SPRINT - 4 - PR

.env.example

@@ -26,3 +26,18 @@ Llm__Providers__OpenAI__Model=gpt-5.1
 Llm__Providers__Claude__Model=claude-3-5-haiku-latest
 Llm__Providers__Claude__Version=2023-06-01
 Llm__Providers__Gemini__Model=gemini-3.1-flash-lite
+# LM Studio does not require auth by default; a harmless placeholder such as
+# "lmstudio" is sufficient for the saved provider key when auth is off.
+# If the backend runs in Docker, point this at a host-reachable LM Studio server,
+# for example http://host.docker.internal:1234/v1.
+Llm__Providers__LmStudio__BaseUrl=http://localhost:1234/v1
+Llm__Providers__LmStudio__Model=local-model
+
+# Built-in guest preview keys used once per logged-out browser session.
+# These should be low-quota or dedicated guest credentials.
+Llm__GuestPreview__OpenAI__ApiKey=
+Llm__GuestPreview__OpenAI__Model=gpt-5.2
+Llm__GuestPreview__Claude__ApiKey=
+Llm__GuestPreview__Claude__Model=claude-sonnet-4-20250514
+Llm__GuestPreview__Gemini__ApiKey=
+Llm__GuestPreview__Gemini__Model=gemini-2.5-flash

.github/workflows/ci.yml

@@ -70,31 +70,74 @@ jobs:
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
     steps:
     - uses: actions/checkout@v4
+    - name: Build production and baseline images
+      shell: bash
+      run: |
+        docker build -t coliee-backend:prod-ci -f ./backend/Coliee.API/Dockerfile ./backend/Coliee.API
+        docker build -t coliee-backend:dev-baseline -f ./backend/Coliee.API/Dockerfile.dev ./backend/Coliee.API
+        docker build \
+          -t coliee-frontend:prod-ci \
+          --build-arg VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }} \
+          -f ./frontend/Dockerfile \
+          ./frontend
+        docker build -t coliee-frontend:dev-baseline -f ./frontend/Dockerfile.dev ./frontend
+    - name: Compare image sizes
+      shell: bash
+      run: |
+        backend_prod_size=$(docker image inspect coliee-backend:prod-ci --format '{{.Size}}')
+        backend_dev_size=$(docker image inspect coliee-backend:dev-baseline --format '{{.Size}}')
+        frontend_prod_size=$(docker image inspect coliee-frontend:prod-ci --format '{{.Size}}')
+        frontend_dev_size=$(docker image inspect coliee-frontend:dev-baseline --format '{{.Size}}')
+
+        echo "Backend dev size: ${backend_dev_size}"
+        echo "Backend prod size: ${backend_prod_size}"
+        echo "Frontend dev size: ${frontend_dev_size}"
+        echo "Frontend prod size: ${frontend_prod_size}"
+
+        if [ "$backend_prod_size" -ge "$backend_dev_size" ]; then
+          echo "Backend production image is not smaller than the dev baseline."
+          exit 1
+        fi
+
+        if [ "$frontend_prod_size" -ge "$frontend_dev_size" ]; then
+          echo "Frontend production image is not smaller than the dev baseline."
+          exit 1
+        fi
+    - name: Run Trivy on backend image
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: 'coliee-backend:prod-ci'
+        format: 'table'
+        exit-code: '1'
+        ignore-unfixed: true
+        severity: 'CRITICAL'
+    - name: Run Trivy on frontend image
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: 'coliee-frontend:prod-ci'
+        format: 'table'
+        exit-code: '1'
+        ignore-unfixed: true
+        severity: 'CRITICAL'
     - name: Login to Docker Hub
       uses: docker/login-action@v3
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
-    - name: Build & push backend image
-      uses: docker/build-push-action@v5
-      with:
-        context: ./backend/Coliee.API
-        file: ./backend/Coliee.API/Dockerfile
-        push: true
-        tags: |
-          ${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:latest
-          ${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:${{ github.sha }}
-    - name: Build & push frontend image
-      uses: docker/build-push-action@v5
-      with:
-        context: ./frontend
-        file: ./frontend/Dockerfile
-        push: true
-        build-args: |
-          VITE_GOOGLE_CLIENT_ID=${{ secrets.VITE_GOOGLE_CLIENT_ID }}
-        tags: |
-          ${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:latest
-          ${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:${{ github.sha }}
+    - name: Tag & push backend image
+      shell: bash
+      run: |
+        docker tag coliee-backend:prod-ci "${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:latest"
+        docker tag coliee-backend:prod-ci "${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:${{ github.sha }}"
+        docker push "${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:latest"
+        docker push "${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:${{ github.sha }}"
+    - name: Tag & push frontend image
+      shell: bash
+      run: |
+        docker tag coliee-frontend:prod-ci "${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:latest"
+        docker tag coliee-frontend:prod-ci "${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:${{ github.sha }}"
+        docker push "${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:latest"
+        docker push "${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:${{ github.sha }}"
 
   # Docker build test (only on PRs and non-main pushes)
   docker_build_test:
@@ -103,27 +146,52 @@ jobs:
     if: github.ref != 'refs/heads/main' || github.event_name == 'pull_request'
     steps:
     - uses: actions/checkout@v4
-    - name: Build Docker images
-      run: docker compose build
+    - name: Build production and baseline images
+      shell: bash
+      run: |
+        docker build -t coliee-backend:prod-ci -f ./backend/Coliee.API/Dockerfile ./backend/Coliee.API
+        docker build -t coliee-backend:dev-baseline -f ./backend/Coliee.API/Dockerfile.dev ./backend/Coliee.API
+        docker build \
+          -t coliee-frontend:prod-ci \
+          --build-arg VITE_GOOGLE_CLIENT_ID=ci-placeholder \
+          -f ./frontend/Dockerfile \
+          ./frontend
+        docker build -t coliee-frontend:dev-baseline -f ./frontend/Dockerfile.dev ./frontend
+    - name: Compare image sizes
+      shell: bash
+      run: |
+        backend_prod_size=$(docker image inspect coliee-backend:prod-ci --format '{{.Size}}')
+        backend_dev_size=$(docker image inspect coliee-backend:dev-baseline --format '{{.Size}}')
+        frontend_prod_size=$(docker image inspect coliee-frontend:prod-ci --format '{{.Size}}')
+        frontend_dev_size=$(docker image inspect coliee-frontend:dev-baseline --format '{{.Size}}')
 
-  trivy-scan:
-    runs-on: ubuntu-latest
-    needs: [docker_push]
-    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
-    steps:
+        echo "Backend dev size: ${backend_dev_size}"
+        echo "Backend prod size: ${backend_prod_size}"
+        echo "Frontend dev size: ${frontend_dev_size}"
+        echo "Frontend prod size: ${frontend_prod_size}"
+
+        if [ "$backend_prod_size" -ge "$backend_dev_size" ]; then
+          echo "Backend production image is not smaller than the dev baseline."
+          exit 1
+        fi
+
+        if [ "$frontend_prod_size" -ge "$frontend_dev_size" ]; then
+          echo "Frontend production image is not smaller than the dev baseline."
+          exit 1
+        fi
     - name: Run Trivy on backend image
       uses: aquasecurity/trivy-action@master
       with:
-        image-ref: '${{ secrets.DOCKERHUB_USERNAME }}/coliee-backend:latest'
+        image-ref: 'coliee-backend:prod-ci'
         format: 'table'
         exit-code: '1'
         ignore-unfixed: true
         severity: 'CRITICAL'
     - name: Run Trivy on frontend image
       uses: aquasecurity/trivy-action@master
       with:
-        image-ref: '${{ secrets.DOCKERHUB_USERNAME }}/coliee-frontend:latest'
+        image-ref: 'coliee-frontend:prod-ci'
         format: 'table'
         exit-code: '1'
         ignore-unfixed: true
-        severity: 'CRITICAL'
+        severity: 'CRITICAL'

CONTRIBUTING.md

@@ -27,7 +27,7 @@ docker compose up --build
 Coliee/
 ├── .github/workflows/        CI/CD pipelines (GitHub Actions)
 ├── backend/Coliee.API/       .NET 8 Web API
-├── frontend/                 React frontend (Vite + Nginx)
+├── frontend/                 Unified React frontend (Vite + Nginx)
 ├── docker-compose.yml        Multi-service orchestration
 ├── init.sql                  MySQL schema initialisation
 ├── .env.example              Environment variable template

DEPLOYMENT.md

@@ -145,6 +145,12 @@ Go to your repo → **Settings** → **Secrets and variables** → **Actions** a
 | `SMTP_PORT`            | `587`                                          |
 | `SMTP_USER`            | Your Gmail address                             |
 | `SMTP_PASSWORD`        | [Google App Password](https://myaccount.google.com/apppasswords) |
+| `Llm__GuestPreview__OpenAI__ApiKey` | Dedicated one-time guest preview key for OpenAI |
+| `Llm__GuestPreview__OpenAI__Model` | Default built-in OpenAI guest model |
+| `Llm__GuestPreview__Claude__ApiKey` | Dedicated one-time guest preview key for Claude |
+| `Llm__GuestPreview__Claude__Model` | Default built-in Claude guest model |
+| `Llm__GuestPreview__Gemini__ApiKey` | Dedicated one-time guest preview key for Gemini |
+| `Llm__GuestPreview__Gemini__Model` | Default built-in Gemini guest model |
 
 ---
 

README.md

@@ -15,8 +15,8 @@
 - � **Note Generation** — synthesise notes from any combination of nodes
 - � **Export** — download notes as PDF or plain text
 - 🔒 **Secure Authentication** — JWT-based auth with BCrypt password hashing
-- 🔑 **BYOK Provider Settings** — save and manage personal OpenAI, Claude, and Gemini keys
-- 💬 **Main-Node Chat** — minimal chat surface on `/home` using the selected BYOK provider
+- 🔑 **BYOK Provider Settings** — save and manage personal OpenAI, Claude, Gemini, and LM Studio keys
+- 💬 **Canvas Workspace** — the primary frontend experience now lives in the unified canvas workspace on `/`
 
 ---
 
@@ -27,7 +27,7 @@
 | Frontend   | React.js (functional components + hooks), React Flow |
 | Backend    | ASP.NET Web API (.NET 8), ADO.NET       |
 | Database   | MySQL 8.0 hosted on Supabase            |
-| AI         | OpenAI API (GPT-4 / GPT-3.5-turbo)     |
+| AI         | OpenAI, Anthropic Claude, and Google Gemini APIs |
 | Proxy      | Nginx reverse proxy                     |
 | DevOps     | Docker, GitHub Actions CI/CD            |
 | Hosting    | Azure App Service (API) + Azure Static Web Apps (frontend) |
@@ -56,7 +56,8 @@ Coliee/
 - [Docker](https://docs.docker.com/get-docker/) & Docker Compose
 - [.NET 8 SDK](https://dotnet.microsoft.com/download/dotnet/8.0) *(for backend development outside Docker)*
 - [Node.js 18+](https://nodejs.org/) *(for frontend development outside Docker)*
-- A provider API key for OpenAI, Claude, or Gemini if you want to use the BYOK chat flow
+- A provider API key for OpenAI, Claude, Gemini, or LM Studio if you want to use the BYOK chat flow
+- Optional built-in guest preview API keys for OpenAI, Claude, and Gemini if you want logged-out users to get one real AI action before sign-in
 
 ### 1. Clone the repository
 
@@ -81,6 +82,18 @@ MYSQL_ROOT_PASSWORD=your_root_password
 
 JWT_KEY=your_jwt_secret
 Llm__EncryptionKey=replace-with-base64-32-byte-key
+Llm__GuestPreview__OpenAI__ApiKey=
+Llm__GuestPreview__OpenAI__Model=gpt-5.2
+Llm__GuestPreview__Claude__ApiKey=
+Llm__GuestPreview__Claude__Model=claude-sonnet-4-20250514
+Llm__GuestPreview__Gemini__ApiKey=
+Llm__GuestPreview__Gemini__Model=gemini-2.5-flash
+# LM Studio does not require auth by default; a placeholder such as
+# "lmstudio" is enough for the saved provider key when auth is off.
+# If the backend runs in Docker, point LM Studio at a host-reachable URL such as
+# http://host.docker.internal:1234/v1.
+Llm__Providers__LmStudio__BaseUrl=http://localhost:1234/v1
+Llm__Providers__LmStudio__Model=local-model
 
 # Backend API URL (used by frontend)
 VITE_API_URL=http://localhost:5000
@@ -162,7 +175,7 @@ The backend follows a **layered structure**:
 Controller  →  Service  →  Data Access (ADO.NET)  →  MySQL
 ```
 
-All LLM providers are abstracted behind an interface, and the current BYOK flow supports OpenAI, Claude, and Gemini using user-managed keys stored encrypted at rest.
+All LLM providers are abstracted behind an interface, and the current BYOK flow supports OpenAI, Claude, Gemini, and LM Studio using user-managed keys stored encrypted at rest. Logged-out guest canvas actions can also use dedicated built-in preview keys for a single real AI action before sign-in is required.
 
 ---
 

backend/Coliee.API.Tests/AuthControllerTests.cs

@@ -2,6 +2,7 @@
 using Coliee.API.DTOs;
 using Coliee.API.Services;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Logging.Abstractions;
 using Xunit;
 
 namespace Coliee.API.Tests;
@@ -57,7 +58,14 @@ public async Task ResendPasswordResetOtp_ReturnsRateLimitPayload_OnBlock()
     }
 
     private static AuthController CreateController(IPasswordResetOtpService passwordResetOtpService) =>
-        new(null!, null!, passwordResetOtpService, new StubEmailVerificationOtpService(), new StubPasswordPolicyService(), new StubGoogleAuthService());
+        new(
+            null!,
+            null!,
+            passwordResetOtpService,
+            new StubEmailVerificationOtpService(),
+            new StubPasswordPolicyService(),
+            new StubGoogleAuthService(),
+            NullLogger<AuthController>.Instance);
 }
 
 internal sealed class StubPasswordResetOtpService : IPasswordResetOtpService

backend/Coliee.API.Tests/Controllers/AuthControllerTests.cs

@@ -5,6 +5,7 @@
 using Coliee.API.Services;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.Logging.Abstractions;
 using Xunit;
 
 namespace Coliee.API.Tests.Controllers;
@@ -49,7 +50,7 @@
         Assert.Equal("user@example.com", payload.Email);
         Assert.Equal(2, payload.ResendAttemptsRemaining);
         Assert.Equal(1, repo.ResetFailedLoginCallCount);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
     }
 
     [Fact]
@@ -62,7 +63,7 @@
 
         var unauthorizedResult = Assert.IsType<UnauthorizedObjectResult>(result);
         Assert.Equal(401, unauthorizedResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.CreateGoogleUserCallCount);
     }
 
@@ -79,7 +80,7 @@
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(503, objectResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.CreateGoogleUserCallCount);
     }
 
@@ -154,7 +155,7 @@
 
         var objectResult = Assert.IsType<ObjectResult>(result);
         Assert.Equal(429, objectResult.StatusCode);
         Assert.Equal(0, repo.StoredRefreshTokens.Count);
         Assert.Equal(0, repo.ResetFailedLoginCallCount);
     }
 
@@ -220,7 +221,8 @@
             new StubPasswordResetOtpService(),
             emailVerificationOtpService ?? new StubEmailVerificationOtpService(),
             new StubPasswordPolicyService(),
-            googleAuthService);
+            googleAuthService,
+            NullLogger<AuthController>.Instance);
     }
 
     private static TokenService CreateTokenService()