Real-time collaborative coding for pair programming, technical interviews, and shared code execution.
PairPad is a full-stack collaborative coding platform built around Monaco Editor, Socket.IO, a conflict-free sequence CRDT, persistent room state and revision history, remote cursors, role-based access, workspace files, interview mode, and integrated code execution. Multiple users can join a room, edit documents concurrently, compare revisions, restore checkpoints, chat, execute code, and collaborate directly in the browser.
| Category | What It Does |
|---|---|
| Authentication | Register, login, rotating JWT access/refresh sessions, logout-all, and safer HttpOnly refresh-cookie storage |
| Rooms | Create, join, leave, delete, transfer ownership, and manage member roles |
| Live Editing | Monaco Editor backed by a deterministic sequence CRDT; concurrent edits converge without last-write-wins document replacement |
| Remote Cursors | Throttled cursor/selection broadcasting with deterministic collaborator colors and hover names |
| Presence | Real-time list of connected room members with reconnect cleanup and Redis-backed multi-instance support |
| Roles | Owner, editor, and viewer permissions enforced by REST and Socket.IO and mirrored by the UI |
| Revision History | Automatic checkpoints, manual checkpoints, comparisons, authorship metadata, and owner-only restore |
| Workspace | Multi-file tree with create, rename, delete, language detection, per-file CRDT state, and active-file execution |
| Interview Mode | Problem statements, candidate assignment, timer, public/hidden tests, lifecycle controls, and safe hidden-result redaction |
| Chat | MongoDB-backed persistent room messaging with real-time delivery |
| Code Execution | Judge0 integration plus an optional isolated execution worker |
| Security | Helmet/CSP, CORS allowlist, rate limiting, input limits, request correlation, role enforcement, isolated execution, and protected metrics |
| Resilience | Socket reconnection, room rejoin, CRDT recovery, distributed document state, document restore propagation, and health/readiness probes |
| Observability | Structured request logs, request IDs, latency counters, status counters, and Prometheus-compatible metrics |
| Accessibility | Skip navigation, keyboard focus styling, reduced-motion support, semantic controls, and automated browser accessibility gates |
| Role | View | Edit | Execute | Create checkpoint | Manage members | Transfer ownership | Restore | Delete room |
|---|---|---|---|---|---|---|---|---|
| Owner | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
| Editor | Yes | Yes | Yes | Yes | No | No | No | No |
| Viewer | Yes | No | No | No | No | No | No | No |
The server remains authoritative; hiding UI controls is never used as a security boundary.
PairPad includes automated browser checks for accessible names, form labels, image alternatives, keyboard navigation hygiene, and visible focus. It also provides skip navigation, route-focus management, and reduced-motion support. See docs/ACCESSIBILITY.md for the release gate and manual WCAG review checklist.
| Layer | Technologies |
|---|---|
| Frontend | React 18, Vite, React Router v6, Axios, Socket.IO Client, Monaco Editor |
| Backend | Node.js 18+, Express 4, Socket.IO 4, MongoDB + Mongoose 8, JWT, bcryptjs, express-rate-limit, Helmet, Redis adapter |
| Collaboration | Dependency-free sequence CRDT over authenticated Socket.IO transport |
| Code Execution | Judge0 CE + optional isolated execution worker |
| Testing | Jest + Supertest · Vitest + Testing Library · Playwright |
| Tooling | ESLint + Prettier · GitHub Actions · CodeQL · Dependabot |
git clone https://github.com/assishmoncs/pairpad.git
cd pairpadcd backend
npm install
cp .env.example .env
# fill in MONGODB_URI and JWT_SECRET
npm run devBackend: http://localhost:5000 · health: GET /health · readiness: GET /ready · metrics: GET /metrics.
cd ../frontend
npm install
npm run devFrontend: http://localhost:5173.
docker compose up --buildThe Compose stack includes MongoDB, Redis, backend, frontend, and the optional execution worker. Production local execution remains disabled by default.
The REST contract is exposed at /api/openapi.yaml with a human-readable documentation landing page at /api/docs. Operational metrics are exposed through /metrics; in production this endpoint requires METRICS_TOKEN.
Backend: npm test · frontend: npm test / npm run test:coverage · browser: npx playwright test.
CI provisions MongoDB and Redis, runs lint/format/test/build checks, browser collaboration tests, security flows, performance budgets, and accessibility gates. Browser failures retain screenshots, traces, video, and server logs.
Releases use semantic version tags such as v1.0.0. The release workflow validates the source, builds and publishes immutable backend, frontend, and execution-worker images to GitHub Container Registry, records source provenance, and provides a smoke-test stage. See docs/RELEASE.md for promotion and rollback guidance.
The backend lockfile currently needs regeneration in a network-enabled environment after the Redis dependencies were added; until that is done, CI intentionally uses npm install rather than pretending npm ci is reproducible.
- Repository quality baseline and security automation
- Docker deployment foundation
- CRDT-based concurrent collaboration
- Remote Monaco cursors and presence cleanup
- Owner/editor/viewer authorization
- Revision history, comparison, checkpoints, and restore
- Rotating refresh-token sessions / hardened cookies
- Redis-backed horizontal Socket.IO scaling
- Isolated execution worker integration
- Playwright E2E and adversarial security suites
- OpenAPI contract
- Interview mode with hidden test cases
- Multi-file workspace
- Observability baseline
- Performance budgets and load-test gates
- Automated accessibility gate
- Release and rollback runbook
See docs/RBAC.md, docs/system-design.md, docs/DEPLOYMENT.md, docs/RELEASE.md, docs/ACCESSIBILITY.md, docs/PERFORMANCE.md, and docs/QUALITY_BASELINE.md.
MIT — see LICENSE.