Scrum 185 us 802 sprint 4 final qa integration e2 e and regression testing

.env.example

@@ -26,3 +26,18 @@ Llm__Providers__OpenAI__Model=gpt-5.1
 Llm__Providers__Claude__Model=claude-3-5-haiku-latest
 Llm__Providers__Claude__Version=2023-06-01
 Llm__Providers__Gemini__Model=gemini-3.1-flash-lite
+# LM Studio does not require auth by default; a harmless placeholder such as
+# "lmstudio" is sufficient for the saved provider key when auth is off.
+# If the backend runs in Docker, point this at a host-reachable LM Studio server,
+# for example http://host.docker.internal:1234/v1.
+Llm__Providers__LmStudio__BaseUrl=http://localhost:1234/v1
+Llm__Providers__LmStudio__Model=local-model
+
+# Built-in guest preview keys used once per logged-out browser session.
+# These should be low-quota or dedicated guest credentials.
+Llm__GuestPreview__OpenAI__ApiKey=
+Llm__GuestPreview__OpenAI__Model=gpt-5.2
+Llm__GuestPreview__Claude__ApiKey=
+Llm__GuestPreview__Claude__Model=claude-sonnet-4-20250514
+Llm__GuestPreview__Gemini__ApiKey=
+Llm__GuestPreview__Gemini__Model=gemini-2.5-flash

CONTRIBUTING.md

@@ -27,7 +27,7 @@ docker compose up --build
 Coliee/
 ├── .github/workflows/        CI/CD pipelines (GitHub Actions)
 ├── backend/Coliee.API/       .NET 8 Web API
-├── frontend/                 React frontend (Vite + Nginx)
+├── frontend/                 Unified React frontend (Vite + Nginx)
 ├── docker-compose.yml        Multi-service orchestration
 ├── init.sql                  MySQL schema initialisation
 ├── .env.example              Environment variable template

DEPLOYMENT.md

@@ -145,6 +145,12 @@ Go to your repo → **Settings** → **Secrets and variables** → **Actions** a
 | `SMTP_PORT`            | `587`                                          |
 | `SMTP_USER`            | Your Gmail address                             |
 | `SMTP_PASSWORD`        | [Google App Password](https://myaccount.google.com/apppasswords) |
+| `Llm__GuestPreview__OpenAI__ApiKey` | Dedicated one-time guest preview key for OpenAI |
+| `Llm__GuestPreview__OpenAI__Model` | Default built-in OpenAI guest model |
+| `Llm__GuestPreview__Claude__ApiKey` | Dedicated one-time guest preview key for Claude |
+| `Llm__GuestPreview__Claude__Model` | Default built-in Claude guest model |
+| `Llm__GuestPreview__Gemini__ApiKey` | Dedicated one-time guest preview key for Gemini |
+| `Llm__GuestPreview__Gemini__Model` | Default built-in Gemini guest model |
 
 ---
 

README.md

@@ -15,8 +15,8 @@
 - � **Note Generation** — synthesise notes from any combination of nodes
 - � **Export** — download notes as PDF or plain text
 - 🔒 **Secure Authentication** — JWT-based auth with BCrypt password hashing
-- 🔑 **BYOK Provider Settings** — save and manage personal OpenAI, Claude, and Gemini keys
-- 💬 **Main-Node Chat** — minimal chat surface on `/home` using the selected BYOK provider
+- 🔑 **BYOK Provider Settings** — save and manage personal OpenAI, Claude, Gemini, and LM Studio keys
+- 💬 **Canvas Workspace** — the primary frontend experience now lives in the unified canvas workspace on `/`
 
 ---
 
@@ -27,7 +27,7 @@
 | Frontend   | React.js (functional components + hooks), React Flow |
 | Backend    | ASP.NET Web API (.NET 8), ADO.NET       |
 | Database   | MySQL 8.0 hosted on Supabase            |
-| AI         | OpenAI API (GPT-4 / GPT-3.5-turbo)     |
+| AI         | OpenAI, Anthropic Claude, and Google Gemini APIs |
 | Proxy      | Nginx reverse proxy                     |
 | DevOps     | Docker, GitHub Actions CI/CD            |
 | Hosting    | Azure App Service (API) + Azure Static Web Apps (frontend) |
@@ -56,7 +56,8 @@ Coliee/
 - [Docker](https://docs.docker.com/get-docker/) & Docker Compose
 - [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0) *(for backend development outside Docker)*
 - [Node.js 18+](https://nodejs.org/) *(for frontend development outside Docker)*
-- A provider API key for OpenAI, Claude, or Gemini if you want to use the BYOK chat flow
+- A provider API key for OpenAI, Claude, Gemini, or LM Studio if you want to use the BYOK chat flow
+- Optional built-in guest preview API keys for OpenAI, Claude, and Gemini if you want logged-out users to get one real AI action before sign-in
 
 ### 1. Clone the repository
 
@@ -81,6 +82,18 @@ MYSQL_ROOT_PASSWORD=your_root_password
 
 JWT_KEY=your_jwt_secret
 Llm__EncryptionKey=replace-with-base64-32-byte-key
+Llm__GuestPreview__OpenAI__ApiKey=
+Llm__GuestPreview__OpenAI__Model=gpt-5.2
+Llm__GuestPreview__Claude__ApiKey=
+Llm__GuestPreview__Claude__Model=claude-sonnet-4-20250514
+Llm__GuestPreview__Gemini__ApiKey=
+Llm__GuestPreview__Gemini__Model=gemini-2.5-flash
+# LM Studio does not require auth by default; a placeholder such as
+# "lmstudio" is enough for the saved provider key when auth is off.
+# If the backend runs in Docker, point LM Studio at a host-reachable URL such as
+# http://host.docker.internal:1234/v1.
+Llm__Providers__LmStudio__BaseUrl=http://localhost:1234/v1
+Llm__Providers__LmStudio__Model=local-model
 
 # Backend API URL (used by frontend)
 VITE_API_URL=http://localhost:5000
@@ -162,7 +175,7 @@ The backend follows a **layered structure**:
 Controller  →  Service  →  Data Access (ADO.NET)  →  MySQL
 ```
 
-All LLM providers are abstracted behind an interface, and the current BYOK flow supports OpenAI, Claude, and Gemini using user-managed keys stored encrypted at rest.
+All LLM providers are abstracted behind an interface, and the current BYOK flow supports OpenAI, Claude, Gemini, and LM Studio using user-managed keys stored encrypted at rest. Logged-out guest canvas actions can also use dedicated built-in preview keys for a single real AI action before sign-in is required.
 
 ---
 

backend/Coliee.API.Tests/AuthControllerTests.cs

@@ -2,6 +2,7 @@
 using Coliee.API.DTOs;
 using Coliee.API.Services;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging.Abstractions;
 using Xunit;
 
 namespace Coliee.API.Tests;
@@ -57,7 +58,14 @@ public async Task ResendPasswordResetOtp_ReturnsRateLimitPayload_OnBlock()
     }
 
     private static AuthController CreateController(IPasswordResetOtpService passwordResetOtpService) =>
-        new(null!, null!, passwordResetOtpService, new StubEmailVerificationOtpService(), new StubPasswordPolicyService(), new StubGoogleAuthService());
+        new(
+            null!,
+            null!,
+            passwordResetOtpService,
+            new StubEmailVerificationOtpService(),
+            new StubPasswordPolicyService(),
+            new StubGoogleAuthService(),
+            NullLogger<AuthController>.Instance);
 }
 
 internal sealed class StubPasswordResetOtpService : IPasswordResetOtpService

backend/Coliee.API.Tests/Controllers/AuthControllerTests.cs

@@ -5,6 +5,7 @@
 using Coliee.API.Services;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
 using Xunit;
 
 namespace Coliee.API.Tests.Controllers;
@@ -49,7 +50,7 @@
         Assert.Equal("user@example.com", payload.Email);
         Assert.Equal(2, payload.ResendAttemptsRemaining);
         Assert.Equal(1, repo.ResetFailedLoginCallCount);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
     }
 
     [Fact]
@@ -62,7 +63,7 @@
 
         var unauthorizedResult = Assert.IsType<UnauthorizedObjectResult>(result);
         Assert.Equal(401, unauthorizedResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.CreateGoogleUserCallCount);
     }
 
@@ -79,7 +80,7 @@
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(503, objectResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.CreateGoogleUserCallCount);
     }
 
@@ -154,7 +155,7 @@
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(429, objectResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.ResetFailedLoginCallCount);
     }
 
@@ -220,7 +221,8 @@
             new StubPasswordResetOtpService(),
             emailVerificationOtpService ?? new StubEmailVerificationOtpService(),
             new StubPasswordPolicyService(),
-            googleAuthService);
+            googleAuthService,
+            NullLogger<AuthController>.Instance);
     }
 
     private static TokenService CreateTokenService()

backend/Coliee.API.Tests/Controllers/CanvasesControllerTests.cs

@@ -21,7 +21,7 @@ public async Task GetCanvases_ReturnsOrderedCanvasSummaries()
                 new CanvasSummaryResponse { Id = 1, Title = "Older" }
             ]
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), service, new FakeCanvasGraphService());
 
         var result = await controller.GetCanvases();
 
@@ -34,32 +34,57 @@ public async Task GetCanvases_ReturnsOrderedCanvasSummaries()
     public async Task CreateCanvas_ReturnsCreatedStatus()
     {
         var service = new FakeCanvasService
+        { };
+        var creationService = new FakeCanvasCreationService
         {
             CreateResult = new CanvasSummaryResponse
             {
                 Id = 10,
-                Title = "Launch checklist"
+                Title = "Launch Checklist"
             }
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(creationService, service, new FakeCanvasGraphService());
 
         var result = await controller.CreateCanvas(new CreateCanvasRequest { FirstPrompt = "Launch checklist" });
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(201, objectResult.StatusCode);
         var payload = Assert.IsType<CanvasSummaryResponse>(objectResult.Value);
         Assert.Equal(10, payload.Id);
-        Assert.Equal("Launch checklist", payload.Title);
+        Assert.Equal("Launch Checklist", payload.Title);
+    }
+
+    [Fact]
+    public async Task CreateCanvas_PassesGenerationModeToCreationService()
+    {
+        var creationService = new FakeCanvasCreationService
+        {
+            CreateResult = new CanvasSummaryResponse
+            {
+                Id = 11,
+                Title = "Launch Checklist"
+            }
+        };
+        var controller = CreateController(creationService, new FakeCanvasService(), new FakeCanvasGraphService());
+
+        await controller.CreateCanvas(new CreateCanvasRequest
+        {
+            FirstPrompt = "Launch checklist",
+            GenerationMode = "rich"
+        });
+
+        Assert.Equal("rich", creationService.LastGenerationMode);
     }
 
     [Fact]
     public async Task CreateCanvas_WhenServiceRejectsPrompt_ReturnsBadRequest()
     {
-        var service = new FakeCanvasService
+        var service = new FakeCanvasService();
+        var creationService = new FakeCanvasCreationService
         {
             ExceptionToThrow = new CanvasOperationException("A first prompt is required to create a canvas.", 400)
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(creationService, service, new FakeCanvasGraphService());
 
         var result = await controller.CreateCanvas(new CreateCanvasRequest { FirstPrompt = " " });
 
@@ -78,7 +103,7 @@ public async Task RenameCanvas_ReturnsUpdatedCanvas()
                 Title = "Renamed canvas"
             }
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), service, new FakeCanvasGraphService());
 
         var result = await controller.RenameCanvas(10, new RenameCanvasRequest { Title = "Renamed canvas" });
 
@@ -94,7 +119,7 @@ public async Task RenameCanvas_WhenServiceRejectsTitle_ReturnsBadRequest()
         {
             ExceptionToThrow = new CanvasOperationException("A canvas title is required.", 400)
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), service, new FakeCanvasGraphService());
 
         var result = await controller.RenameCanvas(10, new RenameCanvasRequest { Title = " " });
 
@@ -105,7 +130,7 @@ public async Task RenameCanvas_WhenServiceRejectsTitle_ReturnsBadRequest()
     [Fact]
     public async Task DeleteCanvas_ReturnsNoContent()
     {
-        var controller = CreateController(new FakeCanvasService(), new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), new FakeCanvasService(), new FakeCanvasGraphService());
 
         var result = await controller.DeleteCanvas(10);
 
@@ -119,7 +144,7 @@ public async Task DeleteCanvas_WhenForbidden_ReturnsForbidden()
         {
             DeleteExceptionToThrow = new CanvasOperationException("You do not have access to that canvas.", 403)
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), service, new FakeCanvasGraphService());
 
         var result = await controller.DeleteCanvas(10);
 
@@ -134,7 +159,7 @@ public async Task DeleteCanvas_WhenMissing_ReturnsNotFound()
         {
             DeleteExceptionToThrow = new CanvasOperationException("Canvas not found.", 404)
         };
-        var controller = CreateController(service, new FakeCanvasGraphService());
+        var controller = CreateController(new FakeCanvasCreationService(), service, new FakeCanvasGraphService());
 
         var result = await controller.DeleteCanvas(999);
 
@@ -158,7 +183,7 @@ public async Task GetCanvasGraph_ReturnsGraphPayload()
                 ]
             }
         };
-        var controller = CreateController(new FakeCanvasService(), graphService);
+        var controller = CreateController(new FakeCanvasCreationService(), new FakeCanvasService(), graphService);
 
         var result = await controller.GetCanvasGraph(10);
 
@@ -175,17 +200,32 @@ public async Task ExpandCanvasNode_WhenProviderMissing_ReturnsBadRequestWithCode
         {
             LlmExceptionToThrow = new LlmChatException("Missing provider", LlmProviderErrorCodes.MissingKey, 400)
         };
-        var controller = CreateController(new FakeCanvasService(), graphService);
+        var controller = CreateController(new FakeCanvasCreationService(), new FakeCanvasService(), graphService);
 
         var result = await controller.ExpandCanvasNode(10, 42, new ExpandCanvasNodeRequest { Prompt = "Hello" });
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(400, objectResult.StatusCode);
     }
 
-    private static CanvasesController CreateController(ICanvasService service, ICanvasGraphService graphService, int userId = 1)
+    [Fact]
+    public async Task ExpandCanvasNode_PassesGenerationModeToGraphService()
+    {
+        var graphService = new FakeCanvasGraphService();
+        var controller = CreateController(new FakeCanvasCreationService(), new FakeCanvasService(), graphService);
+
+        await controller.ExpandCanvasNode(10, 42, new ExpandCanvasNodeRequest
+        {
+            Prompt = "Hello",
+            GenerationMode = "rich"
+        });
+
+        Assert.Equal("rich", graphService.LastGenerationMode);
+    }
+
+    private static CanvasesController CreateController(ICanvasCreationService creationService, ICanvasService service, ICanvasGraphService graphService, int userId = 1)
     {
-        var controller = new CanvasesController(service, graphService);
+        var controller = new CanvasesController(creationService, service, graphService);
         var claims = new List<Claim>
         {
             new Claim(ClaimTypes.NameIdentifier, userId.ToString()),
@@ -202,21 +242,28 @@ private static CanvasesController CreateController(ICanvasService service, ICanv
         return controller;
     }
 
-    private sealed class FakeCanvasService : ICanvasService
+    private sealed class FakeCanvasCreationService : ICanvasCreationService
     {
-        public IReadOnlyList<CanvasSummaryResponse> Items { get; set; } = [];
         public CanvasSummaryResponse CreateResult { get; set; } = new();
-        public CanvasSummaryResponse RenameResult { get; set; } = new();
         public Exception? ExceptionToThrow { get; set; }
-        public Exception? DeleteExceptionToThrow { get; set; }
+        public string? LastGenerationMode { get; private set; }
 
-        public Task<CanvasSummaryResponse> CreateCanvasAsync(int userId, string firstPrompt)
+        public Task<CanvasSummaryResponse> CreateCanvasAsync(int userId, string firstPrompt, string? generationMode)
         {
             if (ExceptionToThrow != null)
                 throw ExceptionToThrow;
 
+            LastGenerationMode = generationMode;
             return Task.FromResult(CreateResult);
         }
+    }
+
+    private sealed class FakeCanvasService : ICanvasService
+    {
+        public IReadOnlyList<CanvasSummaryResponse> Items { get; set; } = [];
+        public CanvasSummaryResponse RenameResult { get; set; } = new();
+        public Exception? ExceptionToThrow { get; set; }
+        public Exception? DeleteExceptionToThrow { get; set; }
 
         public Task<IReadOnlyList<CanvasSummaryResponse>> GetCanvasesAsync(int userId)
         {
@@ -246,6 +293,7 @@ private sealed class FakeCanvasGraphService : ICanvasGraphService
         public CanvasGraphResponse ExpandResult { get; set; } = new();
         public Exception? ExceptionToThrow { get; set; }
         public Exception? LlmExceptionToThrow { get; set; }
+        public string? LastGenerationMode { get; private set; }
 
         public Task<CanvasGraphResponse> GetCanvasGraphAsync(int userId, int canvasId)
         {
@@ -255,14 +303,15 @@ public Task<CanvasGraphResponse> GetCanvasGraphAsync(int userId, int canvasId)
             return Task.FromResult(GraphResult);
         }
 
-        public Task<CanvasGraphResponse> ExpandCanvasNodeAsync(int userId, int canvasId, int nodeId, string prompt, string? providerOverride)
+        public Task<CanvasGraphResponse> ExpandCanvasNodeAsync(int userId, int canvasId, int nodeId, string prompt, string? providerOverride, string? generationMode)
         {
             if (ExceptionToThrow != null)
                 throw ExceptionToThrow;
 
             if (LlmExceptionToThrow != null)
                 throw LlmExceptionToThrow;
 
+            LastGenerationMode = generationMode;
             return Task.FromResult(ExpandResult);
         }
     }