UpScaler-AI Backend

This repository hosts two backend services:

Folder	Stack	Purpose
node-api/	Node.js / Express / MongoDB	Clean-architecture REST API, RBAC, JWT + Google OAuth — sole source of truth for every route the frontend calls
ai-service/	Python 3.12 / FastAPI / MongoDB	Narrow internal AI microservice (interview question generation, resume AI features) — called only by node-api over a JWT-authenticated internal API, never directly by the frontend

See node-api/README.md for architecture and node-api/REQUIREMENTS.md for prerequisites.

Python service removal — and why ai-service/ is not that service coming back

The original python-service/ (Python 3.12 / FastAPI / MongoDB) was removed. It predated node-api and the two had drifted into duplicate, inconsistently-behaving implementations of the same routes (auth, students, placements, etc.) against separate MongoDB databases. node-api had already reached full functional parity with every endpoint the live frontend actually calls (see SECURITY_AUDIT.md for the migration history), so keeping both running was pure duplicated maintenance and deployment surface with no remaining benefit. Its git history is preserved; see the commit that removed it for the full file list. Full migration/removal notes are appended to SECURITY_AUDIT.md. Its leftover files on disk (a stale .venv, caches, .env) were never cleaned up after that removal and have since been deleted for real.

ai-service/ is a deliberately smaller, newly-built replacement for one narrow slice of functionality — the Groq-backed AI features (interview question generation, resume analysis/JD matching/AI-suggest/parsing, assessment question generation) that used to live directly inside node-api via groq-sdk. It owns no business data (no students/placements/auth — those stay in node-api/MongoDB), is never called directly by the frontend, and every route requires a JWT node-api mints per-request (see ai-service/app/security.py). It is not a restoration of the old full-stack duplicate service described above.

Recent updates

• Added the full Node/Express/PostgreSQL API (16-table schema, RBAC, JWT + Google OAuth, clean architecture, deployment docs) — originally scaffolded at the repo root.
• Removed ~19 stale one-off debug/migration scripts that had accumulated at the repo root (fix_db*.py, migrate_to_mongo.py, sync_sqlite_to_mongo.py, query_db*.py, test_hash.py, change_admin_pass.py, check.py, test-login.js, a query.js with a hardcoded DB password, an empty skillovate.db, and an unused main.py stub) and ~60 committed __pycache__/*.pyc files; added the right patterns to .gitignore so they don't return.
• Reorganized the repo root: what used to be a flat mix of Python and Node config files is now split into python-service/ and node-api/, each self-contained. Dockerfile.node was renamed to plain Dockerfile inside node-api/ (the .node extension was being misread as a compiled Node binary by some tooling, and the suffix was only there to avoid colliding with the Python service's Dockerfile when both sat in the same folder — no longer needed once separated).
• Found and relocated seed_mongo.py (created outside this cleanup, containing a hardcoded plaintext MongoDB Atlas password) into python-service/ — that credential should be rotated; see the security note in python-service/README.md.
• Swapped the Node API's database from PostgreSQL to MongoDB — no live Postgres instance was ever provisioned, whereas the Python service's MongoDB Atlas connection was already proven working. sql/schema.sql was replaced by node-api/scripts/setupIndexes.js (creates the same uniqueness/query indexes without SQL). Both services now use MongoDB, but on separate database names (upscaler_ai for Python, upscaler_ai_node for Node) on the same cluster — they do not share collections, and each still owns its own connection string.
• Standardized the Python service on MongoDB only. It still carried a full SQLAlchemy layer (an ORM model package, alembic.ini, sqlalchemy/alembic/psycopg dependencies, a DATABASE_URL setting, and Session/Query type hints on functions that were actually being handed a Mongo handle) left over from the Postgres era. All of it was unreachable at runtime and has been removed — see SECURITY_AUDIT.md for the full inventory. The same pass found that the service's real drivers (motor, pymongo, certifi, groq) were never declared in requirements.txt, which meant the built Docker image crashed on startup.

Local development ports

Service	URL
Frontend	http://localhost:5173 (or 3000 for the existing Next.js app)
Node API	http://localhost:5000

The frontend's NEXT_PUBLIC_API_URL should point at http://localhost:5000/api/v1. Its unset-env-var fallback (src/lib/api.ts, D:\Upscaler-Frontend) still defaults to port 8000 — a leftover from when python-service owned that port. That fallback only matters if NEXT_PUBLIC_API_URL is unset; update it to 5000 (or set the env var everywhere it's deployed) as a follow-up.