CodeRabbit full-repo review (do not merge)

.coderabbit.yaml

@@ -0,0 +1,26 @@
+# CodeRabbit configuration
+# Docs: https://docs.coderabbit.ai/getting-started/configure-coderabbit
+
+reviews:
+  # Default is "chill" — we want it to surface issues without
+  # blocking on style nits.
+  profile: chill
+
+  # Auto-review configuration. By default CodeRabbit only reviews PRs
+  # where the BASE branch is the repo's default branch (main).
+  # We open one-off full-repo audit PRs against the `coderabbit-root`
+  # branch (a non-default branch pointing at the initial commit) so
+  # we can ask `@coderabbitai full review` over the entire codebase.
+  # Add coderabbit-root to the allowed base list so those audit PRs
+  # actually get reviewed instead of "Review skipped".
+  auto_review:
+    enabled: true
+    drafts: false
+    base_branches:
+      - "main"
+      - "coderabbit-root"
+
+  # Allow @coderabbitai review / full review on any PR opened against
+  # any base branch in this repo — overrides the default "only on
+  # default-branch base" policy so manual triggers always work.
+  request_changes_workflow: false

.dockerignore

@@ -0,0 +1,13 @@
+.env
+.git
+.github
+.pytest_cache
+.venv
+__pycache__
+*.pyc
+*.pyo
+*.pyd
+*.log
+DEVLOG.md
+docs/pdf_rendered
+tests

.env.example

@@ -0,0 +1,135 @@
+## Optional for AI-assisted workflow and assistant features.
+OPENAI_API_KEY=
+OPENAI_MODEL_DEFAULT=gpt-5.4-mini
+OPENAI_MODEL_HIGH_TRUST=gpt-5.4
+OPENAI_MODEL_MID_TIER=gpt-5.4-mini
+OPENAI_MODEL_PRODUCT_HELP=gpt-5.4-mini
+OPENAI_MODEL_APPLICATION_QA=gpt-5.4
+OPENAI_REASONING_DEFAULT=medium
+OPENAI_REASONING_HIGH_TRUST=high
+OPENAI_REASONING_PROFILE=medium
+OPENAI_REASONING_JOB=medium
+OPENAI_REASONING_FIT=medium
+OPENAI_REASONING_TAILORING=medium
+OPENAI_REASONING_STRATEGY=medium
+OPENAI_REASONING_REVIEW=high
+OPENAI_REASONING_RESUME_GENERATION=high
+OPENAI_REASONING_PRODUCT_HELP=medium
+OPENAI_REASONING_APPLICATION_QA=high
+
+## Optional app base URL. Used as the default auth redirect URL when no
+## explicit SUPABASE_AUTH_REDIRECT_URL is provided.
+APP_BASE_URL=http://localhost:3000
+
+## Required for the current login-first resume workflow, Google sign-in,
+## persisted saved-workspace reload, and account-level quotas.
+SUPABASE_URL=
+SUPABASE_ANON_KEY=
+## Service-role key used ONLY by the cached_jobs writer
+## (/admin/refresh-cache) and reader (/jobs/search). Bypasses RLS —
+## never send to the frontend, never use for user-scoped tables.
+SUPABASE_SERVICE_ROLE_KEY=
+SUPABASE_AUTH_REDIRECT_URL=http://localhost:3000/workspace
+SUPABASE_APP_USERS_TABLE=app_users
+SUPABASE_USAGE_EVENTS_TABLE=usage_events
+SUPABASE_SAVED_WORKSPACES_TABLE=saved_workspaces
+SUPABASE_SAVED_JOBS_TABLE=saved_jobs
+SUPABASE_RESUME_BUILDER_SESSIONS_TABLE=resume_builder_sessions
+SUPABASE_CACHED_JOBS_TABLE=cached_jobs
+SAVED_WORKSPACE_TTL_HOURS=24
+## Shared secret guarding /admin/refresh-cache. Set the same value in
+## the Supabase pg_cron job's HTTP headers so the cron can include
+## it. Rotate if leaked.
+REFRESH_CACHE_SECRET=
+
+## Optional job-search backend settings. Keep ENABLE_JOB_SEARCH_BACKEND=false
+## until the separate backend service is available in the target environment.
+ENABLE_JOB_SEARCH_BACKEND=false
+JOB_BACKEND_BASE_URL=http://localhost:8000
+JOB_BACKEND_HOSTPORT=
+# Comma-separated lists of board / site identifiers. Each is the
+# {token} in https://boards-api.greenhouse.io/v1/boards/{token}/jobs
+# or the {site} in https://api.lever.co/v0/postings/{site}. The
+# /admin/refresh-cache endpoint pulls every active job from each.
+# Bad tokens surface as "error" in the refresh report's
+# providers.greenhouse.errors[] (or .lever) — trim them from your
+# env after the first refresh shows which ones failed.
+#
+# Validated seed list ~58 Greenhouse + 6 Lever = ~8.7K active jobs.
+# Companies that previously used Greenhouse/Lever and migrated to
+# Ashby (Linear, Vercel, Netlify, Supabase, OpenAI, ...) were
+# trimmed after the first refresh — they 404'd. Add your own and
+# they'll either show up as "ok" or "error" in the next refresh
+# report.
+GREENHOUSE_BOARD_TOKENS=databricks,stripe,mongodb,anthropic,cloudflare,datadog,waymo,okta,samsara,zscaler,roblox,airbnb,brex,sofi,gitlab,scaleai,intercom,affirm,gleanwork,figma,fivetran,pinterest,elastic,reddit,twilio,robinhood,boxinc,lyft,smartsheet,asana,instacart,cresta,motional,dropbox,nuro,zoominfo,discord,moloco,gusto,wayve,faire,classpass,chime,fastly,amplitude,monzo,twitch,peloton,opendoor,mercury,mozilla,qualtrics,sumologic,pagerduty,launchdarkly,mixpanel,marqeta,wikimedia,algolia,triplelift,airtable,descript,calendly,typeface,narvar,glossier,placerlabs,modernhealth,lastpass,honeycomb,udacity,bitwarden,assemblyai,coursera,planetscale,inflectionai,kayak,allbirds,hubspot
+LEVER_SITE_NAMES=dnb,plaid,mistral,palantir,netflix,attentive
+## Ashby boards. Modern AI/dev-tools tier (Linear, Cursor, Replit,
+## Vercel, Cohere, Mistral, Sierra, Decagon, ...) — companies that
+## migrated off Greenhouse/Lever in 2023-2025. Endpoint:
+## https://api.ashbyhq.com/posting-api/job-board/{token}
+ASHBY_BOARD_TOKENS=mistral,notion,elevenlabs,cohere,sierra,ramp,decagon,plaid,cursor,replit,lovable,perplexity,deepgram,gamma,writer,supabase,n8n,workos,exa,linear,render,substack,character,posthog,poolside,column,railway,warp,statsig,pinecone,weaviate,stytch,pika,runway,nylas,clerk
+## Workday tokens are tenant:host:site triples — each Fortune 500
+## company runs its own Workday tenant on a numbered host
+## (wd1.myworkdayjobs.com, wd5, etc) at a public site. Validated
+## tenants below unlock ~14.5K jobs. The bulk-validation script in
+## scripts/probe_workday.py (or a similar one-off) finds more —
+## many big companies (AMD, Intel, Tesla, Cisco, IBM) require
+## tenant-specific request shapes that the default body doesn't
+## satisfy; those return 422 and are excluded.
+WORKDAY_BOARD_TOKENS=micron:wd1:External,nvidia:wd5:NVIDIAExternalCareerSite,citi:wd5:2,walmart:wd5:WalmartExternal,hpe:wd5:Jobsathpe,adobe:wd5:external_experienced,boeing:wd1:EXTERNAL_CAREERS,disney:wd5:disneycareer,hp:wd5:ExternalCareerSite,blackrock:wd1:BlackRock_Professional,workday:wd5:Workday
+
+## Frontend origin settings for the Next.js transition.
+FRONTEND_APP_URL=http://localhost:3000
+CORS_ALLOWED_ORIGINS=http://localhost:3000,http://127.0.0.1:3000
+## Leave AUTH_COOKIE_DOMAIN empty on localhost. In production, set it to
+## your parent domain (for example, .job-application-copilot.xyz) so the
+## landing and workspace subdomains share the same HttpOnly session.
+AUTH_COOKIE_DOMAIN=
+AUTH_COOKIE_SECURE=false
+AUTH_COOKIE_SAMESITE=lax
+
+## AI-assisted workflow and the in-app assistant are login-required in the
+## active UI. This flag controls whether the workflow button also enforces that.
+AUTH_REQUIRED_FOR_ASSISTED_WORKFLOW=true
+AUTH_DEFAULT_PLAN_TIER=free
+AUTH_DEFAULT_ACCOUNT_STATUS=active
+## Only internal unrestricted testing accounts belong here.
+## Leave normal quota-test accounts out of this list so they stay on the free-tier path.
+AUTH_INTERNAL_USER_EMAILS=
+FREE_TIER_MAX_CALLS_PER_DAY=12
+FREE_TIER_MAX_TOKENS_PER_DAY=60000
+PAID_TIER_MAX_CALLS_PER_DAY=80
+PAID_TIER_MAX_TOKENS_PER_DAY=400000
+
+## Lemon Squeezy subscription integration.
+##
+## The backend uses these to validate webhook deliveries (HMAC over the
+## raw body) and to mint customer portal URLs. The frontend uses the
+## NEXT_PUBLIC_ values below to build the hosted checkout URL.
+##
+## Until these are populated the backend webhook returns 503 (with a
+## Retry-After) on every delivery and the pricing CTA falls back to
+## "Coming soon" for Pro / "Contact us" (mailto) for Business. This
+## lets the integration ship to main without LS being live.
+##
+## Build against LS *sandbox* mode by default. Sandbox has its own
+## webhook secret + API key; the dashboard URL is the same surface.
+## See docs/lemon-squeezy.md for the full setup walkthrough.
+AIJOBAGENT_LEMONSQUEEZY_API_KEY=
+AIJOBAGENT_LEMONSQUEEZY_WEBHOOK_SECRET=
+AIJOBAGENT_LEMONSQUEEZY_STORE_ID=
+## LS variant_id values (numeric strings on the variant API resource).
+## One per paid tier; mapping flows
+##   variant_id -> tier -> TIER_CAPS
+## inside backend.webhooks.lemonsqueezy._tier_for_variant.
+AIJOBAGENT_LEMONSQUEEZY_PRODUCT_VARIANT_PRO=
+AIJOBAGENT_LEMONSQUEEZY_PRODUCT_VARIANT_BUSINESS=
+
+## Public (frontend) LS env. NEXT_PUBLIC_ prefix gets these inlined
+## into the JS bundle at build time. The store_id here is the
+## subdomain piece (e.g. "yourstore" -> https://yourstore.lemonsqueezy.com).
+## variant ids must match the AIJOBAGENT_* values above (same upstream
+## resource, two views).
+NEXT_PUBLIC_LEMONSQUEEZY_STORE_ID=
+NEXT_PUBLIC_LEMONSQUEEZY_PRODUCT_VARIANT_PRO=
+NEXT_PUBLIC_LEMONSQUEEZY_PRODUCT_VARIANT_BUSINESS=

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@v6
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.11"
+
+      - name: Sync dependencies
+        run: uv sync --group dev --frozen
+
+      - name: Compile check
+        run: uv run python -m compileall backend src tests
+
+      - name: Run tests
+        run: uv run pytest -v
+
+  frontend:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v5
+
+      - name: Set up Node
+        uses: actions/setup-node@v5
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: frontend/package-lock.json
+
+      - name: Install dependencies
+        working-directory: frontend
+        run: npm ci
+
+      - name: Lint
+        working-directory: frontend
+        run: npm run lint
+
+      - name: Build
+        working-directory: frontend
+        run: npm run build

.github/workflows/deploy.yml

@@ -0,0 +1,117 @@
+name: Build & Deploy
+
+on:
+  push:
+    branches: [main]
+
+env:
+  IMAGE: ghcr.io/leanderantony/ai_job_application_agent/api
+  VPS_APP_DIR: /home/ubuntu/AI_Job_Application_Agent
+
+jobs:
+  build-and-push:
+    name: Build Docker image to GHCR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ github.token }}
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Build and push
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: true
+          tags: ${{ env.IMAGE }}:latest,${{ env.IMAGE }}:${{ github.sha }}
+          cache-from: type=registry,ref=${{ env.IMAGE }}:cache
+          cache-to: type=registry,ref=${{ env.IMAGE }}:cache,mode=max
+
+  deploy:
+    name: Deploy to VPS
+    runs-on: ubuntu-latest
+    needs: build-and-push
+    permissions:
+      contents: read
+      packages: read
+    env:
+      GITHUB_ACTOR: ${{ github.actor }}
+      GITHUB_TOKEN: ${{ github.token }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Prepare VPS directory
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          script: |
+            mkdir -p "${{ env.VPS_APP_DIR }}/backend/vps"
+
+      - name: Copy deployment files
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          source: backend/vps/docker-compose.yml,backend/vps/docker-compose.override.yml
+          target: ${{ env.VPS_APP_DIR }}/backend/vps
+          strip_components: 2
+
+      - name: Deploy via SSH
+        uses: appleboy/ssh-action@v1
+        env:
+          IMAGE: ${{ env.IMAGE }}
+          GITHUB_ACTOR: ${{ env.GITHUB_ACTOR }}
+          GITHUB_TOKEN: ${{ env.GITHUB_TOKEN }}
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          envs: IMAGE,GITHUB_TOKEN,GITHUB_ACTOR
+          script: |
+            echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
+            docker pull "$IMAGE:latest"
+            cd "${{ env.VPS_APP_DIR }}/backend/vps"
+            docker compose -p ai_job_application_agent up -d --no-deps --no-build --force-recreate api
+            docker logout ghcr.io
+
+      - name: Health check
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.VPS_HOST }}
+          username: ${{ secrets.VPS_USER }}
+          key: ${{ secrets.VPS_SSH_KEY }}
+          port: ${{ secrets.VPS_PORT }}
+          script: |
+            echo "Waiting for AI Job Application Agent API to be healthy..."
+            for i in $(seq 1 12); do
+              STATUS=$(docker inspect --format='{{.State.Health.Status}}' ai-job-application-agent-api 2>/dev/null)
+              echo "Attempt $i: $STATUS"
+              if [ "$STATUS" = "healthy" ]; then
+                echo "Container is healthy"
+                exit 0
+              fi
+              sleep 5
+            done
+            echo "Container did not become healthy in time"
+            docker logs ai-job-application-agent-api --tail 30
+            exit 1