JobIN

---

📖 Overview

JobIN is an AI-powered SaaS platform designed to streamline the modern job search. It analyzes a candidate's uploaded resume alongside target job descriptions to generate ATS-optimized resumes and cover letters.

The platform includes a public job catalogue, AI-assisted resume and cover-letter tools, an application tracker, a Chrome extension, Stripe subscriptions, and role-controlled admin workflows. Sign-in can use the configured OCI, Supabase, or Auth0 integration; this is provider-backed identity with user-scoped API authorization, not a full enterprise multi-tenant system.

✨ Key Features

• 🤖 AI Resume Tailoring: Evidence-aware, job-specific resume rewriting through the configured AI provider.
• 🔎 Job Search: Search a shared catalogue from public feeds and configured employer boards, with filters and original-source links.
• 📄 AI Cover Letters: Auto-generate personalized cover letters targeting specific hiring managers.
• 📊 Application Tracker: Visual Kanban board to track job pipelines (Applied, Interviewing, Offered).
• 🧩 Chrome Extension: Detect supported job pages and help autofill Greenhouse and Lever forms.
• 💳 Monetization & Credits: Stripe-integrated billing with an "AI Credit" system.
• 🛡️ Admin Portal: Role-permission-controlled user, billing/refund, support, notification, site banner, and CSV report tools.
• ☁️ Cloud Storage: Private resume storage in OCI Object Storage using instance-principal authentication.

🛠️ Tech Stack

JobIN is built using a modern, decoupled monorepo architecture:

• Frontend: Next.js 16 (App Router), React 19, Tailwind CSS, Radix UI.
• Backend: NestJS 12, Node.js, TypeScript.
• Database: PostgreSQL, hosted on OCI for the OCI deployment.
• ORM: Prisma.
• Authentication: The web app offers Supabase email/password and Google sign-in, plus a separate OCI IAM Identity Domains OAuth 2.0/PKCE option. The API accepts both during the transition; Auth0 remains an optional alternative.
• Storage: OCI Object Storage (private bucket; the API issues short-lived, object-scoped download links).
• AI Engine: Admin-configurable Gemini, OpenAI, Anthropic, DeepSeek, Groq, Kimi/Moonshot, NVIDIA, and hosted Ollama providers.

---

📂 Project Structure

This repository uses a workspace structure:

JobIN/
├── apps/
│   ├── api/            # NestJS API and Prisma schema/migrations
│   ├── web/            # Next.js 16 web application
│   └── extension/      # Chrome extension (Manifest V3)
├── docs/               # Product and architecture documentation
└── render.yaml         # Render API service configuration

The root-level backend/ and frontend/ directories are legacy snapshots; active development and deployment use the apps/ workspaces.

---

🧭 End-to-end architecture and data flow

Browser (Next.js) ──OCI access token───────────┐
                                               ├──> NestJS API ──Prisma──> PostgreSQL on OCI
Chrome extension ──provider access token─────────┘      │
                                                ├──> OCI Object Storage (resume files)
                                                ├──> AI provider (resume/cover letter tasks)
                                                └──> Stripe (checkout, billing portal, webhooks)

Services and responsibilities

1. Web application (apps/web) — Next.js App Router UI for registration, sign-in, resume management, AI tools, job tracking, billing, and admin pages. It uses OCI Identity Domains Authorization Code + PKCE by default and sends an API access token to the backend; ID tokens are not used for API authorization. Provider settings are in the corresponding .env.example files.
2. Chrome extension (apps/extension) — Manifest V3 extension. Its popup/options/side panel communicate with the extension service worker; the worker detects supported job pages, requests autofill data, and calls the same API endpoints as the web app. It defaults to Supabase Auth and supports OCI/Auth0 Authorization Code + PKCE using Chrome Identity. It does not connect directly to PostgreSQL or call AI providers.
3. API (apps/api) — NestJS is the trusted boundary for application data and privileged operations. The historically named SupabaseAuthGuard validates tokens for the configured provider mode (oci, oci_dual, auth0, or Supabase). It resolves the identity to a JobIN User, checks account status, and attaches roles and permissions. Controllers and services enforce endpoint and ownership authorization; services perform business logic.
4. Database — PostgreSQL stores JobIN users and roles, resumes and versions, applications, subscription and payment records, AI usage/credits, and admin configuration. The OCI deployment runs PostgreSQL in a private Docker volume on the OCI Always Free VM. Prisma schema and migrations are under apps/api/prisma; connection strings are supplied by DATABASE_URL and DIRECT_URL.
5. Resume file storage — Uploaded resume objects are stored in a private OCI Object Storage bucket; PostgreSQL stores object metadata, ownership, and keys. The API uses the OCI VM's instance principal for storage operations and issues short-lived, single-object download links after authorization checks.
6. AI providers — The API selects the configured provider/model and makes generation requests server-side. Admin-managed provider credentials are encrypted before persistence using AI_SETTINGS_ENCRYPTION_KEY; never expose provider keys to the web app or extension.
7. Billing — The API creates Stripe checkout/portal sessions and processes Stripe webhooks to update subscription/payment records. Stripe is the only customer payment method. Complimentary plans are assigned by an authorized administrator and are JobIN-managed rather than Stripe subscriptions.

This is the beginning of the README. Read the rest at the original. Read the full README ↗