JEENEETARD

JEENEETARD is an independent, free educational directory for finding curriculum-organised YouTube courses and lectures. Students can browse by exam, class, subject and chapter, then watch lessons through YouTube's official privacy-enhanced player.

The application stores YouTube identifiers and descriptive catalogue data. It does not host the videos and is not affiliated with YouTube, Google, an institute or a coaching provider.

Current release

The production frontend is intentionally capability-gated. Existing code does not make a feature production-ready; the matching database capability, security controls and release evidence must also be present.

Capability	Current state
Anonymous catalogue browsing	Enabled
Curriculum navigation	Enabled
YouTube privacy-enhanced playback	Enabled
Device-local watch progress	Enabled
Universal search	Enabled
Course comparison	Enabled
Faculty profiles and filtering	Enabled
School-board classification	Enabled
Study-material library	Enabled
Public student accounts	Enabled
Rating submission	Enabled
Review display	Enabled
Content reporting	Enabled
Student forum	Enabled — limited closed beta; public reading, invited-member contributions
Continue with Google sign-in	Enabled
Student polls	Enabled — schema installed on production; the database poll_mode() is the live switch (docs/polls/POLLS_V1_ACTIVATION_RUNBOOK.md)

The source of truth is src/releaseCapabilities.js. Do not enable a flag merely because its React component or SQL file exists.

Technology

• React 19 and Vite 8
• JavaScript with Vitest and Testing Library
• Tailwind CSS 4 through @tailwindcss/vite
• React Router
• Supabase (Postgres, Auth, RLS and RPCs)
• YouTube privacy-enhanced embeds
• Vercel or Netlify deployment configuration

CI runs on Node.js 24.

Safe local setup

Requirements:

• Node.js 24
• Git
• A Supabase project URL and browser-safe anon/publishable key

From PowerShell:

git clone https://github.com/jeeneetardshelp-cpu2027/jeeneetards.git
cd jeeneetards
Copy-Item .env.example .env
npm ci
npm run dev

Edit the new .env before starting the app:

VITE_SUPABASE_URL=https://your-project-ref.supabase.co
VITE_SUPABASE_ANON_KEY=your-anon-public-key

There is no browser YouTube key. The admin playlist importer calls YouTube through api/youtube.js, a server-side proxy that reads the server-only YOUTUBE_API_KEY and requires an admin Supabase session. That key and the Supabase service-role key are needed only by that proxy and by specific local administrative scripts.

Vite prints the local URL, normally http://localhost:5173. Public catalogue browsing must work without signing in.

Credential rules

These are release-blocking rules:

1. Every VITE_ value is bundled into public browser JavaScript. Never put a service-role key, server key or other secret in a VITE_ variable.
2. VITE_SUPABASE_ANON_KEY must be an anon/publishable key protected by Supabase Row Level Security.
3. SUPABASE_SERVICE_ROLE_KEY bypasses RLS. Keep it local, never add it to Git, and never configure it in the frontend deployment.
4. VITE_YOUTUBE_API_KEY no longer exists. It was removed on 2026-08-10 because Vite inlines every VITE_ value into the public bundle, so an HTTP-referrer restriction did not protect it. YOUTUBE_API_KEY is the single server/script key, restricted by IP, used by api/youtube.js and the Node scripts.
5. Real .env and .env.staging files are ignored. Only the example files belong in Git.
6. Do not paste credentials into issues, pull requests, screenshots or chat. Rotate a key immediately if exposure is suspected.

GitHub CI uses clearly labelled fake public placeholders. It does not receive the local .env file or any privileged credential.

Everyday commands

Command	Purpose
npm run dev	Start the local development server
npm run lint	Check JavaScript, React hooks and accessibility rules
npm test	Run the complete automated test suite once
npm run build	Create the production bundle in dist/
npm run preview	Preview the built bundle locally
npm run verify:frontend-release	Check secrets, metadata, headers, SPA routing and legal placeholders
npm run verify:production-capabilities	Read-only check that production API capabilities match the frontend flags
npm run audit:production-catalog	Read-only anonymous inventory of live catalogue metadata and coverage
npm run review:ingestion -- --playlist=<ID> --expected-project-ref=<REF>	Build an outside-repository, read-only human-review bundle from real YouTube metadata and live public taxonomy
npm run prepare:ingestion-review -- --playlist=<ID> --expected-project-ref=<REF> --out-dir=<NEW_DIR> [--check]	Run the complete fail-closed review preparation; --check creates no files, while --bundle=<REVIEW> reverifies an existing real bundle offline
npm run verify:ingestion-preparation -- --receipt=<RECEIPT>	Offline verification of the complete preparation receipt, all four artifact hashes, bindings, and blank-response state
npm run verify:ingestion-review -- --bundle=<FILE>	Offline integrity check for a generated ingestion human-review bundle
npm run prepare:ingestion-decisions -- --bundle=<FILE>	Create a hash-bound, non-importable human decision worksheet outside the repository
npm run verify:ingestion-decisions -- --bundle=<REVIEW> --decisions=<DECISIONS>	Offline integrity and human-completion check for an ingestion decision worksheet
npm run render:ingestion-review -- --bundle=<REVIEW> --decisions=<DECISIONS> [--prior-manifest=<MANIFEST>]	Render a hash-bound, evidence-only Markdown packet; an optional prior reviewed manifest is exact-source-bound and labelled historical

For a normal frontend change, run:

npm run lint
npm test
npm run build
npm run verify:frontend-release

GitHub Actions repeats npm ci, static checks, tests, build and the frontend release verifier for every push to main and every pull request.

The production catalogue audit uses only the browser-safe anonymous key and performs SELECT queries only; it has no write path and never imports the service-role key. It also reports exact video overlap between playlists so a duplicate course can be reviewed before removal. Its sanitized JSON report is written outside the repository at ../outputs/catalog-production-inventory.json.

Project map

Path	Responsibility
src/App.jsx	Routing, shared layout and capability-gated routes
src/Home.jsx	Student landing page and guided entry points
src/Explore.jsx	Curriculum exploration flow
src/BrowsePage.jsx	The /browse catalogue and filter page
src/PlaylistBrowse.jsx	Course and lecture results
src/CourseVideoPage.jsx	Course detail and lesson playback
src/searchDestinations.js	Where a search result lands; one definition for every search surface
src/releaseCapabilities.js	Current production capability contract
supabase/migrations/	The ordered migration chain — the schema source of truth
docs/schema_reference.md	Generated reference for the production schema
src/migrations/	Historical migration sources; not a status report and not an instruction to run them
production/	Production packages, evidence, hashes and runbooks
middleware.js, ogInject.js	Edge-rendered metadata and crawler-visible content for SPA routes
docs/	Security, deployment, staging and scale evidence
public/	Favicon, social preview, robots policy and early theme script
.github/workflows/ci.yml	Automated test/build/release gate

Theme colours come from ThemeContext/useTheme; components do not use Tailwind's dark: variant. Brand accents are navy #142A4F and teal #0F6F78.

Database and production safety

Schema truth is the ordered Supabase CLI migration chain in supabase/migrations/ — see supabase/README.md. The baseline 20260831140005_production_baseline.sql is the live production schema (66 tables, 181 functions, 98 RLS policies); a schema change ships as a new timestamped file in that directory and is applied with npx supabase db push. db push applies every pending migration at once, so review npx supabase migration list first. The Supabase SQL Editor is for reading — audits and verification — not schema writes. docs/schema_reference.md is a generated, grouped reference for that baseline.

src/migrations/, production/ and the loose .sql files at the repository root are history. Several still carry "not applied to production" headers that are no longer true, so never read live status from them. Most development does not require a database migration at all.

Before any production database operation:

1. Obtain explicit owner approval for that exact operation.
2. Confirm the target project in the Supabase header; never rely only on a tab title or remembered URL.
3. Verify a recent restorable backup.
4. Pass the relevant disposable-staging gate.
5. Follow the matching preflight, hash, migration, postflight and rollback instructions in the applicable runbook.
6. Stop immediately if preflight or postflight evidence differs from the documented expectation.
7. Update releaseCapabilities.js only after the production capability is deployed and verified.

Do not run staging fixtures or destructive verification helpers against production. .env.staging.example documents the separate disposable-staging credentials and opt-in marker.

Deployment

Read docs/frontend_deployment.md before a public deployment. The repository contains SPA rewrites and security headers for both Vercel and Netlify.

The deployment platform needs these browser-safe build values:

• VITE_SUPABASE_URL
• VITE_SUPABASE_ANON_KEY

api/youtube.js is a server-side function, so the deployed admin importer also needs YOUTUBE_API_KEY configured as a server variable — never with a VITE_ prefix, which would inline it into the public bundle. Leave it unset if the deployed importer is not used.

Never configure SUPABASE_SERVICE_ROLE_KEY in the frontend deployment, and never expose any server key through a VITE_ variable. (docs/frontend_deployment.md still lists the removed VITE_YOUTUBE_API_KEY here and has not been updated.)

Before promotion, confirm the GitHub Actions run is green and run the read-only production capability check against the intended production project.

Further operational documentation

• Release checkpoint — 25 July 2026
• Backup and restore readiness
• Checklist for future Codex tasks
• Mass-ingestion preflight
• Frontend deployment gate
• Catalogue scale gate
• Import and migration hardening
• Faculty release gate
• Content-report production runbook
• Production migration runbook
• Catalogue navigation production runbook

License

No open-source license has been selected. Until the owner makes and documents a license decision, the repository is not licensed for copying, redistribution or external reuse.