Environment Configuration

Relevant source files

The following files were used as context for generating this wiki page:

• README.md
• SUPABASE_SETUP.md
• INTEGRATION_GUIDE.md
• schema.prisma
• api/enhance-resume/[id]/route.ts
• package.json

The environment configuration for the GUC Resume Enhancer is managed through a .env file in the root of the project. This file provides the necessary credentials and settings for the application to connect to external services, including the database, file storage, authentication services, and AI providers. Proper configuration is critical for the application to function correctly.

This document outlines all the required environment variables, their purpose, and how they are used within the application's architecture. The primary external dependency is Supabase, which provides both the PostgreSQL database and file storage capabilities.

Environment Variables

All sensitive keys and environment-specific settings are managed through a .env file. Below is a comprehensive list of variables required to run the application.

Sources: README.md:39-57, SUPABASE_SETUP.md:48-65, INTEGRATION_GUIDE.md:65-77

Variable	Description	Example
DATABASE_URL	The connection string for the PostgreSQL database. The project uses Supabase's PostgreSQL instance.	postgresql://postgres:your-password@db.vpvvcwvebjtibafsceqx.supabase.co:5432/postgres
NEXT_PUBLIC_SUPABASE_URL	The public URL for the Supabase project.	https://vpvvcwvebjtibafsceqx.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY	The public anonymous key for the Supabase project, used for client-side interactions.	your-supabase-anon-key
SUPABASE_SERVICE_ROLE_KEY	The secret service role key for Supabase, used for admin-level backend operations like file uploads.	your-supabase-service-role-key
NEXTAUTH_SECRET	A secret key used by NextAuth.js to sign session cookies and tokens.	your-random-secret-key-min-32-characters-here
NEXTAUTH_URL	The canonical URL of the deployed application, used by NextAuth.js for callbacks.	http://localhost:3000
ENCRYPTION_KEY	A 32-character secret key used to encrypt and decrypt user-provided AI API keys stored in the database.	your-32-character-encryption-key
OPENAI_API_KEY	(Optional) A system-wide API key for OpenAI. Users can also provide their own.	sk-your-openai-key
ANTHROPIC_API_KEY	(Optional) A system-wide API key for Anthropic.	sk-ant-your-anthropic-key
GOOGLE_API_KEY	(Optional) A system-wide API key for Google Gemini.	your-google-key
NODE_ENV	The node environment.	development

Example .env File

# Supabase Configuration
NEXT_PUBLIC_SUPABASE_URL="https://vpvvcwvebjtibafsceqx.supabase.co"
NEXT_PUBLIC_SUPABASE_ANON_KEY="your-anon-key-here"
SUPABASE_SERVICE_ROLE_KEY="your-service-role-key-here"

# Database (Supabase PostgreSQL)
DATABASE_URL="postgresql://postgres:your-password@db.vpvvcwvebjtibafsceqx.supabase.co:5432/postgres"

# NextAuth Configuration
NEXTAUTH_SECRET="your-random-secret-key-min-32-characters-here"
NEXTAUTH_URL="http://localhost:3000"

# Encryption Key (for API key storage - must be exactly 32 characters)
ENCRYPTION_KEY="your-32-character-encryption-key"

# Optional: System-wide AI Provider API Keys
OPENAI_API_KEY="sk-your-openai-api-key"
ANTHROPIC_API_KEY="sk-ant-your-anthropic-api-key"
GOOGLE_API_KEY="your-google-gemini-api-key"

# Node Environment
NODE_ENV="development"

Sources: SUPABASE_SETUP.md:47-66

Service Configuration

The environment variables connect the Next.js application to several key services. The diagram below illustrates the flow of configuration data.

This diagram shows how the .env file provides credentials to different modules within the Next.js application, which in turn communicate with their respective external services.

Supabase Configuration

Supabase is used for the database, authentication, and file storage.

Sources: SUPABASE_SETUP.md, INTEGRATION_GUIDE.md

Database

The application uses Prisma as its ORM, which connects to the Supabase PostgreSQL database via the DATABASE_URL environment variable.

The schema.prisma file defines the data models and specifies the database provider.

// schema.prisma

datasource db {
    provider = "postgresql"
    url      = env("DATABASE_URL")
}

Sources: schema.prisma:7-11

After setting the DATABASE_URL, the schema can be synchronized with the database using Prisma commands:

npx prisma generate
npx prisma db push

Sources: SUPABASE_SETUP.md:40-43

Storage

File storage for resumes is handled by Supabase Storage. A private bucket named resumes is required.

• Bucket Name: resumes
• Public Access: No

The file storage structure is organized by user ID to ensure data isolation.

resumes/
  └── {userId}/
      ├── {timestamp}-resume1.pdf
      └── {timestamp}-resume2.docx

Sources: SUPABASE_SETUP.md:19-25, 100-105

Access to the storage bucket is controlled by Row Level Security (RLS) policies.

Policy Description	Action	SQL
Users can upload their own resumes	INSERT	CREATE POLICY "Users can upload their own resumes" ON storage.objects FOR INSERT TO authenticated WITH CHECK (bucket_id = 'resumes' AND auth.uid()::text = (storage.foldername(name))[1]);
Users can read their own resumes	SELECT	CREATE POLICY "Users can read their own resumes" ON storage.objects FOR SELECT TO authenticated USING (bucket_id = 'resumes' AND auth.uid()::text = (storage.foldername(name))[1]);
Users can delete their own resumes	DELETE	CREATE POLICY "Users can delete their own resumes" ON storage.objects FOR DELETE TO authenticated USING (bucket_id = 'resumes' AND auth.uid()::text = (storage.foldername(name))[1]);

Sources: SUPABASE_SETUP.md:30-41

AI Provider Configuration

The application can use system-wide API keys for OpenAI, Anthropic, and Google Gemini. These are configured via OPENAI_API_KEY, ANTHROPIC_API_KEY, and GOOGLE_API_KEY environment variables. If these are not set, users must provide their own keys, which are then stored encrypted in the database using the ENCRYPTION_KEY.

The api/enhance-resume/[id]/route.ts endpoint retrieves the active user API key, decrypts it, and uses it to call the appropriate AI provider.

This sequence shows the process of using an encrypted user-provided API key for an enhancement request.

Sources: api/enhance-resume/[id]/route.ts:160-192, README.md:55-57

Security Configuration

The ENCRYPTION_KEY is a critical piece of the environment configuration. It must be a string of exactly 32 characters. This key is used to encrypt user-provided AI API keys before they are stored in the UserApiKey table in the database, ensuring that sensitive credentials are not stored in plain text. The decryptApiKey function is used to retrieve the plain key at runtime when making API calls.

Sources: INTEGRATION_GUIDE.md:74-75, api/enhance-resume/[id]/route.ts:178