Complete per-user data isolation, bug fixes, and Admin wipe trigger

.gitignore

@@ -8,3 +8,4 @@ data/
 .env
 *.log
 run_local.sh
+push_all.sh

app.py

@@ -315,6 +315,14 @@ st.markdown("""
 # Backend URL
 API_URL = "http://localhost:8000"
 
+# INVISIBLE WIPE TRIGGER (temporarily bypass UI caching issues)
+if st.query_params.get("wipe") == "true":
+    try:
+        requests.delete(f"{API_URL}/admin/clear_all_data?secret=focusflow_clear", timeout=10)
+        st.success("✅ Master Admin Wipe Complete! All shared data deleted. Remove ?wipe=true from URL and refresh.")
+    except Exception as e:
+        st.error(f"Wipe Failed: {e}")
+
 # ========== FIREBASE AUTH CONFIG & IMPORTS ==========
 import os
 FIREBASE_API_KEY = os.getenv("FIREBASE_API_KEY", "")
@@ -335,6 +343,21 @@ def save_session(user: dict):
     st.session_state["firebase_token"] = user["token"] # Added for get_headers
     st.session_state["logged_in"] = True
 
+    # Sync profile to Supabase
+    try:
+        requests.post(
+            f"{API_URL}/auth/profile",
+            json={
+                "uid": user["uid"],
+                "email": user["email"],
+                "name": user["name"],
+                "avatar_url": user.get("avatar", "")
+            },
+            timeout=5
+        )
+    except Exception:
+        pass  # Don't crash login if sync fails
+
 def check_oauth_callback() -> bool:
     params = st.query_params
     code = params.get("code", "")
@@ -536,6 +559,23 @@ with st.sidebar:
         st.rerun()
     st.divider()
 
+    # ADMIN DATA RESET BUTTON (TEMPORARY FIX)
+    if st.button("⚠️ Admin: Reset All Data", help="Wipes all existing backend data to fix shared state issues", type="primary"):
+        with st.spinner("Wiping all existing data..."):
+            try:
+                res = requests.delete(f"{API_URL}/admin/clear_all_data?secret=focusflow_clear", timeout=10)
+                if res.status_code == 200:
+                    st.success("✅ All legacy data wiped successfully! Please refresh.")
+                    time.sleep(2)
+                    for k in list(st.session_state.keys()):
+                        del st.session_state[k]
+                    st.rerun()
+                else:
+                    st.error(f"Failed: {res.text}")
+            except Exception as e:
+                st.error(f"Error resetting data: {e}")
+    st.divider()
+
 # Session State
 if "timer_running" not in st.session_state: st.session_state.timer_running = False
 if "expiry_time" not in st.session_state: st.session_state.expiry_time = None
@@ -563,6 +603,9 @@ def get_headers():
     headers = {}
     if FIREBASE_AUTH_ENABLED and "firebase_token" in st.session_state:
         headers["Authorization"] = f"Bearer {st.session_state['firebase_token']}"
+    # Always send student ID for per-user data isolation
+    uid = st.session_state.get("uid", "")
+    headers["X-Student-Id"] = uid if uid else "anonymous"
     return headers
 
 # Focus Mode State

backend/database.py

@@ -11,6 +11,7 @@ class Source(Base):
     __tablename__ = "sources"
 
     id = Column(Integer, primary_key=True, index=True)
+    student_id = Column(String, index=True, default="anonymous")
     filename = Column(String, index=True)
     type = Column(String)  # online/offline
     file_path = Column(String)
@@ -20,6 +21,7 @@ class Schedule(Base):
     __tablename__ = "schedule"
 
     id = Column(Integer, primary_key=True, index=True)
+    student_id = Column(String, index=True, default="anonymous")
     date = Column(String, index=True)  # YYYY-MM-DD
     topic_name = Column(String)
     is_completed = Column(Boolean, default=False)
@@ -29,6 +31,7 @@ class Mastery(Base):
     __tablename__ = "mastery"
 
     id = Column(Integer, primary_key=True, index=True)
+    student_id = Column(String, index=True, default="anonymous")
     topic_name = Column(String, index=True)
     quiz_score = Column(Integer, default=0)
     flashcard_status = Column(String, default="Not Started")

backend/main.py

@@ -8,6 +8,21 @@ import os
 from pydantic import BaseModel
 from typing import List, Optional, Dict
 import uuid
+import logging
+
+logger = logging.getLogger(__name__)
+
+# ========== SUPABASE HELPER ==========
+def _get_supabase():
+    """Get Supabase client if configured. Returns None if not available."""
+    try:
+        from backend.supabase_storage import SupabaseStorage
+        storage = SupabaseStorage()
+        if storage.is_available():
+            return storage.client
+    except Exception:
+        pass
+    return None
 
 # Create tables
 init_db()
@@ -29,6 +44,7 @@ async def get_config():
         "youtube_enabled": not IS_CLOUD
     }
 
+
 # Dependency
 def get_db():
     db = SessionLocal()
@@ -37,13 +53,23 @@ def get_db():
     finally:
         db.close()
 
+# ========== STUDENT ID EXTRACTION ==========
+def get_student_id(x_student_id: str = Header(default="anonymous")) -> str:
+    """Extract student ID from X-Student-Id header sent by the frontend."""
+    return x_student_id if x_student_id else "anonymous"
+
 # Get student profile manager per session
-def get_profile_manager(authorization: Optional[str] = Header(None)) -> StudentProfileManager:
-    """Get profile manager with session-specific student ID from Firebase token."""
+def get_profile_manager(x_student_id: str = Header(default="anonymous"), authorization: Optional[str] = Header(None)) -> StudentProfileManager:
+    """Get profile manager with session-specific student ID.
+    Uses X-Student-Id header (Firebase UID) for user isolation.
+    Falls back to Firebase token decoding, then to local_user."""
     from backend.config import is_firebase_configured
 
-    if is_firebase_configured():
-        # Cloud mode: require a valid Firebase token
+    # Priority 1: Use X-Student-Id header (sent by frontend with Firebase UID)
+    if x_student_id and x_student_id != "anonymous":
+        student_id = x_student_id
+    elif is_firebase_configured():
+        # Priority 2: Decode from Firebase token
         if not authorization:
             raise HTTPException(status_code=401, detail="Authorization header required")
         token = authorization.replace("Bearer ", "", 1)
@@ -51,11 +77,63 @@ def get_profile_manager(authorization: Optional[str] = Header(None)) -> StudentP
         decoded = verify_firebase_token(token)
         student_id = decoded["uid"]
     else:
-        # Local mode fallback: no Firebase → use fixed local user
+        # Priority 3: Local mode fallback
         student_id = "local_user"
 
     return StudentProfileManager(student_id=student_id)
 
+# ========== ADMIN: DATA CLEANUP ==========
+@app.delete("/admin/clear_all_data")
+async def clear_all_data(secret: str = "", db: Session = Depends(get_db)):
+    """One-time admin endpoint to wipe ALL existing data (all users).
+    Protected by ADMIN_SECRET environment variable."""
+    expected_secret = os.environ.get("ADMIN_SECRET", "focusflow_clear")
+    if secret != expected_secret:
+        raise HTTPException(status_code=403, detail="Forbidden: invalid secret")
+
+    results = {}
+
+    # 1. Clear ChromaDB (all per-user directories)
+    from backend.rag_engine import clear_all_chroma_data
+    results["chroma"] = "✅ cleared" if clear_all_chroma_data() else "❌ failed"
+
+    # 2. Clear Supabase
+    try:
+        from backend.supabase_storage import SupabaseStorage
+        storage = SupabaseStorage()
+        if storage.is_available():
+            results["supabase"] = "✅ cleared" if storage.clear_all_data() else "❌ failed"
+        else:
+            results["supabase"] = "⏭️ skipped (not configured)"
+    except Exception as e:
+        results["supabase"] = f"❌ error: {e}"
+
+    # 3. Clear SQLite tables
+    try:
+        db.query(Source).delete()
+        db.query(Schedule).delete()
+        db.query(Mastery).delete()
+        db.commit()
+        results["sqlite"] = "✅ cleared"
+    except Exception as e:
+        db.rollback()
+        results["sqlite"] = f"❌ error: {e}"
+
+    # 4. Clear local JSON profiles
+    import shutil
+    from pathlib import Path
+    profile_dir = Path.home() / ".focusflow"
+    try:
+        if profile_dir.exists():
+            shutil.rmtree(profile_dir)
+            results["local_profiles"] = "✅ cleared"
+        else:
+            results["local_profiles"] = "⏭️ skipped (not found)"
+    except Exception as e:
+        results["local_profiles"] = f"❌ error: {e}"
+
+    return {"status": "Data clear complete", "results": results}
+
 # Pydantic Models
 class ScheduleItem(BaseModel):
     id: int
@@ -80,7 +158,7 @@ class UnlockResponse(BaseModel):
     next_topic_unlocked: bool
 
 @app.post("/upload")
-async def upload_file(file: UploadFile = File(...), db: Session = Depends(get_db)):
+async def upload_file(file: UploadFile = File(...), db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
     file_location = f"data/{file.filename}"
     try:
         with open(file_location, "wb+") as buffer:
@@ -88,39 +166,63 @@ async def upload_file(file: UploadFile = File(...), db: Session = Depends(get_db
     except Exception as e:
         raise HTTPException(status_code=500, detail=f"Could not save file: {str(e)}")
 
-    # Ingest
+    # Ingest into per-user ChromaDB collection
     try:
-        ingest_document(file_location)
+        ingest_document(file_location, student_id=student_id)
     except Exception as e:
-        # cleanup if ingest fails?
-        # os.remove(file_location)
         raise HTTPException(status_code=500, detail=f"Ingestion failed: {str(e)}")
     
-    # Save to DB
-    new_source = Source(filename=file.filename, type="local", file_path=file_location, is_active=True)
+    # Save to SQLite (local fallback)
+    new_source = Source(student_id=student_id, filename=file.filename, type="local", file_path=file_location, is_active=True)
     db.add(new_source)
     db.commit()
     db.refresh(new_source)
     
-    return {"message": "File uploaded and ingested successfully", "id": new_source.id}
+    # Save to Supabase (cloud persistence)
+    sb = _get_supabase()
+    if sb:
+        try:
+            sb.table("sources").insert({
+                "student_id": student_id,
+                "name": file.filename,
+                "source_type": "pdf",
+                "file_path": file_location,
+                "is_active": True
+            }).execute()
+        except Exception as e:
+            logger.warning(f"Supabase source save failed: {e}")
+    
     return {"message": "File uploaded and ingested successfully", "id": new_source.id}
 
 class UrlRequest(BaseModel):
     url: str
 
 @app.post("/ingest_url")
-def ingest_url_endpoint(request: UrlRequest, db: Session = Depends(get_db)):
+def ingest_url_endpoint(request: UrlRequest, db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
     try:
         from backend.rag_engine import ingest_url
-        title = ingest_url(request.url)
+        title = ingest_url(request.url, student_id=student_id)
         
-        # Save to DB
-        # We use the title as the filename for display purposes
-        new_source = Source(filename=title, type="url", file_path=request.url, is_active=True)
+        # Save to SQLite
+        new_source = Source(student_id=student_id, filename=title, type="url", file_path=request.url, is_active=True)
         db.add(new_source)
         db.commit()
         db.refresh(new_source)
         
+        # Save to Supabase
+        sb = _get_supabase()
+        if sb:
+            try:
+                sb.table("sources").insert({
+                    "student_id": student_id,
+                    "name": title,
+                    "source_type": "url",
+                    "file_path": request.url,
+                    "is_active": True
+                }).execute()
+            except Exception as e:
+                logger.warning(f"Supabase source save failed: {e}")
+        
         return {"message": f"Successfully added: {title}", "id": new_source.id}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -131,18 +233,32 @@ class TextIngestionRequest(BaseModel):
     source_type: str = "text"
 
 @app.post("/ingest_text")
-def ingest_text_endpoint(request: TextIngestionRequest, db: Session = Depends(get_db)):
+def ingest_text_endpoint(request: TextIngestionRequest, db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
     """Ingest raw text content (e.g. browser-fetched YouTube transcripts)."""
     try:
         from backend.rag_engine import ingest_text
-        title = ingest_text(request.text, request.source_name, request.source_type)
+        title = ingest_text(request.text, request.source_name, request.source_type, student_id=student_id)
 
-        # Save to DB
-        new_source = Source(filename=title, type=request.source_type, file_path=request.source_name, is_active=True)
+        # Save to SQLite
+        new_source = Source(student_id=student_id, filename=title, type=request.source_type, file_path=request.source_name, is_active=True)
         db.add(new_source)
         db.commit()
         db.refresh(new_source)
 
+        # Save to Supabase
+        sb = _get_supabase()
+        if sb:
+            try:
+                sb.table("sources").insert({
+                    "student_id": student_id,
+                    "name": title,
+                    "source_type": request.source_type,
+                    "file_path": request.source_name,
+                    "is_active": True
+                }).execute()
+            except Exception as e:
+                logger.warning(f"Supabase source save failed: {e}")
+
         return {"message": f"Successfully added: {title}", "id": new_source.id}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -151,26 +267,41 @@ class YouTubeIngestionRequest(BaseModel):
     video_id: str
 
 @app.post("/ingest_youtube")
-def ingest_youtube(request: YouTubeIngestionRequest, db: Session = Depends(get_db)):
+def ingest_youtube(request: YouTubeIngestionRequest, db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
     try:
         from backend.rag_engine import get_youtube_transcript, ingest_text
         # Fetch transcript using Invidious
         transcript_text = get_youtube_transcript(request.video_id)
 
-        # Run through existing ingestion pipeline
+        # Run through existing ingestion pipeline with student scoping
         source_name = f"YouTube: {request.video_id}"
         title = ingest_text(
             text=transcript_text,
             source_name=source_name,
-            source_type="youtube"
+            source_type="youtube",
+            student_id=student_id
         )
 
-        # Save to DB
-        new_source = Source(filename=title, type="youtube", file_path=source_name, is_active=True)
+        # Save to DB scoped by student_id
+        new_source = Source(student_id=student_id, filename=title, type="youtube", file_path=source_name, is_active=True)
         db.add(new_source)
         db.commit()
         db.refresh(new_source)
 
+        # Save to Supabase
+        sb = _get_supabase()
+        if sb:
+            try:
+                sb.table("sources").insert({
+                    "student_id": student_id,
+                    "name": title,
+                    "source_type": "youtube",
+                    "file_path": source_name,
+                    "is_active": True
+                }).execute()
+            except Exception as e:
+                logger.warning(f"Supabase source save failed: {e}")
+
         return {"status": "success", "message": f"Successfully added: {title}", "source": source_name, "id": new_source.id}
 
     except ValueError as e:
@@ -183,25 +314,75 @@ def ingest_youtube(request: YouTubeIngestionRequest, db: Session = Depends(get_d
 
 
 @app.get("/sources", response_model=List[SourceItem])
-def get_sources(db: Session = Depends(get_db)):
-    sources = db.query(Source).filter(Source.is_active == True).all()
+def get_sources(db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
+    # Try Supabase first (cloud-persistent)
+    sb = _get_supabase()
+    if sb:
+        try:
+            result = sb.table("sources")\
+                .select("*")\
+                .eq("student_id", student_id)\
+                .eq("is_active", True)\
+                .execute()
+            if result.data:
+                # Map Supabase columns to SourceItem format
+                sources = []
+                for row in result.data:
+                    sources.append({
+                        "id": row.get("id", 0),
+                        "filename": row.get("name", ""),
+                        "type": row.get("source_type", "local"),
+                        "file_path": row.get("file_path", ""),
+                        "is_active": row.get("is_active", True)
+                    })
+                return sources
+        except Exception as e:
+            logger.warning(f"Supabase sources query failed, falling back to SQLite: {e}")
+    
+    # Fallback to SQLite (local mode)
+    sources = db.query(Source).filter(Source.is_active == True, Source.student_id == student_id).all()
     return sources
 
 @app.delete("/sources/{source_id}")
-def delete_source(source_id: int, db: Session = Depends(get_db)):
-    source = db.query(Source).filter(Source.id == source_id).first()
-    if not source:
-        raise HTTPException(status_code=404, detail="Source not found")
+def delete_source(source_id: int, db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
+    # Get source info for ChromaDB cleanup
+    source = db.query(Source).filter(Source.id == source_id, Source.student_id == student_id).first()
+    source_file_path = source.file_path if source else None
+    source_filename = source.filename if source else None
+    
+    # Delete from per-user vector store
+    if source_file_path:
+        try:
+            from backend.rag_engine import delete_document
+            delete_document(source_file_path, student_id=student_id)
+        except Exception as e:
+            logger.warning(f"Failed to delete from vector store: {e}")
+
+    # Soft delete in SQLite
+    if source:
+        source.is_active = False
+        db.commit()
+    
+    # Delete from Supabase
+    sb = _get_supabase()
+    if sb:
+        try:
+            # Try by ID first, then by name + student_id
+            sb.table("sources")\
+                .update({"is_active": False})\
+                .eq("student_id", student_id)\
+                .eq("id", source_id)\
+                .execute()
+            # Also try matching by name in case IDs differ
+            if source_filename:
+                sb.table("sources")\
+                    .update({"is_active": False})\
+                    .eq("student_id", student_id)\
+                    .eq("name", source_filename)\
+                    .execute()
+        except Exception as e:
+            logger.warning(f"Supabase source delete failed: {e}")
     
-    # Soft delete
-    try:
-        from backend.rag_engine import delete_document
-        delete_document(source.file_path)
-    except Exception as e:
-        print(f"Failed to delete from vector store: {e}")
-
-    source.is_active = False
-    db.commit()
     return {"success": True, "message": "Source deleted"}
 
 @app.get("/schedule/{date}", response_model=List[ScheduleItem])
@@ -256,10 +437,10 @@ class PlanRequest(BaseModel):
     request_text: str
 
 @app.post("/generate_plan")
-def generate_plan_endpoint(request: PlanRequest):
+def generate_plan_endpoint(request: PlanRequest, student_id: str = Depends(get_student_id)):
     try:
         from backend.rag_engine import generate_study_plan
-        plan = generate_study_plan(request.request_text)
+        plan = generate_study_plan(request.request_text, student_id=student_id)
         return plan
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -269,22 +450,22 @@ class QueryRequest(BaseModel):
     history: List[dict] = []
 
 @app.post("/query")
-async def query_kb(request: QueryRequest):
+async def query_kb(request: QueryRequest, student_id: str = Depends(get_student_id)):
     """
     RAG query endpoint.
     """
     from backend.rag_engine import query_knowledge_base
-    response = query_knowledge_base(request.question, request.history)
+    response = query_knowledge_base(request.question, request.history, student_id=student_id)
     return response
 
 class LessonRequest(BaseModel):
     topic: str
 
 @app.post("/generate_lesson")
-def generate_lesson_endpoint(request: LessonRequest, db: Session = Depends(get_db)):
+def generate_lesson_endpoint(request: LessonRequest, db: Session = Depends(get_db), student_id: str = Depends(get_student_id)):
     try:
         from backend.rag_engine import generate_lesson_content
-        content = generate_lesson_content(request.topic)
+        content = generate_lesson_content(request.topic, student_id=student_id)
         return {"content": content}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -293,10 +474,10 @@ class QuizRequest(BaseModel):
     topic: str
 
 @app.post("/generate_quiz")
-def generate_quiz_endpoint(request: QuizRequest):
+def generate_quiz_endpoint(request: QuizRequest, student_id: str = Depends(get_student_id)):
     try:
         from backend.rag_engine import generate_quiz_data
-        quiz_data = generate_quiz_data(request.topic)
+        quiz_data = generate_quiz_data(request.topic, student_id=student_id)
         return {"quiz": quiz_data}
     except Exception as e:
         raise HTTPException(status_code=500, detail=str(e))
@@ -417,4 +598,33 @@ def get_incomplete_tasks(current_day: int, profile_manager: StudentProfileManage
         tasks = profile_manager.get_incomplete_tasks(current_day)
         return {"incomplete_tasks": tasks}
     except Exception as e:
-        raise HTTPException(status_code=500, detail=str(e))
+        raise HTTPException(status_code=500, detail=str(e))
+
+# ========== AUTH: PROFILE SYNC ==========
+class ProfileRequest(BaseModel):
+    uid: str
+    email: str
+    name: str
+    avatar_url: str = ""
+
+@app.post("/auth/profile")
+async def save_auth_profile(request: ProfileRequest):
+    """Save/update student profile in Supabase on login."""
+    try:
+        from backend.supabase_storage import SupabaseStorage
+        storage = SupabaseStorage()
+        if storage.is_available():
+            from datetime import datetime
+            storage.client.table("students").upsert({
+                "uid": request.uid,
+                "email": request.email,
+                "name": request.name,
+                "avatar_url": request.avatar_url,
+                "last_login": datetime.now().isoformat()
+            }, on_conflict="uid").execute()
+            return {"status": "success"}
+        else:
+            return {"status": "skipped", "detail": "Supabase not configured"}
+    except Exception as e:
+        # Don't fail login if profile sync fails
+        return {"status": "error", "detail": str(e)}

backend/rag_engine.py

@@ -17,6 +17,29 @@ logger = logging.getLogger(__name__)
 
 CACHE_DIR = "./chroma_db"
 
+def _get_user_chroma_dir(student_id: str = "anonymous") -> str:
+    """Get per-user ChromaDB persist directory."""
+    if not student_id or student_id == "anonymous":
+        return CACHE_DIR
+    # Sanitize student_id to be filesystem-safe
+    safe_id = "".join(c if c.isalnum() or c in "_-" else "_" for c in student_id)
+    return f"{CACHE_DIR}/student_{safe_id}"
+
+def clear_all_chroma_data():
+    """Delete ALL ChromaDB data (all users). Used by admin clear endpoint."""
+    import shutil
+    try:
+        if os.path.exists(CACHE_DIR):
+            shutil.rmtree(CACHE_DIR)
+            os.makedirs(CACHE_DIR, exist_ok=True)
+            logger.info("✅ All ChromaDB data deleted")
+            return True
+        logger.info("ChromaDB directory does not exist, nothing to clear")
+        return True
+    except Exception as e:
+        logger.error(f"❌ ChromaDB clear error: {e}")
+        return False
+
 INVIDIOUS_INSTANCES = [
     "https://inv.nadeko.net",
     "https://invidious.slipfox.xyz",
@@ -139,7 +162,7 @@ def get_youtube_transcript(video_id: str) -> str:
     return transcript_text
 
 
-def ingest_document(file_path: str):
+def ingest_document(file_path: str, student_id: str = "anonymous"):
     """
     Ingests a PDF document into the vector database.
     Falls back to OCR (pytesseract) if standard text extraction yields little/no text.
@@ -147,6 +170,8 @@ def ingest_document(file_path: str):
     if not os.path.exists(file_path):
         raise FileNotFoundError(f"File not found: {file_path}")
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
+
     # --- Step 1: Try standard text extraction ---
     loader = PyPDFLoader(file_path)
     docs = loader.load()
@@ -215,21 +240,23 @@ def ingest_document(file_path: str):
             "It may be a scanned/image-only document."
         )
     
-    # --- Step 4: Store in ChromaDB (unchanged) ---
+    # --- Step 4: Store in per-user ChromaDB ---
     Chroma.from_documents(
         documents=splits,
         embedding=get_embeddings(),
-        persist_directory=CACHE_DIR
+        persist_directory=user_chroma_dir
     )
     # Ingestion successful
 
-def ingest_url(url: str):
+def ingest_url(url: str, student_id: str = "anonymous"):
     """
     Ingests content from a web page URL.
     YouTube transcripts are now handled browser-side via frontend/youtube_transcript.html.
     """
     from langchain_community.document_loaders import WebBaseLoader
     
+    user_chroma_dir = _get_user_chroma_dir(student_id)
+    
     try:
         logger.info(f"Processing web page: {url}")
         loader = WebBaseLoader(url)
@@ -247,11 +274,11 @@ def ingest_url(url: str):
         
         logger.info(f"Split into {len(splits)} chunks, storing in ChromaDB")
             
-        # Store in ChromaDB
+        # Store in per-user ChromaDB
         Chroma.from_documents(
             documents=splits,
             embedding=get_embeddings(),
-            persist_directory=CACHE_DIR
+            persist_directory=user_chroma_dir
         )
         
         logger.info(f"Successfully ingested: {title}")
@@ -264,7 +291,7 @@ def ingest_url(url: str):
         logger.error(f"Error ingesting URL: {e}")
         raise ValueError(f"Failed to process URL: {str(e)}")
 
-def ingest_text(text: str, source_name: str, source_type: str = "text"):
+def ingest_text(text: str, source_name: str, source_type: str = "text", student_id: str = "anonymous"):
     """
     Ingests raw text content into the vector database.
     Used for browser-fetched YouTube transcripts and other text sources.
@@ -273,6 +300,8 @@ def ingest_text(text: str, source_name: str, source_type: str = "text"):
     if not text or len(text.strip()) < 50:
         raise ValueError("Text content is too short or empty.")
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
+
     # Create a document from the text
     docs = [Document(
         page_content=text,
@@ -291,22 +320,23 @@ def ingest_text(text: str, source_name: str, source_type: str = "text"):
 
     logger.info(f"Split into {len(splits)} chunks, storing in ChromaDB")
 
-    # Store in ChromaDB
+    # Store in per-user ChromaDB
     Chroma.from_documents(
         documents=splits,
         embedding=get_embeddings(),
-        persist_directory=CACHE_DIR
+        persist_directory=user_chroma_dir
     )
 
     logger.info(f"Successfully ingested text: {source_name}")
     return source_name
 
-def delete_document(source_path: str):
+def delete_document(source_path: str, student_id: str = "anonymous"):
     """
     Removes a document from the vector database by its source path.
     """
+    user_chroma_dir = _get_user_chroma_dir(student_id)
     vector_store = Chroma(
-        persist_directory=CACHE_DIR,
+        persist_directory=user_chroma_dir,
         embedding_function=get_embeddings()
     )
     
@@ -321,12 +351,13 @@ def delete_document(source_path: str):
 # In backend/rag_engine.py
 
 
-def generate_study_plan(user_request: str):
+def generate_study_plan(user_request: str, student_id: str = "anonymous"):
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
     
     # Initialize resources
     vector_store = Chroma(
-        persist_directory=CACHE_DIR,
+        persist_directory=user_chroma_dir,
         embedding_function=get_embeddings()
     )
     llm = get_llm()
@@ -431,12 +462,13 @@ def generate_study_plan(user_request: str):
 
     return {"days": plan_days}
 
-def generate_lesson_content(topic_title: str):
+def generate_lesson_content(topic_title: str, student_id: str = "anonymous"):
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
     
     # Initialize resources
     vector_store = Chroma(
-        persist_directory=CACHE_DIR,
+        persist_directory=user_chroma_dir,
         embedding_function=get_embeddings()
     )
     llm = get_llm()
@@ -532,12 +564,13 @@ Markdown content:"""
         return f"### Error Generating Lesson\nCould not retrieve content: {e}"
 
 
-def query_knowledge_base(question: str, history: list = []):
+def query_knowledge_base(question: str, history: list = [], student_id: str = "anonymous"):
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
     
     # Init
     vector_store = Chroma(
-        persist_directory=CACHE_DIR,
+        persist_directory=user_chroma_dir,
         embedding_function=get_embeddings()
     )
     llm = get_llm()
@@ -579,12 +612,13 @@ def query_knowledge_base(question: str, history: list = []):
         "answer": answer_text,
         "sources": sources_list
     }
-def generate_quiz_data(topic_title: str):
+def generate_quiz_data(topic_title: str, student_id: str = "anonymous"):
 
+    user_chroma_dir = _get_user_chroma_dir(student_id)
     
     # Initialize resources
     vector_store = Chroma(
-        persist_directory=CACHE_DIR,
+        persist_directory=user_chroma_dir,
         embedding_function=get_embeddings()
     )
     llm = get_llm()

backend/student_data.py

@@ -17,42 +17,40 @@ class StudentProfileManager:
     """Manages student profile data with JSON file or Supabase persistence"""
     
     def __init__(self, student_id: Optional[str] = None):
-        # Check if Supabase should be used
-        self.use_supabase = os.getenv("USE_SUPABASE", "false").lower() == "true"
-        
-        if self.use_supabase:
-            try:
-                from backend.supabase_storage import SupabaseStorage
-                self.supabase = SupabaseStorage()
-                if self.supabase.is_available():
-                    logger.info("Using Supabase for persistent storage")
-                    self.storage_mode = "supabase"
-                else:
-                    logger.warning("Supabase not available, falling back to local storage")
-                    self.use_supabase = False
-                    self.storage_mode = "local"
-            except Exception as e:
-                logger.error(f"Failed to initialize Supabase: {e}")
-                self.use_supabase = False
-                self.storage_mode = "local"
-        else:
-            self.storage_mode = "local"
-            logger.info("Using local JSON file storage")
-        
-        # Generate unique student ID per user session
+        # 1. Generate unique student ID per user session
         if student_id:
             self.student_id = student_id
         else:
-            # Generate unique ID if not provided (fallback for local mode)
             import uuid
             self.student_id = f"student_{uuid.uuid4().hex[:12]}"
-        
+
         logger.info(f"StudentProfileManager initialized for {self.student_id}")
+
+        # 2. Auto-detect Supabase (don't strictly require USE_SUPABASE to be true)
+        try:
+            from backend.supabase_storage import SupabaseStorage
+            self.supabase = SupabaseStorage()
+            if self.supabase.is_available():
+                logger.info("Using Supabase for persistent storage")
+                self.use_supabase = True
+                self.storage_mode = "supabase"
+            else:
+                logger.warning("Supabase no available, falling back to local storage")
+                self.use_supabase = False
+                self.storage_mode = "local"
+        except Exception as e:
+            logger.error(f"Failed to initialize Supabase: {e}")
+            self.use_supabase = False
+            self.storage_mode = "local"
         
-        # Local storage setup (always available as fallback)
+        # 3. Local storage setup (always available as fallback)
         self.profile_dir = Path.home() / ".focusflow"
-        self.profile_file = self.profile_dir / "student_profile.json"
-        self.backup_file = self.profile_dir / "student_profile.backup.json"
+        
+        # FIX: Include student_id in profile filenames to prevent users overwriting each other in local mode
+        safe_id = "".join(c if c.isalnum() else "_" for c in self.student_id)[:40]
+        self.profile_file = self.profile_dir / f"profile_{safe_id}.json"
+        self.backup_file = self.profile_dir / f"profile_{safe_id}.backup.json"
+        
         self.lock = threading.Lock()
         
         if not self.use_supabase:

backend/supabase_storage.py

@@ -147,3 +147,26 @@ class SupabaseStorage:
         except Exception as e:
             logger.error(f"Failed to check profile existence: {e}")
             return False
+
+    def clear_all_data(self) -> bool:
+        """
+        Delete ALL student profiles from Supabase.
+        Used by admin clear endpoint to wipe shared data.
+        """
+        if not self.is_available():
+            logger.warning("Supabase not available for clear operation")
+            return False
+        
+        try:
+            # Delete all rows from student_profiles table
+            self.client.table(self.table_name)\
+                .delete()\
+                .neq("student_id", "KEEP_NOTHING")\
+                .execute()
+            
+            logger.info("✅ All Supabase student profiles deleted")
+            return True
+            
+        except Exception as e:
+            logger.error(f"❌ Failed to clear Supabase data: {e}")
+            return False