feat: implement sandbox mode

.gitignore

@@ -12,6 +12,7 @@ __pycache__/
 
 # Local SQLite databases and logs
 /scratch/db_*.sqlite
+/scratch/sandbox.db
 sync.log
 debug_cookies.txt
 debug_db.txt

algospaced-ui/src/App.tsx

@@ -8,6 +8,7 @@ import TerminalEmulator from './components/TerminalEmulator';
 import PythonChallenge from './components/PythonChallenge';
 import MySQLPlayground from './components/MySQLPlayground';
 import FileExplorer from './components/FileExplorer';
+import Settings from './components/Settings';
 
 
 
@@ -29,6 +30,7 @@ export default function App() {
     sync: { isOpen: false, isMinimized: false },
     python: { isOpen: false, isMinimized: false },
     mysql: { isOpen: false, isMinimized: false },
+    settings: { isOpen: false, isMinimized: false },
   });
   const [activeWindow, setActiveWindow] = useState<string>('queue');
   const [isMobile, setIsMobile] = useState(false);
@@ -461,6 +463,22 @@ export default function App() {
               TERMINAL
             </span>
           </button>
+
+          {localStorage.getItem('algospaced_sandbox_mode') === 'true' && (
+            <button 
+              onClick={() => toggleWindowMinimize('settings')}
+              className="flex flex-col items-center justify-center text-ink-black gap-2.5 p-2 w-full group icon-hover-shift cursor-pointer outline-none animate-fade-in"
+            >
+              <div className="w-16 h-16 bg-paper-white border-[3px] border-ink-black flex items-center justify-center gadget-shadow group-hover:bg-[#10b981] group-hover:text-white transition-all shadow-[inset_2px_2px_0px_rgba(255,255,255,0.8)]">
+                <span className="material-symbols-outlined text-4xl" style={{ fontVariationSettings: "'FILL' 1" }}>
+                  key
+                </span>
+              </div>
+              <span className="font-icon-label text-[9px] bg-ink-black text-white px-2 py-1 border-[3px] border-ink-black text-center leading-tight shadow-[2px_2px_0px_0px_#10b981] uppercase">
+                API<br/>KEYS
+              </span>
+            </button>
+          )}
         </nav>
       )}
 
@@ -602,6 +620,20 @@ export default function App() {
               </span>
             </button>
 
+            {localStorage.getItem('algospaced_sandbox_mode') === 'true' && (
+              <button 
+                onClick={() => toggleWindowMinimize('settings')}
+                className="bg-[#10b981] text-white border-[3px] border-ink-black p-4 flex flex-col justify-between aspect-square gadget-shadow active:translate-y-1 active:translate-x-1 active:shadow-none select-none text-left cursor-pointer transition-all"
+              >
+                <span className="material-symbols-outlined text-3xl align-top" style={{ fontVariationSettings: "'FILL' 1" }}>
+                  key
+                </span>
+                <span className="font-arcade text-[8px] font-bold tracking-tight uppercase leading-tight">
+                  API<br/>KEYS
+                </span>
+              </button>
+            )}
+
             {/* Drive Sync Tile (Wide - 2 cols) */}
             <button 
               onClick={triggerSync}
@@ -804,6 +836,25 @@ export default function App() {
         <MySQLPlayground />
       </WindowShell>
 
+      {/* 8. API Control Panel Window */}
+      <WindowShell
+        id="settings"
+        title="Control Panel"
+        icon="key"
+        isOpen={windows.settings?.isOpen}
+        isMinimized={windows.settings?.isMinimized}
+        onClose={() => closeWindow('settings')}
+        onMinimize={() => minimizeWindow('settings')}
+        activeWindow={activeWindow}
+        setActiveWindow={setActiveWindow}
+        defaultWidth="500px"
+        defaultHeight="450px"
+        titleBarColor="#10b981"
+        isMobile={isMobile}
+      >
+        <Settings />
+      </WindowShell>
+
       {/* Start Menu Popup */}
       {isStartOpen && (
         <div 
@@ -860,6 +911,15 @@ export default function App() {
               <span className="material-symbols-outlined text-lg" style={{ fontVariationSettings: "'FILL' 1" }}>database</span>
               MySQL Playground
             </button>
+            {localStorage.getItem('algospaced_sandbox_mode') === 'true' && (
+              <button 
+                onClick={() => openWindow('settings')}
+                className="w-full text-left hover:bg-[#10b981]/25 px-3 py-1.5 border-2 border-transparent hover:border-[#10b981] transition-colors cursor-pointer flex items-center gap-2"
+              >
+                <span className="material-symbols-outlined text-lg text-[#10b981]" style={{ fontVariationSettings: "'FILL' 1" }}>key</span>
+                Gemini API Config
+              </button>
+            )}
           </div>
           
           <div className="mt-4 flex justify-end border-t-[3px] border-ink-black pt-4 select-none">
@@ -999,6 +1059,21 @@ export default function App() {
               <span>{isMobile ? 'SQL' : 'MySQL Playground'}</span>
             </button>
           )}
+
+          {/* API Settings Tab */}
+          {windows.settings?.isOpen && (
+            <button 
+              onClick={() => toggleWindowMinimize('settings')}
+              className={`h-full ${isMobile ? 'px-2 text-[10px] gap-1' : 'px-4 text-xs gap-2'} border-r-[4px] border-ink-black font-bold font-window-title cursor-pointer transition-all shadow-[inset_0px_3px_0px_rgba(255,255,255,0.8)] ${
+                activeWindow === 'settings' && !windows.settings.isMinimized
+                  ? 'bg-paper-white text-[#10b981] font-extrabold translate-y-[2px]' 
+                  : 'bg-surface-variant text-trash-gray hover:bg-white/40'
+              }`}
+            >
+              <span className="material-symbols-outlined text-sm font-bold text-[#10b981]">key</span>
+              <span>{isMobile ? 'API' : 'API Config'}</span>
+            </button>
+          )}
         </div>
 
         {/* System tray (wifi, clock, volume) */}

algospaced-ui/src/components/Auth.tsx

@@ -54,6 +54,11 @@ export default function Auth() {
     }
   };
 
+  const handleSandboxEntrance = () => {
+    localStorage.setItem('algospaced_sandbox_mode', 'true');
+    window.location.reload();
+  };
+
   return (
     <div className="min-h-screen w-screen flex items-center justify-center p-4 relative selection:bg-highlight-pink selection:text-white">
       {/* Background Wallpaper image */}
@@ -194,6 +199,15 @@ export default function Auth() {
             </svg>
             SIGN IN WITH GOOGLE
           </button>
+
+          <button
+            onClick={handleSandboxEntrance}
+            disabled={loading}
+            className="mt-3 w-full bg-[#10b981] hover:bg-emerald-600 text-white font-window-title py-3 px-4 border-[3px] border-ink-black rounded-xl flex items-center justify-center gap-2 cursor-pointer shadow-[3px_3px_0px_0px_rgba(30,41,59,1)] active:translate-y-0.5 active:shadow-none uppercase font-bold text-xs"
+          >
+            <span className="material-symbols-outlined text-sm font-bold">sports_esports</span>
+            Enter Sandbox Mode (No Login)
+          </button>
         </div>
       </div>
     </div>

algospaced-ui/src/components/Settings.tsx

@@ -0,0 +1,96 @@
+import { useState, useEffect } from 'react';
+import { Key, Eye, EyeOff, Save, Trash } from 'lucide-react';
+
+export default function Settings() {
+  const [apiKey, setApiKey] = useState('');
+  const [showKey, setShowKey] = useState(false);
+  const [status, setStatus] = useState<string | null>(null);
+
+  useEffect(() => {
+    const savedKey = localStorage.getItem('sandbox_gemini_api_key') || '';
+    setApiKey(savedKey);
+  }, []);
+
+  const handleSave = () => {
+    if (apiKey.trim()) {
+      localStorage.setItem('sandbox_gemini_api_key', apiKey.trim());
+      setStatus('API Key saved successfully!');
+    } else {
+      localStorage.removeItem('sandbox_gemini_api_key');
+      setStatus('API Key cleared.');
+    }
+    setTimeout(() => setStatus(null), 3000);
+  };
+
+  const handleClear = () => {
+    localStorage.removeItem('sandbox_gemini_api_key');
+    setApiKey('');
+    setStatus('API Key cleared.');
+    setTimeout(() => setStatus(null), 3000);
+  };
+
+  return (
+    <div className="w-full h-full bg-[#fdf8e1] p-6 flex flex-col gap-5 select-none font-sans text-ink-black overflow-y-auto custom-scrollbar">
+      <div className="flex flex-col gap-2">
+        <h3 className="font-headline-md font-bold text-sm m-0 flex items-center gap-2">
+          <span className="material-symbols-outlined text-lg text-[#0ea5e9]">key</span>
+          CUSTOM GEMINI API CONFIG
+        </h3>
+        <p className="text-[9px] text-trash-gray font-bold leading-normal m-0 uppercase font-arcade">
+          Configure a custom Gemini API key for Sandbox Mode AI evaluations & explanations.
+        </p>
+      </div>
+
+      <div className="bg-white border-[3px] border-ink-black p-4 shadow-[4px_4px_0px_0px_rgba(30,41,59,1)] flex flex-col gap-4">
+        <div>
+          <label className="block text-xs font-bold text-ink-black uppercase tracking-wider mb-2 font-headline-md">
+            Gemini API Key
+          </label>
+          <div className="relative">
+            <Key className="absolute left-3.5 top-1/2 -translate-y-1/2 w-4 h-4 text-ink-black" />
+            <input
+              type={showKey ? 'text' : 'password'}
+              value={apiKey}
+              onChange={(e) => setApiKey(e.target.value)}
+              placeholder="AIzaSy..."
+              className="w-full bg-white border-[3px] border-ink-black rounded-lg py-2.5 pl-10 pr-10 text-ink-black placeholder-trash-gray focus:outline-none focus:bg-white text-xs font-code-mono shadow-[inset_2px_2px_0px_rgba(0,0,0,0.1)]"
+            />
+            <button
+              type="button"
+              onClick={() => setShowKey(!showKey)}
+              className="absolute right-3.5 top-1/2 -translate-y-1/2 text-trash-gray hover:text-ink-black cursor-pointer bg-transparent border-0 outline-none"
+            >
+              {showKey ? <EyeOff className="w-4 h-4" /> : <Eye className="w-4 h-4" />}
+            </button>
+          </div>
+          <span className="text-[9px] text-trash-gray mt-2 block font-medium leading-normal">
+            Your key is stored locally in your browser's localStorage and is only sent to the local server in request headers.
+          </span>
+        </div>
+
+        {status && (
+          <div className="p-3 border-[3px] border-ink-black bg-emerald-100 border-emerald-500 text-emerald-700 text-xs font-bold font-arcade leading-relaxed shadow-[2px_2px_0px_0px_rgba(30,41,59,1)]">
+            {status}
+          </div>
+        )}
+
+        <div className="flex flex-col sm:flex-row gap-3 pt-2 border-t border-slate-200">
+          <button
+            onClick={handleSave}
+            className="flex-1 flex items-center justify-center gap-2 py-2.5 border-[3px] border-ink-black bg-[#ffe24c] hover:bg-yellow-300 text-xs font-bold text-ink-black shadow-[3px_3px_0px_0px_#1E293B] active:translate-y-0.5 active:shadow-none transition-all cursor-pointer text-center uppercase"
+          >
+            <Save className="w-4 h-4" />
+            Save Key
+          </button>
+          <button
+            onClick={handleClear}
+            className="flex-1 flex items-center justify-center gap-2 py-2.5 border-[3px] border-ink-black bg-white hover:bg-slate-100 text-xs font-bold text-ink-black shadow-[3px_3px_0px_0px_#1E293B] active:translate-y-0.5 active:shadow-none transition-all cursor-pointer text-center uppercase"
+          >
+            <Trash className="w-4 h-4 text-rose-500" />
+            Clear Key
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}

algospaced-ui/src/main.tsx

@@ -5,6 +5,27 @@ import App from './App.tsx'
 
 import { initializeSupabase } from './supabaseClient'
 
+// Global fetch interceptor to append custom Gemini API Key header if available
+const originalFetch = window.fetch;
+window.fetch = async (input: RequestInfo | URL, init?: RequestInit) => {
+  const customKey = localStorage.getItem('sandbox_gemini_api_key');
+  if (customKey) {
+    const urlStr = typeof input === 'string'
+      ? input
+      : 'url' in input
+        ? (input as any).url
+        : input.toString();
+    if (urlStr && urlStr.includes('/api/')) {
+      const newInit = init ? { ...init } : {};
+      const headers = new Headers(newInit.headers || {});
+      headers.set('X-Gemini-API-Key', customKey);
+      newInit.headers = headers;
+      return originalFetch(input, newInit);
+    }
+  }
+  return originalFetch(input, init);
+};
+
 async function init() {
   try {
     const apiBase = import.meta.env.VITE_API_BASE_URL || '';

algospaced-ui/src/supabaseClient.ts

@@ -11,6 +11,39 @@ export function initializeSupabase(url: string, key: string) {
 // Proxy wrapper that delegates all calls to the dynamically initialized instance
 export const supabase = new Proxy({} as any, {
   get(_target, prop) {
+    if (prop === 'auth' && localStorage.getItem('algospaced_sandbox_mode') === 'true') {
+      const mockSession = {
+        access_token: 'sandbox',
+        user: {
+          id: 'sandbox-user-id',
+          email: 'sandbox@algospaced.io',
+          email_confirmed_at: new Date().toISOString(),
+          last_sign_in_at: new Date().toISOString(),
+          role: 'authenticated',
+          aud: 'authenticated',
+        }
+      };
+      return {
+        getSession: async () => ({ data: { session: mockSession }, error: null }),
+        getUser: async () => ({ data: { user: mockSession.user }, error: null }),
+        onAuthStateChange: (callback: any) => {
+          setTimeout(() => callback('SIGNED_IN', mockSession), 0);
+          return {
+            data: {
+              subscription: {
+                unsubscribe: () => {}
+              }
+            }
+          };
+        },
+        signOut: async () => {
+          localStorage.removeItem('algospaced_sandbox_mode');
+          window.location.reload();
+          return { error: null };
+        }
+      };
+    }
+
     if (!supabaseInstance) {
       // Fallback: try loading from build-time environment if not initialized yet
       const url = import.meta.env.VITE_SUPABASE_URL || '';

db.py

@@ -208,12 +208,12 @@ def get_problem_titles_by_number(client=None) -> dict:
     if client is None:
         client = get_supabase_client()
     user_id = get_current_user_id(client)
-    if not user_id:
-        return {}
-    res = client.table('problems').select('problem_number, name').eq('user_id', user_id).execute()
+    res = client.table('problems').select('problem_number, name, user_id').execute()
     mapping = {}
     if res.data:
-        for row in res.data:
+        # Sort so that current user's titles override others
+        rows = sorted(res.data, key=lambda r: 1 if r.get('user_id') == user_id else 0)
+        for row in rows:
             num = row.get('problem_number')
             if num is not None:
                 base_name = row['name'].split(" - ")[0].strip()
@@ -224,10 +224,22 @@ def get_problems_by_number(problem_number: int, client=None) -> list:
     if client is None:
         client = get_supabase_client()
     user_id = get_current_user_id(client)
-    if not user_id:
+    
+    # Fetch all versions of this problem number
+    res = client.table('problems').select('*').eq('problem_number', problem_number).execute()
+    problems = res.data if res.data else []
+    
+    if not problems:
         return []
-    res = client.table('problems').select('*').eq('user_id', user_id).eq('problem_number', problem_number).execute()
-    return res.data if res.data else []
+        
+    # Prioritize current user's problem
+    if user_id:
+        user_probs = [p for p in problems if p.get('user_id') == user_id]
+        if user_probs:
+            return user_probs
+            
+    # Fallback to returning all public versions
+    return problems
 
 def get_reviews_by_problem_id(problem_id: str, client=None) -> list:
     if client is None:

llm_reviewer.py

@@ -40,10 +40,10 @@ def generate_content_with_fallback(client, system_instruction, user_prompt, is_j
             
     raise last_err if last_err else Exception("No Gemini models succeeded")
 
-def evaluate_code(problem_name, pattern_name, expected_time, expected_space, candidate_code):
-    api_key = get_secret("GEMINI_API_KEY")
+def evaluate_code(problem_name, pattern_name, expected_time, expected_space, candidate_code, custom_api_key=None):
+    api_key = custom_api_key or get_secret("GEMINI_API_KEY")
     if not api_key:
-        return {"error": "GEMINI_API_KEY not found in secrets"}
+        return {"error": "GEMINI_API_KEY not found in secrets. Please configure your API key in the System Control Panel."}
     
     client = genai.Client(api_key=api_key)
     
@@ -80,10 +80,10 @@ def evaluate_code(problem_name, pattern_name, expected_time, expected_space, can
     except Exception as e:
         return {"error": str(e)}
 
-def explain_code(problem_name, code, optimal_time, optimal_space):
-    api_key = get_secret("GEMINI_API_KEY")
+def explain_code(problem_name, code, optimal_time, optimal_space, custom_api_key=None):
+    api_key = custom_api_key or get_secret("GEMINI_API_KEY")
     if not api_key:
-        return {"error": "GEMINI_API_KEY not found in secrets"}
+        return {"error": "GEMINI_API_KEY not found in secrets. Please configure your API key in the System Control Panel."}
     
     client = genai.Client(api_key=api_key)
     
@@ -119,10 +119,10 @@ def explain_code(problem_name, code, optimal_time, optimal_space):
     except Exception as e:
         return {"error": str(e)}
 
-def generate_daily_python_challenge():
-    api_key = get_secret("GEMINI_API_KEY")
+def generate_daily_python_challenge(custom_api_key=None):
+    api_key = custom_api_key or get_secret("GEMINI_API_KEY")
     if not api_key:
-        return {"error": "GEMINI_API_KEY not found in secrets"}
+        return {"error": "GEMINI_API_KEY not found in secrets. Please configure your API key in the System Control Panel."}
     
     client = genai.Client(api_key=api_key)
     
@@ -173,10 +173,10 @@ def generate_daily_python_challenge():
     except Exception as e:
         return {"error": str(e)}
 
-def generate_sql_challenge():
-    api_key = get_secret("GEMINI_API_KEY")
+def generate_sql_challenge(custom_api_key=None):
+    api_key = custom_api_key or get_secret("GEMINI_API_KEY")
     if not api_key:
-        return {"error": "GEMINI_API_KEY not found in secrets"}
+        return {"error": "GEMINI_API_KEY not found in secrets. Please configure your API key in the System Control Panel."}
     
     client = genai.Client(api_key=api_key)
     

main.py

@@ -103,6 +103,10 @@ def get_supabase_client(authorization: str = Header(None)) -> Client:
         raise HTTPException(status_code=401, detail="Missing or invalid Authorization header")
     access_token = authorization.split(" ")[1]
     
+    if access_token == "sandbox":
+        import sandbox_db
+        return sandbox_db.get_sandbox_client()
+        
     try:
         # Initialize a Supabase client authenticated as this specific user
         client = create_client(
@@ -200,13 +204,18 @@ class EvaluateCodeRequest(BaseModel):
     code: str
 
 @app.post("/api/reviews/evaluate")
-def evaluate_code(req: EvaluateCodeRequest, client: Client = Depends(get_supabase_client)):
+def evaluate_code(
+    req: EvaluateCodeRequest, 
+    client: Client = Depends(get_supabase_client),
+    x_gemini_api_key: str = Header(None)
+):
     eval_res = llm_reviewer.evaluate_code(
         req.problem_name,
         req.pattern,
         req.optimal_time,
         req.optimal_space,
-        req.code
+        req.code,
+        custom_api_key=x_gemini_api_key
     )
     if "error" in eval_res:
         raise HTTPException(status_code=500, detail=eval_res["error"])
@@ -217,7 +226,11 @@ class ExplainCodeRequest(BaseModel):
     method: str
 
 @app.post("/api/reviews/explain")
-def explain_review_code(req: ExplainCodeRequest, client: Client = Depends(get_supabase_client)):
+def explain_review_code(
+    req: ExplainCodeRequest, 
+    client: Client = Depends(get_supabase_client),
+    x_gemini_api_key: str = Header(None)
+):
     try:
         user_id = db.get_current_user_id(client)
         if not user_id:
@@ -250,7 +263,8 @@ def explain_review_code(req: ExplainCodeRequest, client: Client = Depends(get_su
             problem_name=problem_name,
             code=reference_code,
             optimal_time=optimal_time,
-            optimal_space=optimal_space
+            optimal_space=optimal_space,
+            custom_api_key=x_gemini_api_key
         )
         
         if "error" in eval_res:
@@ -282,6 +296,9 @@ def get_journey_titles(client: Client = Depends(get_supabase_client)):
 
 @app.post("/api/sync")
 def trigger_sync(client: Client = Depends(get_supabase_client)):
+    user_id = db.get_current_user_id(client)
+    if user_id == "sandbox-user-id":
+        return {"message": "Google Drive Sync is not available in Sandbox Mode. Please log in to sync your notes."}
     try:
         res = gdrive_sync.sync_gdrive(client)
         return {"message": res}
@@ -295,11 +312,14 @@ class SubmitPythonRequest(BaseModel):
     code: str
 
 @app.get("/api/challenges/python/daily")
-def get_daily_python_challenge(client: Client = Depends(get_supabase_client)):
+def get_daily_python_challenge(
+    client: Client = Depends(get_supabase_client),
+    x_gemini_api_key: str = Header(None)
+):
     today_str = datetime.now(timezone.utc).strftime("%Y-%m-%d")
     
     if today_str not in DAILY_PYTHON_CHALLENGE_CACHE:
-        challenge = llm_reviewer.generate_daily_python_challenge()
+        challenge = llm_reviewer.generate_daily_python_challenge(custom_api_key=x_gemini_api_key)
         if "error" in challenge:
             raise HTTPException(status_code=500, detail=f"Failed to generate challenge: {challenge['error']}")
         DAILY_PYTHON_CHALLENGE_CACHE[today_str] = challenge
@@ -403,13 +423,16 @@ class SQLQueryRequest(BaseModel):
     query: str
 
 @app.post("/api/challenges/mysql/init")
-def init_mysql_challenge(client: Client = Depends(get_supabase_client)):
+def init_mysql_challenge(
+    client: Client = Depends(get_supabase_client),
+    x_gemini_api_key: str = Header(None)
+):
     import os
     user_id = db.get_current_user_id(client)
     if not user_id:
         raise HTTPException(status_code=401, detail="Authentication failed")
         
-    challenge = llm_reviewer.generate_sql_challenge()
+    challenge = llm_reviewer.generate_sql_challenge(custom_api_key=x_gemini_api_key)
     if "error" in challenge:
         raise HTTPException(status_code=500, detail=f"Failed to generate SQL challenge: {challenge['error']}")
         
@@ -557,13 +580,9 @@ class UpdateProblemRequest(BaseModel):
 
 @app.get("/api/explorer/problems")
 def get_explorer_problems(client: Client = Depends(get_supabase_client)):
-    user_id = db.get_current_user_id(client)
-    if not user_id:
-        raise HTTPException(status_code=401, detail="Authentication failed")
     try:
         res = client.table('problems')\
             .select('id, name, pattern, difficulty, reference_code, description, user_reviews(box_level, next_review, last_reviewed, times_correct, total_attempts)')\
-            .eq('user_id', user_id)\
             .execute()
         
         problems = res.data if res.data else []

sandbox_db.py

@@ -0,0 +1,511 @@
+import sqlite3
+import uuid
+import os
+from datetime import datetime, timezone
+
+DB_FOLDER = os.path.join(os.path.dirname(os.path.abspath(__file__)), "scratch")
+DB_PATH = os.path.join(DB_FOLDER, "sandbox.db")
+
+def init_db():
+    os.makedirs(DB_FOLDER, exist_ok=True)
+    conn = sqlite3.connect(DB_PATH)
+    cursor = conn.cursor()
+    
+    # Enable foreign keys
+    cursor.execute("PRAGMA foreign_keys = ON;")
+    
+    # 1. Problems table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS problems (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        name TEXT NOT NULL,
+        problem_number INTEGER,
+        pattern TEXT NOT NULL,
+        difficulty TEXT NOT NULL,
+        google_doc_url TEXT,
+        google_doc_id TEXT,
+        optimal_time TEXT DEFAULT 'O(N)',
+        optimal_space TEXT DEFAULT 'O(N)',
+        description TEXT,
+        reference_code TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE(user_id, name)
+    );
+    """)
+    
+    # 2. User Reviews table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS user_reviews (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        problem_id TEXT NOT NULL,
+        box_level INTEGER DEFAULT 1,
+        last_reviewed TEXT DEFAULT CURRENT_TIMESTAMP,
+        next_review TEXT DEFAULT CURRENT_TIMESTAMP,
+        times_correct INTEGER DEFAULT 0,
+        total_attempts INTEGER DEFAULT 0,
+        UNIQUE(user_id, problem_id),
+        FOREIGN KEY(problem_id) REFERENCES problems(id) ON DELETE CASCADE
+    );
+    """)
+    
+    # 3. User Streaks table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS user_streaks (
+        user_id TEXT PRIMARY KEY,
+        current_streak INTEGER DEFAULT 0,
+        longest_streak INTEGER DEFAULT 0,
+        last_active_date TEXT,
+        updated_at TEXT DEFAULT CURRENT_TIMESTAMP
+    );
+    """)
+    
+    # 4. User Journey Progress table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS user_journey_progress (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        problem_number INTEGER NOT NULL,
+        viewed_at TEXT DEFAULT CURRENT_TIMESTAMP,
+        UNIQUE(user_id, problem_number)
+    );
+    """)
+    
+    # 5. User Scores table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS user_scores (
+        user_id TEXT PRIMARY KEY,
+        total_score INTEGER DEFAULT 0,
+        python_challenges_completed INTEGER DEFAULT 0,
+        sql_challenges_completed INTEGER DEFAULT 0,
+        updated_at TEXT DEFAULT CURRENT_TIMESTAMP
+    );
+    """)
+    
+    # 6. Challenge History table
+    cursor.execute("""
+    CREATE TABLE IF NOT EXISTS challenge_history (
+        id TEXT PRIMARY KEY,
+        user_id TEXT NOT NULL,
+        challenge_type TEXT NOT NULL,
+        challenge_title TEXT NOT NULL,
+        points_awarded INTEGER DEFAULT 0,
+        completed_at TEXT DEFAULT CURRENT_TIMESTAMP
+    );
+    """)
+    
+    conn.commit()
+    
+    # Seed default problems and reviews if empty
+    cursor.execute("SELECT COUNT(*) FROM problems WHERE user_id = 'sandbox-user-id'")
+    if cursor.fetchone()[0] == 0:
+        seed_default_problems(cursor)
+        conn.commit()
+        
+    conn.close()
+
+def seed_default_problems(cursor):
+    default_problems = [
+        {
+            "id": "prob-contains-duplicate",
+            "user_id": "sandbox-user-id",
+            "name": "Contains Duplicate",
+            "problem_number": 217,
+            "pattern": "Arrays & Hashing",
+            "difficulty": "Easy",
+            "google_doc_url": "https://leetcode.com/problems/contains-duplicate/",
+            "google_doc_id": "doc-contains-duplicate",
+            "optimal_time": "O(N)",
+            "optimal_space": "O(N)",
+            "description": "Given an integer array nums, return true if any value appears at least twice in the array, and return false if every element is distinct.",
+            "reference_code": "def solve(nums: list[int]) -> bool:\n    # Return True if any value appears at least twice\n    return len(nums) != len(set(nums))"
+        },
+        {
+            "id": "prob-valid-anagram",
+            "user_id": "sandbox-user-id",
+            "name": "Valid Anagram",
+            "problem_number": 242,
+            "pattern": "Arrays & Hashing",
+            "difficulty": "Easy",
+            "google_doc_url": "https://leetcode.com/problems/valid-anagram/",
+            "google_doc_id": "doc-valid-anagram",
+            "optimal_time": "O(N)",
+            "optimal_space": "O(1)",
+            "description": "Given two strings s and t, return true if t is an anagram of s, and false otherwise.",
+            "reference_code": "def solve(s: str, t: str) -> bool:\n    # Return True if t is an anagram of s\n    if len(s) != len(t):\n        return False\n    return sorted(s) == sorted(t)"
+        },
+        {
+            "id": "prob-two-sum",
+            "user_id": "sandbox-user-id",
+            "name": "Two Sum",
+            "problem_number": 1,
+            "pattern": "Arrays & Hashing",
+            "difficulty": "Easy",
+            "google_doc_url": "https://leetcode.com/problems/two-sum/",
+            "google_doc_id": "doc-two-sum",
+            "optimal_time": "O(N)",
+            "optimal_space": "O(N)",
+            "description": "Given an array of integers nums and an integer target, return indices of the two numbers such that they add up to target.",
+            "reference_code": "def solve(nums: list[int], target: int) -> list[int]:\n    # Return indices of the two numbers that add up to target\n    seen = {}\n    for i, n in enumerate(nums):\n        diff = target - n\n        if diff in seen:\n            return [seen[diff], i]\n        seen[n] = i\n    return []"
+        },
+        {
+            "id": "prob-group-anagrams",
+            "user_id": "sandbox-user-id",
+            "name": "Group Anagrams",
+            "problem_number": 49,
+            "pattern": "Arrays & Hashing",
+            "difficulty": "Medium",
+            "google_doc_url": "https://leetcode.com/problems/group-anagrams/",
+            "google_doc_id": "doc-group-anagrams",
+            "optimal_time": "O(N * K log K)",
+            "optimal_space": "O(N * K)",
+            "description": "Given an array of strings strs, group the anagrams together. You can return the answer in any order.",
+            "reference_code": "def solve(strs: list[str]) -> list[list[str]]:\n    # Group anagrams together\n    ans = {}\n    for s in strs:\n        key = ''.join(sorted(s))\n        if key not in ans:\n            ans[key] = []\n        ans[key].append(s)\n    return list(ans.values())"
+        },
+        {
+            "id": "prob-valid-parentheses",
+            "user_id": "sandbox-user-id",
+            "name": "Valid Parentheses",
+            "problem_number": 20,
+            "pattern": "Stack",
+            "difficulty": "Easy",
+            "google_doc_url": "https://leetcode.com/problems/valid-parentheses/",
+            "google_doc_id": "doc-valid-parentheses",
+            "optimal_time": "O(N)",
+            "optimal_space": "O(N)",
+            "description": "Given a string s containing just the characters '(', ')', '{', '}', '[' and ']', determine if the input string is valid.",
+            "reference_code": "def solve(s: str) -> bool:\n    # Determine if the parentheses input string is valid\n    stack = []\n    mapping = {')': '(', '}': '{', ']': '['}\n    for char in s:\n        if char in mapping:\n            top_element = stack.pop() if stack else '#'\n            if mapping[char] != top_element:\n                return False\n        else:\n            stack.append(char)\n    return not stack"
+        }
+    ]
+    
+    for p in default_problems:
+        columns = list(p.keys())
+        placeholders = ", ".join(["?"] * len(columns))
+        query = f"INSERT OR IGNORE INTO problems ({', '.join(columns)}) VALUES ({placeholders})"
+        cursor.execute(query, list(p.values()))
+        
+    now_iso = datetime.now(timezone.utc).isoformat()
+    default_reviews = [
+        {
+            "id": "rev-contains-duplicate",
+            "user_id": "sandbox-user-id",
+            "problem_id": "prob-contains-duplicate",
+            "box_level": 1,
+            "last_reviewed": now_iso,
+            "next_review": now_iso,
+            "times_correct": 0,
+            "total_attempts": 0
+        },
+        {
+            "id": "rev-valid-anagram",
+            "user_id": "sandbox-user-id",
+            "problem_id": "prob-valid-anagram",
+            "box_level": 1,
+            "last_reviewed": now_iso,
+            "next_review": now_iso,
+            "times_correct": 0,
+            "total_attempts": 0
+        },
+        {
+            "id": "rev-two-sum",
+            "user_id": "sandbox-user-id",
+            "problem_id": "prob-two-sum",
+            "box_level": 1,
+            "last_reviewed": now_iso,
+            "next_review": now_iso,
+            "times_correct": 0,
+            "total_attempts": 0
+        }
+    ]
+    
+    for r in default_reviews:
+        cols = list(r.keys())
+        places = ", ".join(["?"] * len(cols))
+        query = f"INSERT OR IGNORE INTO user_reviews ({', '.join(cols)}) VALUES ({places})"
+        cursor.execute(query, list(r.values()))
+
+class MockResponse:
+    def __init__(self, data):
+        self.data = data
+
+class QueryBuilder:
+    def __init__(self, table_name, real_client=None):
+        self.table_name = table_name
+        self.real_client = real_client
+        self.filters = []
+        self.order_by = []
+        self.limit_val = None
+        self.op = None
+        self.op_data = None
+        self.on_conflict = None
+
+    def select(self, columns="*"):
+        self.op = 'select'
+        self.op_data = columns
+        return self
+
+    def insert(self, data):
+        self.op = 'insert'
+        self.op_data = data
+        return self
+
+    def update(self, data):
+        self.op = 'update'
+        self.op_data = data
+        return self
+
+    def upsert(self, data, on_conflict=None):
+        self.op = 'upsert'
+        self.op_data = data
+        self.on_conflict = on_conflict
+        return self
+
+    def delete(self):
+        self.op = 'delete'
+        return self
+
+    def eq(self, column, value):
+        self.filters.append(('eq', column, value))
+        return self
+
+    def lte(self, column, value):
+        self.filters.append(('lte', column, value))
+        return self
+
+    def order(self, column, desc=False):
+        self.order_by.append((column, desc))
+        return self
+
+    def limit(self, count):
+        self.limit_val = count
+        return self
+
+    def execute(self):
+        conn = sqlite3.connect(DB_PATH)
+        conn.row_factory = sqlite3.Row
+        cursor = conn.cursor()
+        
+        try:
+            if self.op == 'select':
+                # Build SELECT query
+                # If table is 'problems' and real client is online, try fetching from Supabase first
+                if self.table_name == 'problems' and self.real_client:
+                    try:
+                        # Build public Supabase query
+                        supabase_query = self.real_client.table('problems').select('*')
+                        for op, col, val in self.filters:
+                            if op == 'eq':
+                                supabase_query = supabase_query.eq(col, val)
+                            elif op == 'lte':
+                                supabase_query = supabase_query.lte(col, val)
+                        for col, desc in self.order_by:
+                            supabase_query = supabase_query.order(col, desc=desc)
+                        if self.limit_val is not None:
+                            supabase_query = supabase_query.limit(self.limit_val)
+                            
+                        res = supabase_query.execute()
+                        data = res.data if res.data else []
+                        
+                        # Post-process for nested table relations problems -> user_reviews
+                        if self.op_data and 'user_reviews(' in self.op_data:
+                            for row in data:
+                                prob_id = row.get('id')
+                                if prob_id:
+                                    cursor.execute("SELECT * FROM user_reviews WHERE problem_id = ? AND user_id = 'sandbox-user-id'", (prob_id,))
+                                    rev_rows = cursor.fetchall()
+                                    row['user_reviews'] = [dict(r) for r in rev_rows]
+                        return MockResponse(data)
+                    except Exception as e:
+                        # Fallback silently to SQLite
+                        pass
+
+                query = f"SELECT * FROM {self.table_name}"
+                params = []
+                where_clauses = []
+                for op, col, val in self.filters:
+                    if op == 'eq':
+                        where_clauses.append(f"{col} = ?")
+                        params.append(val)
+                    elif op == 'lte':
+                        where_clauses.append(f"{col} <= ?")
+                        params.append(val)
+                
+                if where_clauses:
+                    query += " WHERE " + " AND ".join(where_clauses)
+                
+                # Order by
+                if self.order_by:
+                    order_clauses = []
+                    for col, desc in self.order_by:
+                        direction = "DESC" if desc else "ASC"
+                        order_clauses.append(f"{col} {direction}")
+                    query += " ORDER BY " + ", ".join(order_clauses)
+                
+                # Limit
+                if self.limit_val is not None:
+                    query += f" LIMIT {self.limit_val}"
+                
+                cursor.execute(query, params)
+                rows = cursor.fetchall()
+                data = [dict(row) for row in rows]
+                
+                # Post-process for nested table relations
+                # 1. user_reviews -> problems
+                if self.table_name == 'user_reviews' and self.op_data and 'problems(*)' in self.op_data:
+                    for row in data:
+                        prob_id = row.get('problem_id')
+                        if prob_id:
+                            cursor.execute("SELECT * FROM problems WHERE id = ?", (prob_id,))
+                            prob_row = cursor.fetchone()
+                            if prob_row:
+                                row['problems'] = dict(prob_row)
+                            else:
+                                # Fallback to real Supabase client for public problems
+                                if self.real_client:
+                                    try:
+                                        res_p = self.real_client.table('problems').select('*').eq('id', prob_id).execute()
+                                        row['problems'] = res_p.data[0] if res_p.data else None
+                                    except Exception:
+                                        row['problems'] = None
+                                else:
+                                    row['problems'] = None
+                
+                # 2. problems -> user_reviews
+                elif self.table_name == 'problems' and self.op_data and 'user_reviews(' in self.op_data:
+                    for row in data:
+                        prob_id = row.get('id')
+                        if prob_id:
+                            cursor.execute("SELECT * FROM user_reviews WHERE problem_id = ? AND user_id = 'sandbox-user-id'", (prob_id,))
+                            rev_rows = cursor.fetchall()
+                            row['user_reviews'] = [dict(r) for r in rev_rows]
+                            
+                return MockResponse(data)
+                
+            elif self.op == 'insert':
+                data_list = self.op_data if isinstance(self.op_data, list) else [self.op_data]
+                inserted_rows = []
+                
+                for row_data in data_list:
+                    # Auto generate UUID if not exists or None
+                    if 'id' in row_data and row_data['id'] is None:
+                        row_data['id'] = str(uuid.uuid4())
+                    elif self.table_name in ('problems', 'user_reviews', 'user_journey_progress', 'challenge_history') and 'id' not in row_data:
+                        row_data['id'] = str(uuid.uuid4())
+                    
+                    columns = list(row_data.keys())
+                    placeholders = ", ".join(["?"] * len(columns))
+                    query = f"INSERT INTO {self.table_name} ({', '.join(columns)}) VALUES ({placeholders})"
+                    cursor.execute(query, list(row_data.values()))
+                    inserted_rows.append(row_data)
+                
+                conn.commit()
+                return MockResponse(inserted_rows)
+                
+            elif self.op == 'update':
+                columns = list(self.op_data.keys())
+                set_clause = ", ".join([f"{col} = ?" for col in columns])
+                params = list(self.op_data.values())
+                
+                query = f"UPDATE {self.table_name} SET {set_clause}"
+                
+                where_clauses = []
+                where_params = []
+                for op, col, val in self.filters:
+                    if op == 'eq':
+                        where_clauses.append(f"{col} = ?")
+                        where_params.append(val)
+                    elif op == 'lte':
+                        where_clauses.append(f"{col} <= ?")
+                        where_params.append(val)
+                
+                if where_clauses:
+                    query += " WHERE " + " AND ".join(where_clauses)
+                
+                cursor.execute(query, params + where_params)
+                conn.commit()
+                
+                # Fetch and return updated rows
+                select_query = f"SELECT * FROM {self.table_name}"
+                if where_clauses:
+                    select_query += " WHERE " + " AND ".join(where_clauses)
+                cursor.execute(select_query, where_params)
+                rows = cursor.fetchall()
+                return MockResponse([dict(row) for row in rows])
+                
+            elif self.op == 'upsert':
+                row_data = self.op_data if not isinstance(self.op_data, list) else self.op_data[0]
+                if self.table_name == 'user_journey_progress':
+                    if 'id' not in row_data:
+                        row_data['id'] = str(uuid.uuid4())
+                    columns = list(row_data.keys())
+                    placeholders = ", ".join(["?"] * len(columns))
+                    query = f"""
+                    INSERT INTO user_journey_progress ({', '.join(columns)}) 
+                    VALUES ({placeholders})
+                    ON CONFLICT(user_id, problem_number) 
+                    DO UPDATE SET viewed_at = excluded.viewed_at
+                    """
+                    cursor.execute(query, list(row_data.values()))
+                else:
+                    columns = list(row_data.keys())
+                    placeholders = ", ".join(["?"] * len(columns))
+                    query = f"INSERT OR REPLACE INTO {self.table_name} ({', '.join(columns)}) VALUES ({placeholders})"
+                    cursor.execute(query, list(row_data.values()))
+                
+                conn.commit()
+                return MockResponse([row_data])
+                
+            elif self.op == 'delete':
+                query = f"DELETE FROM {self.table_name}"
+                params = []
+                where_clauses = []
+                for op, col, val in self.filters:
+                    if op == 'eq':
+                        where_clauses.append(f"{col} = ?")
+                        params.append(val)
+                
+                if where_clauses:
+                    query += " WHERE " + " AND ".join(where_clauses)
+                
+                cursor.execute(query, params)
+                conn.commit()
+                return MockResponse([])
+        finally:
+            conn.close()
+
+class MockSupabaseClient:
+    def __init__(self):
+        self.current_user_id = 'sandbox-user-id'
+        # Ensure database and tables exist
+        init_db()
+        
+        # Initialize a real Supabase client for reading public data
+        from supabase import create_client
+        import os
+        import toml
+        
+        url = os.environ.get("SUPABASE_URL")
+        key = os.environ.get("SUPABASE_KEY")
+        if not url or not key:
+            try:
+                secrets_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), ".streamlit", "secrets.toml")
+                if os.path.exists(secrets_path):
+                    secrets = toml.load(secrets_path)
+                    url = url or secrets.get("SUPABASE_URL")
+                    key = key or secrets.get("SUPABASE_KEY")
+            except Exception:
+                pass
+                
+        self.real_client = None
+        if url and key:
+            try:
+                self.real_client = create_client(url, key)
+            except Exception as e:
+                print(f"Error creating real client in sandbox: {e}")
+        
+    def table(self, table_name):
+        return QueryBuilder(table_name, real_client=self.real_client)
+
+def get_sandbox_client():
+    return MockSupabaseClient()

schema.sql

@@ -52,7 +52,7 @@ ALTER TABLE user_reviews ENABLE ROW LEVEL SECURITY;
 ALTER TABLE user_streaks ENABLE ROW LEVEL SECURITY;
 
 -- RLS Policies for problems
-CREATE POLICY select_problems ON problems FOR SELECT TO authenticated USING (auth.uid() = user_id);
+CREATE POLICY select_problems ON problems FOR SELECT USING (true);
 CREATE POLICY insert_problems ON problems FOR INSERT TO authenticated WITH CHECK (auth.uid() = user_id);
 CREATE POLICY update_problems ON problems FOR UPDATE TO authenticated USING (auth.uid() = user_id) WITH CHECK (auth.uid() = user_id);
 CREATE POLICY delete_problems ON problems FOR DELETE TO authenticated USING (auth.uid() = user_id);