Skip to content

Commit 873cef4

Browse files
landigflandigf
committed
Bootstrap Papers web-first v1 platform
1 parent dd066bb commit 873cef4

65 files changed

Lines changed: 11704 additions & 3 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.editorconfig‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
root = true
2+
3+
[*.{ts,tsx,js,jsx,json,md}]
4+
indent_style = space
5+
indent_size = 2
6+
charset = utf-8
7+
end_of_line = lf
8+
insert_final_newline = true
9+
trim_trailing_whitespace = true

‎.env.example‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
DATABASE_URL=
2+
PGLITE_DATA_DIR=./packages/db/.data
3+
BETTER_AUTH_SECRET=
4+
BETTER_AUTH_URL=http://localhost:3000
5+
BETTER_AUTH_TRUSTED_ORIGINS=http://localhost:3000
6+
PAPERS_USE_DEMO_DATA=true
7+
PAPERS_DEFAULT_HANDLE=demo-researcher
8+
PAPERS_ORCID_DISCOVERY_URL=https://orcid.org/.well-known/openid-configuration
9+
PAPERS_ORCID_CLIENT_ID=
10+
PAPERS_ORCID_CLIENT_SECRET=
11+
PAPERS_ORCID_SCOPES=openid,/authenticate
12+
PAPERS_R2_ACCOUNT_ID=
13+
PAPERS_R2_ACCESS_KEY_ID=
14+
PAPERS_R2_SECRET_ACCESS_KEY=
15+
PAPERS_R2_BUCKET=
16+
PAPERS_R2_PUBLIC_BASE_URL=
17+
PAPERS_XAI_API_KEY=
18+
PAPERS_XAI_MODEL=grok-4-1-fast
19+
PAPERS_XAI_BASE_URL=https://api.x.ai/v1
20+
TRIGGER_SECRET_KEY=
21+
TRIGGER_PROJECT_REF=

‎.github/workflows/ci.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
name: ci
2+
3+
on:
4+
push:
5+
branches: ["main"]
6+
pull_request:
7+
8+
jobs:
9+
validate:
10+
runs-on: ubuntu-latest
11+
steps:
12+
- uses: actions/checkout@v5
13+
- uses: actions/setup-node@v6
14+
with:
15+
node-version: 23
16+
cache: npm
17+
- run: npm install
18+
- run: npm run lint
19+
- run: npm run test
20+
- run: npm run check
21+
- run: npm run build

‎.gitignore‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
node_modules
2+
.turbo
3+
.next
4+
dist
5+
coverage
6+
.DS_Store
7+
.env
8+
.env.local
9+
.env.development.local
10+
.env.test.local
11+
.env.production.local
12+
packages/db/.data

‎.nvmrc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
23

‎AGENTS.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# AGENTS
2+
3+
Papers is fully AI-written and orchestrated through Jarvis. Work from these rules:
4+
5+
1. Preserve the package boundaries in `ARCHITECTURE.md`.
6+
2. Treat blind-mode safety as a non-negotiable product invariant.
7+
3. Do not invent silent side effects, unsafe external calls, or hidden data flows.
8+
4. If a change spans multiple packages or takes more than a short session, write a plan in `docs/PLANS.md`.
9+
5. Prefer explicit contracts in `packages/contracts` before wiring new behavior in the app.
10+
6. Keep future features such as groups, direct messages, collaborator requests, and opportunities as visible backlog items until explicitly implemented.

‎ARCHITECTURE.md‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
# Architecture
2+
3+
Papers is a web-first research sharing platform with a single primary runtime in
4+
`apps/web`.
5+
6+
## Boundaries
7+
8+
- `apps/web`
9+
- Owns routes, server actions, page composition, uploads, and Trigger.dev task entrypoints.
10+
- `packages/db`
11+
- Owns schema, persistence adapters, and public serialization rules.
12+
- `packages/auth`
13+
- Owns Better Auth, session helpers, and ORCID linking configuration.
14+
- `packages/contracts`
15+
- Owns product types, enums, validation, and blind-mode-safe public shapes.
16+
- `packages/config`
17+
- Owns all environment parsing.
18+
- `packages/ai`
19+
- Owns Grok provider integration and safe-to-send checks.
20+
- `packages/ui`
21+
- Owns shared primitives and reusable presentation components.
22+
23+
## Safety Invariants
24+
25+
- Blind posts store internal ownership but must never expose author identity publicly.
26+
- No private or blind-mode content is sent to Grok.
27+
- Public feed ranking must be deterministic and explainable.
28+
- Groups, DMs, collaborator requests, and opportunities stay outside the v1 execution path until promoted from backlog.

‎LICENSE‎

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
Apache License
2+
Version 2.0, January 2004
3+
http://www.apache.org/licenses/
4+
5+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
6+
7+
1. Definitions.
8+
9+
"License" shall mean the terms and conditions for use, reproduction, and
10+
distribution as defined by Sections 1 through 9 of this document.
11+
12+
"Licensor" shall mean the copyright owner or entity authorized by the copyright
13+
owner that is granting the License.
14+
15+
"Legal Entity" shall mean the union of the acting entity and all other entities
16+
that control, are controlled by, or are under common control with that entity.
17+
For the purposes of this definition, "control" means (i) the power, direct or
18+
indirect, to cause the direction or management of such entity, whether by
19+
contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
20+
outstanding shares, or (iii) beneficial ownership of such entity.
21+
22+
"You" (or "Your") shall mean an individual or Legal Entity exercising
23+
permissions granted by this License.
24+
25+
"Source" form shall mean the preferred form for making modifications, including
26+
but not limited to software source code, documentation source, and configuration
27+
files.
28+
29+
"Object" form shall mean any form resulting from mechanical transformation or
30+
translation of a Source form, including but not limited to compiled object code,
31+
generated documentation, and conversions to other media types.
32+
33+
"Work" shall mean the work of authorship, whether in Source or Object form, made
34+
available under the License, as indicated by a copyright notice that is included
35+
in or attached to the work.
36+
37+
"Derivative Works" shall mean any work, whether in Source or Object form, that
38+
is based on (or derived from) the Work and for which the editorial revisions,
39+
annotations, elaborations, or other modifications represent, as a whole, an
40+
original work of authorship.
41+
42+
"Contribution" shall mean any work of authorship, including the original version
43+
of the Work and any modifications or additions to that Work or Derivative Works,
44+
that is intentionally submitted to Licensor for inclusion in the Work by the
45+
copyright owner or by an individual or Legal Entity authorized to submit on
46+
behalf of the copyright owner.
47+
48+
"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
49+
of whom a Contribution has been received by Licensor and subsequently
50+
incorporated within the Work.
51+
52+
2. Grant of Copyright License. Subject to the terms and conditions of this
53+
License, each Contributor hereby grants to You a perpetual, worldwide,
54+
non-exclusive, no-charge, royalty-free, irrevocable copyright license to
55+
reproduce, prepare Derivative Works of, publicly display, publicly perform,
56+
sublicense, and distribute the Work and such Derivative Works in Source or
57+
Object form.
58+
59+
3. Grant of Patent License. Subject to the terms and conditions of this License,
60+
each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
61+
no-charge, royalty-free, irrevocable patent license to make, have made, use,
62+
offer to sell, sell, import, and otherwise transfer the Work.
63+
64+
4. Redistribution. You may reproduce and distribute copies of the Work or
65+
Derivative Works thereof in any medium, with or without modifications, and in
66+
Source or Object form, provided that You meet the conditions of the Apache 2.0
67+
license.
68+
69+
5. Submission of Contributions. Unless You explicitly state otherwise, any
70+
Contribution intentionally submitted for inclusion in the Work by You to the
71+
Licensor shall be under the terms and conditions of this License.
72+
73+
6. Trademarks. This License does not grant permission to use the trade names,
74+
trademarks, service marks, or product names of the Licensor.
75+
76+
7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
77+
writing, Licensor provides the Work on an "AS IS" BASIS, WITHOUT WARRANTIES OR
78+
CONDITIONS OF ANY KIND.
79+
80+
8. Limitation of Liability. In no event and under no legal theory shall any
81+
Contributor be liable to You for damages arising from this License or out of the
82+
use or inability to use the Work.
83+
84+
9. Accepting Warranty or Additional Liability. While redistributing the Work or
85+
Derivative Works thereof, You may choose to offer, and charge a fee for,
86+
acceptance of support, warranty, indemnity, or other liability obligations.

‎README.md‎

Lines changed: 64 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,65 @@
1-
# Papers 🦆🦆
2-
Stop sharing your research papers on linkedin (it's sad), I'm trying to create a mvp for a dedicated platform.
1+
# Papers
32

4-
[If you are bored :)](https://landigf.github.io/papers-platform-idea.html)
3+
Papers is a web-first platform for sharing research, discussing work in progress,
4+
publishing papers without turning LinkedIn into an accidental preprint server,
5+
and building research discovery around interests, follows, and public discussion.
6+
7+
This repository is structured for agentic execution from day one:
8+
9+
- `apps/web`: the Next.js App Router product
10+
- `packages/auth`: Better Auth config and identity integration
11+
- `packages/db`: Drizzle schema, repositories, and demo-mode fallback
12+
- `packages/contracts`: domain types and validation
13+
- `packages/config`: runtime configuration
14+
- `packages/ai`: Grok provider and safe-to-send classification boundaries
15+
- `packages/ui`: shared UI primitives
16+
17+
## What Works In This First Slice
18+
19+
- public landing page and feed shell
20+
- sign-in and sign-up pages
21+
- profile pages by handle
22+
- paper creation flow with `public` and `blind` visibility modes
23+
- comments, follows, stars, and saved-interest actions
24+
- deterministic feed ranking from recency, follows, stars, and topic overlap
25+
- blind-mode serialization rules that suppress author identity publicly
26+
- server-side Grok adapter with explicit safety boundaries
27+
- Trigger.dev tasks for metadata enrichment, PDF processing, and feed refresh
28+
29+
## Local Development
30+
31+
This repo is designed to run in two modes:
32+
33+
- `managed mode`: real Postgres, Better Auth, R2, and Trigger.dev
34+
- `demo mode`: no external infra required, powered by a local data fallback
35+
36+
Copy `.env.example` into `.env.local` and set what you have. With no
37+
`DATABASE_URL`, the app falls back to local demo data so the product remains
38+
explorable while the production stack is being configured.
39+
40+
```bash
41+
npm install
42+
npm run lint
43+
npm run test
44+
npm run check
45+
npm run build
46+
```
47+
48+
Run the app:
49+
50+
```bash
51+
npm run dev
52+
```
53+
54+
Open `http://localhost:3000`.
55+
56+
## Production Direction
57+
58+
- database: Neon Postgres
59+
- auth: Better Auth with email login and optional ORCID linking
60+
- storage: Cloudflare R2
61+
- jobs: Trigger.dev
62+
- external text model: Grok, server-side only, for public non-blind content
63+
64+
Blind posts never send raw private content, hidden author identity, or blind-mode
65+
assets to external model providers.

‎SECURITY.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Security
2+
3+
Papers is built for research sharing, so privacy boundaries matter early.
4+
5+
## Current Security Defaults
6+
7+
- account required for any publication
8+
- blind mode is per-post, not anonymous account creation
9+
- public serialization removes author identity from blind posts
10+
- blind posts are excluded from external AI provider submission
11+
- private drafts and moderation notes are excluded from external AI provider submission
12+
- uploads must be rewritten or scrubbed before blind-mode persistence
13+
14+
## Secrets
15+
16+
- keep all secrets in local env or a secret manager
17+
- never commit keys
18+
- never expose provider keys to the browser
19+
20+
## Vulnerability Reporting
21+
22+
Open a private report through GitHub security advisories or contact the maintainer directly before publishing exploit details.

0 commit comments

Comments
 (0)