": analysis_id,
+        "short_code":  code,
+        "is_public":   True,
+    }).execute()
+
+    return {"short_code": code, "url": f"https://codenexus.qzz.io/share/{code}"}
+
+
+@router.get("/{code}")
+async def get_shared_analysis(code: str):
+    db = get_supabase_admin()
+    shared = db.table("shared_analyses").select("*, analyses(*)").eq("short_code", code).eq("is_public", True).single().execute()
+    if not shared.data:
+        raise HTTPException(status_code=404, detail="Shared analysis not found or has been removed")
+    return shared.data
+
+
+@router.delete("/{code}")
+async def delete_share(code: str, request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+
+    shared = db.table("shared_analyses").select("*, analyses(user_id)").eq("short_code", code).single().execute()
+    if not shared.data:
+        raise HTTPException(status_code=404, detail="Share not found")
+    if shared.data["analyses"]["user_id"] != str(user.id):
+        raise HTTPException(status_code=403, detail="Not your share link")
+
+    db.table("shared_analyses").delete().eq("short_code", code).execute()
+    return {"message": "Share link deleted"}

routers/support.py

@@ -0,0 +1,48 @@
+from fastapi import APIRouter, HTTPException, Request
+from config.database import get_supabase_admin
+from middleware.auth_guard import get_current_user_optional
+from models.support import SupportTicket, TicketReply
+from services.email import send_support_notification_to_admin, send_support_confirmation_to_user
+
+router = APIRouter(prefix="/api/support", tags=["support"])
+
+ADMIN_EMAIL = "admin@codenexus.qzz.io"
+
+
+@router.post("/ticket")
+async def submit_ticket(data: SupportTicket, request: Request):
+    user = await get_current_user_optional(request)
+    db = get_supabase_admin()
+
+    ticket = {
+        "user_email": data.user_email,
+        "category":   data.category,
+        "message":    data.message,
+        "status":     "open",
+    }
+    if data.screenshot_url:
+        ticket["screenshot_url"] = data.screenshot_url
+    if user:
+        ticket["user_id"] = str(user.id)
+
+    result = db.table("support_tickets").insert(ticket).execute()
+
+    # Send emails (non-blocking — don't fail ticket if email fails)
+    try:
+        await send_support_notification_to_admin(ADMIN_EMAIL, data.user_email, data.category, data.message)
+        await send_support_confirmation_to_user(data.user_email, data.category)
+    except Exception:
+        pass
+
+    return {"message": "Ticket submitted successfully", "id": result.data[0]["id"] if result.data else None}
+
+
+@router.post("/feedback")
+async def submit_feedback(request: Request):
+    body = await request.json()
+    analysis_id = body.get("analysis_id")
+    helpful = body.get("helpful", True)
+    db = get_supabase_admin()
+    if analysis_id:
+        db.table("analyses").update({"feedback": "helpful" if helpful else "not_helpful"}).eq("id", analysis_id).execute()
+    return {"message": "Feedback recorded"}

routers/user.py

@@ -0,0 +1,83 @@
+from fastapi import APIRouter, HTTPException, Request
+from config.database import get_supabase_admin
+from middleware.auth_guard import get_current_user
+from models.user import ProfileUpdate
+
+router = APIRouter(prefix="/api/user", tags=["user"])
+
+
+@router.get("/profile")
+async def get_profile(request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+
+    profile = db.table("users").select("*").eq("id", str(user.id)).single().execute()
+    profile_data = profile.data
+
+    analyses_count = db.table("analyses").select("id", count="exact").eq("user_id", str(user.id)).execute()
+    # Filter by coding type to avoid counting MCQs here
+    submissions_count = db.table("challenge_submissions").select("id", count="exact").eq("user_id", str(user.id)).eq("challenge_type", "coding").execute()
+    passed_count = db.table("challenge_submissions").select("id", count="exact").eq("user_id", str(user.id)).eq("challenge_type", "coding").eq("passed", True).execute()
+
+    # MCQ stats - submissions where challenge_type is mcq
+    mcq_attempted = db.table("challenge_submissions").select("id", count="exact").eq("user_id", str(user.id)).eq("challenge_type", "mcq").execute()
+    mcq_passed = db.table("challenge_submissions").select("id", count="exact").eq("user_id", str(user.id)).eq("challenge_type", "mcq").eq("passed", True).execute()
+
+    return {
+        **(profile_data or {}),
+        "role": user.role, # Prioritize the role from auth_guard (Admin override)
+        "stats": {
+            "total_analyses": analyses_count.count or 0,
+            "total_submissions": submissions_count.count or 0,
+            "challenges_passed": passed_count.count or 0,
+            "mcq_attempted": mcq_attempted.count or 0,
+            "mcq_passed": mcq_passed.count or 0,
+        }
+    }
+
+
+@router.patch("/profile")
+async def update_profile(data: ProfileUpdate, request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+    update = {k: v for k, v in data.dict().items() if v is not None}
+    if not update:
+        raise HTTPException(status_code=400, detail="No fields to update")
+    db.table("users").update(update).eq("id", str(user.id)).execute()
+    return {"message": "Profile updated"}
+
+
+@router.delete("/account")
+async def delete_account(request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+    # Delete all user data
+    db.table("analyses").delete().eq("user_id", str(user.id)).execute()
+    db.table("challenge_submissions").delete().eq("user_id", str(user.id)).execute()
+    db.table("users").delete().eq("id", str(user.id)).execute()
+    db.auth.admin.delete_user(str(user.id))
+    return {"message": "Account permanently deleted"}
+
+
+@router.get("/history")
+async def get_history(request: Request, page: int = 1):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+    offset = (page - 1) * 20
+    result = db.table("analyses") \
+        .select("id, language, time_complexity, space_complexity, created_at") \
+        .eq("user_id", str(user.id)) \
+        .order("created_at", desc=True) \
+        .range(offset, offset + 19) \
+        .execute()
+    return result.data or []
+
+
+@router.get("/history/{analysis_id}")
+async def get_analysis(analysis_id: str, request: Request):
+    user = await get_current_user(request)
+    db = get_supabase_admin()
+    result = db.table("analyses").select("*").eq("id", analysis_id).eq("user_id", str(user.id)).single().execute()
+    if not result.data:
+        raise HTTPException(status_code=404, detail="Analysis not found")
+    return result.data

services/ai_router.py

@@ -0,0 +1,289 @@
+import httpx
+import json
+import re
+import logging
+from config.settings import get_settings
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+
+def _extract_json(text: str) -> dict:
+    """
+    Bulletproof JSON extraction for Level 4-8 'Heavyweight' models.
+    Supports markdown fences, meta-commentary, and nested structures.
+    """
+    text = text.strip()
+    
+    # 1. Trial: Pure JSON
+    try:
+        return json.loads(text)
+    except json.JSONDecodeError:
+        pass
+    
+    # 2. Trial: Regex for ```json codes blocks
+    fence_match = re.search(r"```(?:json)?\s*([\s\S]*?)```", text)
+    if fence_match:
+        try:
+            return json.loads(fence_match.group(1).strip())
+        except json.JSONDecodeError:
+            pass
+
+    # 3. Trial: Brute-force first '{' to last '}'
+    start = text.find('{')
+    end = text.rfind('}')
+    if start != -1 and end != -1 and end > start:
+        json_str = text[start:end+1]
+        try:
+            return json.loads(json_str)
+        except json.JSONDecodeError:
+            pass
+
+    raise ValueError(f"Could not extract valid JSON from AI response. Status: {text[:100]}...")
+
+def _sanitize_result(data: dict) -> dict:
+    """
+    Ensures that 'issues' and 'suggestions' are always flat lists of strings.
+    Handles 'Mistral Categorization' where the AI returns objects instead of arrays.
+    """
+    for key in ["issues", "suggestions"]:
+        val = data.get(key)
+        if isinstance(val, dict):
+            # Flatten dictionary: {"category": "issue"} -> ["category: issue"]
+            new_list = []
+            for k, v in val.items():
+                if isinstance(v, list):
+                    new_list.extend([f"{k}: {item}" for item in v])
+                else:
+                    new_list.append(f"{k}: {v}")
+            data[key] = new_list
+        elif val and not isinstance(val, list):
+            data[key] = [str(val)]
+        elif not val:
+            data[key] = []
+            
+    return data
+
+
+# Smart Model Dictionary: Maps logical names to provider-specific model IDs
+# Ordered from Level 1 (Entry) to Level 8 (Flagship)
+MODEL_MAP = {
+    "gemma-4-31b": {
+        "openrouter": "google/gemma-4-31b-it:free"
+    },
+    "llama-3.1": {
+        "groq": "llama-3.1-8b-instant",
+        "openrouter": "meta-llama/llama-3.1-8b-instruct:free"
+    },
+    "qwen-2.5": {
+        "openrouter": "qwen/qwen-2.5-7b-instruct:free",
+        "huggingface": "Qwen/Qwen2.5-7B-Instruct"
+    },
+    "nemotron-120b": {
+        "openrouter": "nvidia/nemotron-3-super-120b-a12b:free"
+    },
+    "minimax-2.5": {
+        "openrouter": "minimax/minimax-m2.5:free"
+    },
+    "mistral-large": {
+        "openrouter": "mistralai/mistral-large-2407"
+    },
+    "groq-70b": {
+        "groq": "llama-3.3-70b-versatile",
+        "openrouter": "meta-llama/llama-3.3-70b-instruct:free"
+    },
+    "gemini-flash": {
+        "gemini": "gemini-2.0-flash",
+        "openrouter": "google/gemini-2.0-flash-001"
+    }
+}
+
+
+async def analyze_with_groq(prompt: str, model_id: str = "llama-3.1-8b-instant") -> dict:
+    """Backup AI — Groq with specified model."""
+    if not settings.groq_api_key:
+        raise Exception("Groq API key not configured")
+        
+    # Dynamic timeout for large codebases
+    timeout = 60.0 if len(prompt) > 5000 else 30.0
+    
+    async with httpx.AsyncClient(timeout=timeout) as client:
+        response = await client.post(
+            "https://api.groq.com/openai/v1/chat/completions",
+            headers={"Authorization": f"Bearer {settings.groq_api_key}", "Content-Type": "application/json"},
+            json={
+                "model": model_id, 
+                "messages": [{"role": "user", "content": prompt}], 
+                "temperature": 0.1,
+                "max_tokens": 2000 # Increased for large code analysis
+            }
+        )
+        if response.status_code != 200:
+            raise Exception(f"Groq error {response.status_code}: {response.text[:200]}")
+        result = response.json()
+        text = result["choices"][0]["message"]["content"].strip()
+        return _sanitize_result(_extract_json(text))
+
+
+async def analyze_with_gemini(prompt: str, model_id: str = "gemini-2.0-flash") -> dict:
+    """Primary AI — Gemini with specified model."""
+    if not settings.gemini_api_key:
+        raise Exception("Gemini API key not configured")
+        
+    # Support large context in Gemini
+    timeout = 60.0 if len(prompt) > 5000 else 30.0
+    
+    async with httpx.AsyncClient(timeout=timeout) as client:
+        response = await client.post(
+            f"https://generativelanguage.googleapis.com/v1beta/models/{model_id}:generateContent?key={settings.gemini_api_key}",
+            json={
+                "contents": [{"parts": [{"text": prompt}]}],
+                "generationConfig": {"maxOutputTokens": 2000} # Increased
+            }
+        )
+        if response.status_code != 200:
+            raise Exception(f"Gemini error {response.status_code}: {response.text[:200]}")
+        result = response.json()
+        candidates = result.get("candidates")
+        if not candidates:
+            raise Exception("Gemini returned no candidates")
+        text = candidates[0]["content"]["parts"][0]["text"].strip()
+        return _sanitize_result(_extract_json(text))
+
+
+async def analyze_with_openrouter(prompt: str, model_id: str = None) -> dict:
+    """Last Resort AI — OpenRouter with customizable model."""
+    if not settings.openrouter_api_key:
+        raise Exception("OpenRouter API key not configured")
+    
+    # Use settings default if no specific model requested
+    target_model = model_id or settings.openrouter_model
+        
+    # Support large context in OpenRouter
+    timeout = 60.0 if len(prompt) > 5000 else 30.0
+    
+    async with httpx.AsyncClient(timeout=timeout) as client:
+        response = await client.post(
+            "https://openrouter.ai/api/v1/chat/completions",
+            headers={"Authorization": f"Bearer {settings.openrouter_api_key}", "Content-Type": "application/json"},
+            json={
+                "model": target_model, 
+                "messages": [{"role": "user", "content": prompt}],
+                "max_tokens": 2000 # Increased
+            }
+        )
+        if response.status_code != 200:
+            raise Exception(f"OpenRouter error {response.status_code}: {response.text[:200]}")
+        result = response.json()
+        if "choices" not in result:
+            raise Exception(f"Unexpected OpenRouter response: {result}")
+        text = result["choices"][0]["message"]["content"].strip()
+        return _sanitize_result(_extract_json(text))
+
+
+async def analyze_with_huggingface(prompt: str, model_id: str = None) -> dict:
+    """Extra Backup — Hugging Face with specific model OR rotation."""
+    if not settings.huggingface_api_token:
+        raise Exception("Hugging Face API token not configured")
+        
+    # If a specific model is requested, try ONLY that one
+    # Otherwise, use the rotation logic
+    models_to_try = [model_id] if model_id else settings.huggingface_free_models
+    
+    last_error = None
+    for target_model in models_to_try:
+        try:
+            timeout = 60.0 if len(prompt) > 5000 else 30.0
+            async with httpx.AsyncClient(timeout=timeout) as client:
+                response = await client.post(
+                    f"https://api-inference.huggingface.co/models/{target_model}",
+                    headers={"Authorization": f"Bearer {settings.huggingface_api_token}"},
+                    json={
+                        "inputs": prompt,
+                        "parameters": {"max_new_tokens": 2000, "return_full_text": False}
+                    }
+                )
+                if response.status_code != 200:
+                    raise Exception(f"HF Model {target_model} failed ({response.status_code})")
+                
+                result = response.json()
+                text = result[0]["generated_text"].strip() if isinstance(result, list) else result.get("generated_text", "").strip()
+                return _sanitize_result(_extract_json(text))
+        except Exception as e:
+            logger.warning(f"Hugging Face model {target_model} failed: {e}")
+            last_error = e
+            if model_id: # Don't rotate if specific model was forced
+                break
+            continue
+
+    raise Exception(f"Hugging Face attempt failed. Last error: {last_error}")
+
+
+async def route_analysis(prompt: str, model_choice: str = "auto") -> dict:
+    """
+    Smart AI router with Zero-Failure 'Smart Recovery' logic.
+    
+    Tiered Chain: Gemma 4 -> Llama 3.1 -> Qwen 2.5 -> Nemotron 120B -> 
+                 MiniMax 2.5 -> Mistral Large -> Groq 70B -> Gemini Flash
+    """
+    
+    # 1. Prepare Provider List
+    providers = []
+    
+    # Handle Specific Model Choice (With Recovery)
+    if model_choice != "auto" and model_choice in MODEL_MAP:
+        config = MODEL_MAP[model_choice]
+        if "groq" in config:
+            providers.append({"func": lambda p: analyze_with_groq(p, config["groq"]), "name": model_choice})
+        if "gemini" in config:
+            providers.append({"func": lambda p: analyze_with_gemini(p, config["gemini"]), "name": model_choice})
+        if "openrouter" in config:
+            providers.append({"func": lambda p: analyze_with_openrouter(p, config["openrouter"]), "name": model_choice})
+        if "huggingface" in config:
+            providers.append({"func": lambda p: analyze_with_huggingface(p, config["huggingface"]), "name": model_choice})
+        
+        # SMART RECOVERY: If the specific choice fails, pivot to the full AUTO chain
+        providers.append({"func": lambda p: route_analysis(p, "auto"), "is_meta": True})
+        
+    else:
+        # Full Power Progression Chain (8 Levels)
+        order = ["gemma-4-31b", "llama-3.1", "qwen-2.5", "nemotron-120b", "minimax-2.5", "mistral-large", "groq-70b", "gemini-flash"]
+        for m_id in order:
+            m_cfg = MODEL_MAP[m_id]
+            # Primary provider logic for auto-chain
+            if m_id == "llama-3.1": # Prioritize Groq's 8B for speed
+                providers.append({"func": lambda p: analyze_with_groq(p, "llama-3.1-8b-instant"), "name": m_id})
+            elif m_id == "groq-70b": # Prioritize Groq's 70B
+                providers.append({"func": lambda p: analyze_with_groq(p, "llama-3.3-70b-versatile"), "name": m_id})
+            elif m_id == "gemini-flash":
+                providers.append({"func": lambda p: analyze_with_gemini(p), "name": m_id})
+            elif "openrouter" in m_cfg:
+                providers.append({"func": lambda p: analyze_with_openrouter(p, m_cfg["openrouter"]), "name": m_id})
+        
+        # Ultimate Last Resort
+        providers.append({"func": lambda p: analyze_with_openrouter(p, "openrouter/free"), "name": "openrouter-free-fallback"})
+
+    # 2. Execute with Failover Logic
+    last_error = None
+    for i, p_item in enumerate(providers):
+        try:
+            p_name = p_item.get("name", "failover-chain")
+            logger.info(f"Attempting {p_name} ({i+1}/{len(providers)})")
+            
+            result = await p_item["func"](prompt)
+            
+            # If it's a metadata-wrapped result from a nested call, return it
+            if isinstance(result, dict) and "_actual_model" in result:
+                return result
+                
+            # Attach actual model name to the result
+            if isinstance(result, dict):
+                result["_actual_model"] = p_name
+            return result
+            
+        except Exception as e:
+            logger.error(f"Provider {i+1} failed: {str(e)}")
+            last_error = e
+            continue
+
+    raise Exception(f"Absolute failure in AI Hub. Last error: {last_error}")

services/code_runner.py

@@ -0,0 +1,82 @@
+import httpx
+import logging
+from config.settings import get_settings
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+JDOODLE_LANGUAGE_MAP = {
+    "python":     {"language": "python3",    "versionIndex": "4"},
+    "javascript": {"language": "nodejs",     "versionIndex": "4"},
+    "typescript": {"language": "typescript", "versionIndex": "1"},
+    "java":       {"language": "java",       "versionIndex": "4"},
+    "c++":        {"language": "cpp17",      "versionIndex": "1"},
+    "c":          {"language": "c",          "versionIndex": "5"},
+    "go":         {"language": "go",         "versionIndex": "4"},
+    "rust":       {"language": "rust",       "versionIndex": "4"},
+    "ruby":       {"language": "ruby",       "versionIndex": "4"},
+    "php":        {"language": "php",        "versionIndex": "4"},
+}
+
+
+async def run_code_jdoodle(language: str, code: str) -> str:
+    """Run code via JDoodle API. Returns output string."""
+    lang_config = JDOODLE_LANGUAGE_MAP.get(language.lower())
+    if not lang_config:
+        raise ValueError(f"Language '{language}' not supported")
+
+    async with httpx.AsyncClient(timeout=30.0) as client:
+        response = await client.post(
+            "https://api.jdoodle.com/v1/execute",
+            json={
+                "clientId":     settings.jdoodle_client_id,
+                "clientSecret": settings.jdoodle_client_secret,
+                "script":       code,
+                "language":     lang_config["language"],
+                "versionIndex": lang_config["versionIndex"],
+            }
+        )
+        if response.status_code != 200:
+            logger.error(f"JDoodle error {response.status_code}: {response.text}")
+            raise Exception(f"Code execution service error: {response.status_code}")
+
+        result = response.json()
+
+        # JDoodle returns error info in statusCode field
+        if result.get("statusCode") == 400:
+            raise Exception("JDoodle: Invalid request")
+        if result.get("statusCode") == 429:
+            raise Exception("Daily code execution limit reached. Try again tomorrow.")
+
+        return result.get("output", "No output")
+
+
+async def run_code_piston(language: str, version: str, code: str) -> str:
+    """Run code via Piston API (fallback). Returns output string."""
+    async with httpx.AsyncClient(timeout=30.0) as client:
+        response = await client.post(
+            f"{settings.piston_api_url}/execute",
+            json={
+                "language": language,
+                "version":  version,
+                "files":    [{"content": code}],
+            }
+        )
+        if response.status_code != 200:
+            raise Exception(f"Piston error: {response.status_code}")
+
+        result = response.json()
+        run = result.get("run", {})
+        return run.get("output") or run.get("stderr") or "No output"
+
+
+async def run_code(language: str, code: str, version: str = "") -> str:
+    """Run code with JDoodle primary, Piston fallback."""
+    try:
+        return await run_code_jdoodle(language, code)
+    except Exception as e:
+        logger.warning(f"JDoodle failed ({e}), falling back to Piston")
+        try:
+            return await run_code_piston(language, version, code)
+        except Exception as e2:
+            raise Exception(f"Both code runners failed. JDoodle: {e} | Piston: {e2}")

services/email.py

@@ -0,0 +1,92 @@
+import httpx
+import logging
+from config.settings import get_settings
+
+logger = logging.getLogger(__name__)
+settings = get_settings()
+
+FROM_EMAIL = "CodeNexus <noreply@codenexus.qzz.io>"
+
+
+async def send_email(to: str, subject: str, html: str) -> bool:
+    """Send email via Resend. Returns True on success."""
+    try:
+        async with httpx.AsyncClient(timeout=15.0) as client:
+            response = await client.post(
+                "https://api.resend.com/emails",
+                headers={"Authorization": f"Bearer {settings.resend_api_key}", "Content-Type": "application/json"},
+                json={"from": FROM_EMAIL, "to": [to], "subject": subject, "html": html}
+            )
+            if response.status_code not in (200, 201):
+                logger.error(f"Resend error {response.status_code}: {response.text}")
+                return False
+            return True
+    except Exception as e:
+        logger.error(f"Email send failed: {e}")
+        return False
+
+
+async def send_welcome_email(to: str, name: str) -> bool:
+    return await send_email(
+        to=to,
+        subject="Welcome to CodeNexus! 🚀",
+        html=f"""
+        <div style="font-family:Inter,sans-serif;max-width:600px;margin:0 auto;background:#030712;color:#fff;padding:40px;border-radius:16px;">
+          <h1 style="color:#6366f1;font-size:28px;margin-bottom:8px;">Welcome to CodeNexus!</h1>
+          <p style="color:#9ca3af;font-size:16px;">Hi {name}, your account is ready.</p>
+          <p style="color:#d1d5db;">Start writing and analyzing code right now — it's completely free.</p>
+          <a href="https://codenexus.qzz.io/editor" style="display:inline-block;margin-top:24px;padding:14px 28px;background:#6366f1;color:#fff;border-radius:10px;text-decoration:none;font-weight:600;">
+            Open Editor →
+          </a>
+          <p style="color:#4b5563;font-size:12px;margin-top:32px;">CodeNexus — Where Code Meets Intelligence</p>
+        </div>
+        """
+    )
+
+
+async def send_support_notification_to_admin(admin_email: str, user_email: str, category: str, message: str) -> bool:
+    return await send_email(
+        to=admin_email,
+        subject=f"[CodeNexus Support] New {category} ticket from {user_email}",
+        html=f"""
+        <div style="font-family:Inter,sans-serif;max-width:600px;margin:0 auto;background:#030712;color:#fff;padding:40px;border-radius:16px;">
+          <h2 style="color:#f59e0b;">New Support Ticket</h2>
+          <p><strong>From:</strong> {user_email}</p>
+          <p><strong>Category:</strong> {category}</p>
+          <p><strong>Message:</strong></p>
+          <div style="background:#111827;padding:16px;border-radius:8px;color:#d1d5db;">{message}</div>
+          <a href="https://codenexus.qzz.io/admin" style="display:inline-block;margin-top:24px;padding:14px 28px;background:#6366f1;color:#fff;border-radius:10px;text-decoration:none;font-weight:600;">
+            View in Admin Panel →
+          </a>
+        </div>
+        """
+    )
+
+
+async def send_support_confirmation_to_user(to: str, category: str) -> bool:
+    return await send_email(
+        to=to,
+        subject="We received your support request — CodeNexus",
+        html=f"""
+        <div style="font-family:Inter,sans-serif;max-width:600px;margin:0 auto;background:#030712;color:#fff;padding:40px;border-radius:16px;">
+          <h2 style="color:#6366f1;">We got your message!</h2>
+          <p style="color:#9ca3af;">Thanks for reaching out about <strong>{category}</strong>.</p>
+          <p style="color:#d1d5db;">Our team will review your request and get back to you as soon as possible.</p>
+          <p style="color:#4b5563;font-size:12px;margin-top:32px;">CodeNexus — Where Code Meets Intelligence</p>
+        </div>
+        """
+    )
+
+
+async def send_ticket_reply_to_user(to: str, reply: str) -> bool:
+    return await send_email(
+        to=to,
+        subject="Reply to your CodeNexus support ticket",
+        html=f"""
+        <div style="font-family:Inter,sans-serif;max-width:600px;margin:0 auto;background:#030712;color:#fff;padding:40px;border-radius:16px;">
+          <h2 style="color:#6366f1;">Support Reply</h2>
+          <div style="background:#111827;padding:16px;border-radius:8px;color:#d1d5db;">{reply}</div>
+          <p style="color:#4b5563;font-size:12px;margin-top:32px;">CodeNexus Support Team</p>
+        </div>
+        """
+    )

services/quotas.py

@@ -0,0 +1,110 @@
+from datetime import date
+from fastapi import HTTPException
+from config.database import get_supabase_admin
+
+async def check_quota(user_id: str, quota_type: str):
+    """
+    Checks if a user has exceeded their daily quota for a given action.
+    quota_type can be 'analysis' or 'ai_input_converter'.
+    """
+    db = get_supabase_admin()
+    
+    # 1. Get user's role/tier
+    user_res = db.table("users").select("role, daily_analyses_count, last_analysis_date, daily_ai_input_count, last_ai_input_date").eq("id", user_id).single().execute()
+    if not user_res.data:
+        raise HTTPException(status_code=404, detail="User not found")
+    
+    user = user_res.data
+    role = user.get("role", "free")
+    
+    # 2. Master Admin Bypass
+    if role == "admin":
+        return True
+        
+    today = str(date.today())
+    
+    # 2. Get site-wide limits from site_settings
+    settings_res = db.table("site_settings").select("value").eq("key", "quotas").single().execute()
+    
+    # Standardized limits as requested: Guest 3, Free 5, Pro 100
+    default_limits = {
+        "analysis": {"guest": 3, "free": 5, "pro": 100},
+        "ai_input_converter": {"guest": 3, "free": 5, "pro": 25}
+    }
+    
+    # Safe fetch from DB with fallback
+    limits = settings_res.data.get("value", default_limits) if (settings_res.data and "value" in settings_res.data) else default_limits
+    
+    # Determine the specific limit for this action and user role
+    type_limits = limits.get(quota_type, default_limits.get(quota_type, {}))
+    limit = type_limits.get(role, type_limits.get("free", 5))
+    
+    # 3. Check and reset counter if it's a new day
+    counter_field = "daily_analyses_count" if quota_type == "analysis" else "daily_ai_input_count"
+    date_field = "last_analysis_date" if quota_type == "analysis" else "last_ai_input_date"
+    
+    current_count = user.get(counter_field, 0)
+    last_date = user.get(date_field)
+    
+    if last_date != today:
+        current_count = 0
+        db.table("users").update({counter_field: 0, date_field: today}).eq("id", user_id).execute()
+    
+    if limit != -1 and current_count >= limit:
+        raise HTTPException(
+            status_code=429, 
+            detail=f"Daily {quota_type} limit ({limit}) reached for {role} tier. Please upgrade to Pro for more access."
+        )
+    
+    # 4. Increment count
+    db.table("users").update({counter_field: current_count + 1, date_field: today}).eq("id", user_id).execute()
+    
+    return True
+
+async def check_guest_quota(client_ip: str, quota_type: str):
+    """
+    Checks guest quota based on IP address. 
+    Standard limits: 3 analyses per day.
+    """
+    db = get_supabase_admin()
+    today = str(date.today())
+    
+    # Get guest limits from DB or fallback
+    settings_res = db.table("site_settings").select("value").eq("key", "quotas").single().execute()
+    
+    default_guest_limit = 3
+    limit = default_guest_limit
+    
+    if settings_res.data and "value" in settings_res.data:
+        limit = settings_res.data["value"].get(quota_type, {}).get("guest", default_guest_limit)
+    
+    # Block immediately if limit is 0 — before any DB operations
+    # This ensures the setting takes effect even if guest_usage table is missing
+    if limit == 0:
+        raise HTTPException(status_code=429, detail=f"Guest access to {quota_type} is currently disabled. Please sign in for access.")
+
+    # Check IP usage in guest_usage table
+    try:
+        log_res = db.table("guest_usage").select("count").eq("ip", client_ip).eq("action_type", quota_type).eq("usage_date", today).single().execute()
+        
+        count = 0
+        if log_res.data:
+            count = log_res.data["count"]
+            if count >= limit:
+                raise HTTPException(status_code=429, detail=f"Guest limit of {limit} daily {quota_type}s reached. Please sign in for higher limits.")
+            
+            db.table("guest_usage").update({"count": count + 1}).eq("ip", client_ip).eq("action_type", quota_type).eq("usage_date", today).execute()
+        else:
+            db.table("guest_usage").insert({
+                "ip": client_ip,
+                "action_type": quota_type,
+                "usage_date": today,
+                "count": 1
+            }).execute()
+    except HTTPException:
+        raise
+    except Exception:
+        # Ignore if the guest_usage table doesn't exist
+        pass
+    
+    return True

services/settings.py

@@ -0,0 +1,20 @@
+from config.database import get_supabase_admin
+
+def get_site_setting(key: str, default: any = None):
+    """
+    Fetches a site-wide setting from the 'site_settings' table.
+    """
+    try:
+        db = get_supabase_admin()
+        result = db.table("site_settings").select("value").eq("key", key).single().execute()
+        if result.data:
+            return result.data.get("value")
+    except Exception:
+        pass
+    return default
+
+def is_ai_enabled() -> bool:
+    """
+    Convenience function to check if AI features are globally enabled.
+    """
+    return get_site_setting("ai_features_enabled", True)

services/user_sync.py

@@ -0,0 +1,48 @@
+from config.database import get_supabase_admin
+import logging
+
+logger = logging.getLogger(__name__)
+
+async def ensure_user_exists(user):
+    """
+    Ensures that a user from auth.users has a corresponding record in public.users.
+    This handles OAuth users and manual signups uniformly.
+    """
+    if not user:
+        return None
+
+    from config.settings import get_settings
+    settings = get_settings()
+    db = get_supabase_admin()
+    
+    try:
+        # Check if user already exists
+        profile = db.table("users").select("*").eq("id", str(user.id)).execute()
+        
+        # Determine target role (Case-Insensitive)
+        admin_list = [e.lower() for e in settings.admin_emails]
+        target_role = "admin" if user.email.lower() in admin_list else "free"
+        
+        if not profile.data:
+            # Create user on the fly
+            display_name = user.user_metadata.get("full_name") or user.email.split("@")[0]
+            logger.info(f"Syncing new user to public table: {user.email} as {target_role}")
+            
+            db.table("users").insert({
+                "id": str(user.id),
+                "email": user.email,
+                "display_name": display_name,
+                "role": target_role,
+                "is_banned": False
+            }).execute()
+        else:
+            # Existing user - Check if they need an admin upgrade
+            current_role = profile.data[0].get("role")
+            if target_role == "admin" and current_role != "admin":
+                logger.info(f"Upgrading existing user to admin: {user.email}")
+                db.table("users").update({"role": "admin"}).eq("id", str(user.id)).execute()
+            
+        return True
+    except Exception as e:
+        logger.error(f"Error in ensure_user_exists: {str(e)}")
+        return False