AI Prompt Engineering Assistant
PromptTune
Next.js 14 chat app that refines prompts through Gemini server actions, Firebase Auth, and Firestore history. Live at prompttune.prashant-zo.com.
LIVE
in production
Goal
PromptTune helps users improve prompts for LLM workflows. The UI offers leveled suggestions (Beginner, Intermediate, Advanced), markdown rendering, copy-to-clipboard, and dark mode.
Stack: Next.js 14 App Router, Google Gemini, Firebase Auth and Firestore, Tailwind CSS, and Shadcn UI components under src/app/components/.
Client application
src/app/page.tsx wraps the experience in AuthProvider. Sidebar lists chat threads. ChatArea and MessageInput handle streaming display and attachments. TopBar covers theme toggle and account actions.
Login and signup routes live under src/app/login and src/app/signup. Unauthenticated users see a marketing-style landing with navigation into auth flows.
Firestore stores chats and messages with serverTimestamp ordering. compressImage in src/lib/image-utils.ts reduces upload size before Storage writes.
Gemini integration
refinePromptOrGeneratePath in src/app/actions.ts runs on the server with GoogleGenerativeAI. Defaults include GEMINI_MODEL (gemini-3-flash-preview in repo), MAX_INPUT_LENGTH 8000, MAX_HISTORY_MESSAGES 8, FETCH_TIMEOUT_MS 15000.
Responses stream to the client for live token display. Server actions keep the Gemini API key off the browser.
Auth, Firestore, Storage
Firebase modules under src/lib/ configure auth, firestore, and storage clients. Each user owns chat documents; messages append with arrayUnion patterns where needed.
Attachments upload to Firebase Storage; download URLs feed back into message metadata for multimodal Gemini calls.
.env.local documents NEXT_PUBLIC_FIREBASE_* variables and GEMINI_API_KEY for local development.
Security controls
ALLOWED_MIME_TYPES restricts uploads to images and application/pdf. MAX_SERVER_FILE_SIZE is 5MB.
ALLOWED_URL_PREFIXES limit server-side fetches to firebasestorage.googleapis.com, storage.googleapis.com, and *.firebasestorage.app hostnames to reduce SSRF risk.
In-memory rate limiting tracks 20 requests per minute per userId with periodic map cleanup on long-running Node processes.
Deployment
Production host: https://prompttune.prashant-zo.com/ (also linked from portfolio liveUrl).
README documents Vercel deployment and setting the same environment variables in the hosting dashboard. cors.json configures Storage CORS for browser uploads.