security: add HTTP security headers to next.config.mjs

.github/labeler.yml

@@ -0,0 +1,22 @@
+gssoc:approved:
+  - title: ".*"
+  - body: ".*"
+
+mentor:PankajSingh34:
+  - title: ".*"
+
+level:beginner:
+  - title: ".*beginner.*"
+  - body: ".*beginner.*"
+
+type:bug:
+  - title: ".*bug.*"
+  - body: ".*bug.*"
+
+type:feature:
+  - title: ".*feature.*"
+  - body: ".*feature.*"
+
+type:docs:
+  - title: ".*docs.*"
+  - body: ".*docs.*"

.github/workflows/ai-issue-labeler.yml

@@ -0,0 +1,24 @@
+name: Smart Issue Labeler
+
+on:
+  issues:
+    types: [opened, edited]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  label-issues:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repo        # ← ADD THIS
+        uses: actions/checkout@v4
+
+      - name: Label issues
+        uses: github/issue-labeler@v3.4
+        with:
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+          configuration-path: .github/labeler.yml
+          enable-versioned-regex: 0

.github/workflows/auto-approve-on-status.yml

@@ -0,0 +1,96 @@
+name: Conditional Auto Approve
+
+on:
+  # जब भी किसी पीआर पर चेक्स (Status/Check Suite) पूरे हों
+  check_suite:
+    types: [completed]
+  status:
+
+jobs:
+  check-and-approve:
+    runs-on: ubuntu-latest
+    if: github.repository == 'PankajSingh34/AlgoBuddy'
+    steps:
+      - name: Check Statuses and Approve
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const { owner, repo } = context.repo;
+
+            // 1. इस इवेंट से जुड़े Pull Requests की लिस्ट निकालें
+            let pullRequests = [];
+            if (context.eventName === 'check_suite') {
+              pullRequests = context.payload.check_suite.pull_requests;
+            } else {
+              // status इवेंट के लिए SHA के ज़रिए PR ढूंढें
+              const sha = context.payload.sha;
+              const prs = await github.rest.pulls.list({ owner, repo, state: 'open' });
+              pullRequests = prs.data.filter(pr => pr.head.sha === sha);
+            }
+
+            if (pullRequests.length === 0) {
+              console.log("No open pull request found for this event.");
+              return;
+            }
+
+            const prNumber = pullRequests[0].number;
+            const prRef = pullRequests[0].head.sha;
+
+            // 2. इस Commit SHA के सारे कंबाइंड चेक्स/स्टेटस गेट करें
+            const statuses = await github.rest.repos.getCombinedStatusForRef({
+              owner,
+              repo,
+              ref: prRef,
+            });
+
+            const checkRuns = await github.rest.checks.listForRef({
+              owner,
+              repo,
+              ref: prRef,
+            });
+
+            // 3. फ़िल्टर लॉजिक: वर्सेल (Vercel) को छोड़कर बाकी चेक्स की जांच
+            let allOthersPassed = true;
+            let evaluatedChecksCount = 0;
+
+            // स्टेटस चेक करें (पुराने गिटहब स्टेटस के लिए)
+            for (const status of statuses.data.statuses) {
+              if (status.context.toLowerCase().includes('vercel')) {
+                continue; // Vercel को छोड़ दो
+              }
+              evaluatedChecksCount++;
+              if (status.state !== 'success') {
+                allOthersPassed = false;
+              }
+            }
+
+            // चेक रन्स देखें (GitHub Actions आदि के लिए)
+            for (const run of checkRuns.data.check_runs) {
+              if (run.name.toLowerCase().includes('vercel') || run.app?.slug?.toLowerCase().includes('vercel')) {
+                continue; // Vercel को छोड़ दो
+              }
+              // अगर कोई चेक अभी चल रहा है या पास नहीं हुआ है
+              if (run.status !== 'completed') {
+                allOthersPassed = false;
+              } else if (run.conclusion !== 'success' && run.conclusion !== 'neutral') {
+                allOthersPassed = false;
+              }
+              evaluatedChecksCount++;
+            }
+
+            console.log(`Evaluated ${evaluatedChecksCount} non-Vercel checks. Status: ${allOthersPassed}`);
+
+            // 4. अगर वर्सेल के अलावा बाकी सारे चेक्स पास हैं, तो APPROVE कर दो
+            if (allOthersPassed && evaluatedChecksCount > 0) {
+              await github.rest.pulls.createReview({
+                owner,
+                repo,
+                pull_number: prNumber,
+                event: 'APPROVE',
+                body: 'code looks good',
+              });
+              console.log(`PR #${prNumber} has been automatically approved with 'code looks good'!`);
+            } else {
+              console.log("Some non-Vercel checks are either pending or failed. Skipping auto-approval.");
+            }

EnvExample.txt

@@ -2,10 +2,20 @@ EMAIL_USER=Your App Email
 EMAIL_PASSWORD=Your Google App Password
 NEXT_PUBLIC_GA_ID=Your Google Analytics ID
 
-NEXT_PUBLIC_SUPABASE_URL=Your supabase Url
-NEXT_PUBLIC_SUPABASE_ANON_KEY=Your Anon Key
+NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
+NEXT_PUBLIC_SUPABASE_ANON_KEY=Your Supabase anon/public key
 NEXT_PUBLIC_TURNSTILE_SITE_KEY=Your Cloudfare Captcha Key
 
 TURNSTILE_SECRET_KEY=Your Cloudfare backend route api key
 SUPABASE_SERVICE_KEY=Your supabase service key
 REVIEW_INBOX_EMAIL=Optional: fixed inbox for review emails (defaults to EMAIL_USER)
+
+# AI Chatbot (AlgoBuddy Assistant)
+OPENAI_API_KEY=Your OpenAI or OpenRouter API Key
+# Upstash Redis — required in production to enforce rate limits across all
+# serverless instances. Create a free database at https://console.upstash.com
+# and copy the REST URL and token from the database dashboard.
+# Without these, rate limiting falls back to a per-process in-memory store
+# which is bypassed in serverless deployments (multiple Lambda instances).
+UPSTASH_REDIS_REST_URL=https://your-database.upstash.io
+UPSTASH_REDIS_REST_TOKEN=Your Upstash Redis REST token

README.md

@@ -106,7 +106,9 @@ npm install
 
 # 3. Set up environment variables
 cp EnvExample.txt .env.local
-# Fill in the values — see Environment Variables section below
+# Fill in the values — especially NEXT_PUBLIC_SUPABASE_URL and
+# NEXT_PUBLIC_SUPABASE_ANON_KEY. The app will start without them, but auth,
+# dashboard, and middleware session refresh will be disabled until they are set.
 
 # 4. Run the development server
 npm run dev
@@ -131,6 +133,15 @@ Create a `.env.local` file at the root with the following keys (see `EnvExample.
 | `NEXT_PUBLIC_TURNSTILE_SITE_KEY` | Cloudflare Turnstile site key |
 | `TURNSTILE_SECRET_KEY` | Cloudflare Turnstile secret key |
 
+Minimum required for Supabase auth and dashboard features:
+
+- `NEXT_PUBLIC_SUPABASE_URL`
+- `NEXT_PUBLIC_SUPABASE_ANON_KEY`
+
+If those values are missing or invalid, the app now falls back to a safe no-op
+Supabase client for startup, and middleware skips session refresh instead of
+crashing the dev server.
+
 Never commit `.env.local` to version control. It is listed in `.gitignore`.
 
 ---