Build an Online Education Platform in Lovable

Wire the Stripe enrollment flow end to end.

In create-enrollment-checkout/index.ts:
- Verify the caller is authenticated via supabase.auth.getUser()
- Look up the course by course_id to get price_cents and slug
- Create a Stripe Checkout session: mode='payment', line_items with price_data.unit_amount=price_cents, success_url=/checkout/success?session_id={CHECKOUT_SESSION_ID}, cancel_url=/courses/${slug}, metadata={course_id, student_id}
- Return {url: session.url} to the client

In stripe-webhook/index.ts:
- Read raw body FIRST: const body = await req.text()
- Get signature: const sig = req.headers.get('stripe-signature')
- Verify: const event = await stripe.webhooks.constructEventAsync(body, sig, Deno.env.get('STRIPE_WEBHOOK_SECRET'))
- Check idempotency: query stripe_events WHERE stripe_event_id = event.id; if exists return 200
- Insert stripe_events row
- On checkout.session.completed: extract course_id and student_id from event.data.object.metadata, call apply_enrollment() RPC
- Return 200

In CheckoutSuccess.tsx:
- Extract session_id from URL params
- Poll supabase.from('enrollments').select() with status='active' every 2 seconds for up to 20 seconds
- Show spinner; once enrollment is active, navigate to /learn/${slug}

Audit and tighten the lesson-videos Storage bucket RLS.

In Supabase SQL editor, run:
DROP POLICY IF EXISTS enrolled_students_read_video ON storage.objects;
CREATE POLICY enrolled_students_read_video ON storage.objects
  FOR SELECT TO authenticated
  USING (
    bucket_id = 'lesson-videos'
    AND EXISTS (
      SELECT 1 FROM lessons l
      JOIN enrollments e ON e.course_id = l.course_id
      WHERE l.video_path = name
        AND e.student_id = auth.uid()
        AND e.status = 'active'
    )
  );

Update LessonPlayer to fetch video via signed URL instead of public URL:
const { data } = await supabase.storage.from('lesson-videos').createSignedUrl(lesson.video_path, 3600);
Set video.src = data.signedUrl.

Test: sign in as a student enrolled in Course A only, then try to call createSignedUrl for a Course B video path — it must return null/error, not a valid URL.

Wire lesson progress tracking.

In track-progress/index.ts, accept {lesson_id, watched_seconds, completed: bool} from the authenticated user.
Upsert the progress row:
INSERT INTO progress (student_id, lesson_id, watched_seconds, completed_at)
VALUES ($student_id, $lesson_id, $watched_seconds, $completed_at)
ON CONFLICT (student_id, lesson_id) DO UPDATE
  SET watched_seconds = GREATEST(progress.watched_seconds, EXCLUDED.watched_seconds),
      completed_at = COALESCE(progress.completed_at, EXCLUDED.completed_at);

In LessonPlayer, fire track-progress every 30 seconds while the video plays, and once more on pause/end with the final watched_seconds. Pass completed=true when watched_seconds >= lesson.duration_seconds * 0.9.

In LessonSidebar, load the student's progress rows via supabase.from('progress').select() and show CheckCircle on completed lessons. Compute overall course completion percent and pass to ProgressBar.

Implement drip unlocking for lessons with drip_unlock_days > 0.

In LessonSidebar, for each lesson:
- If drip_unlock_days === 0, it's unlocked immediately
- Otherwise, compute unlock_at = enrollment.enrolled_at + drip_unlock_days days
- If unlock_at > now(), render the lesson row with a Lock icon and 'Unlocks in N days' subtitle (gray text)
- If unlock_at <= now(), render as accessible

In EnrollmentGuard (or a separate drip check inside CoursePlayer), before rendering the lesson player for a specific lesson_id:
- Fetch the lesson's drip_unlock_days and the student's enrollment.enrolled_at
- If still locked, show a centered card: 'This lesson unlocks on [date]. Come back then.' with a countdown

Do NOT render the video path or PDF path for locked lessons in any API response — confirm the lesson query only returns video_path if the drip window has passed.

Build the instructor analytics page at /instructor.

Create a Postgres view or RPC that returns per-course metrics for the authenticated instructor:
- enrollment_count: COUNT(*) from enrollments WHERE course_id = course.id AND status='active'
- revenue_cents: SUM(amount_paid_cents) from enrollments
- completion_rate: percent of enrolled students who completed all lessons
- per_lesson_dropout: for each lesson, count of students who completed it (for funnel view)

In InstructorDashboard.tsx, call this RPC and render:
- A summary row per course: title, enrollments, revenue (formatted as currency), completion rate (as %)
- Click a course row to expand a lesson-by-lesson funnel chart (shadcn/ui BarChart or Recharts BarChart)

Add a date-range filter (Last 7 days / 30 days / All time) that filters enrollment.enrolled_at.

All queries must gate on instructor_id = auth.uid() — an instructor must never see another instructor's metrics.

Wire email notifications via Resend.

Create a send-drip-email Edge Function. Configure RESEND_API_KEY in Cloud tab → Secrets.

Add a Postgres trigger on enrollments INSERT (status='active') that calls pg_net.http_post to send-drip-email with action='welcome' and the student's email + course title. The welcome email should include a direct link to /learn/${slug} and a one-line overview of the course.

For drip unlocks: update send-drip-email to also accept action='unlock' with lesson_id. Set up a pg_cron job that runs hourly, queries lessons with drip_unlock_days > 0, joins with enrollments WHERE enrolled_at + drip_unlock_days * interval '1 day' < now(), and sends a Resend email for each lesson newly unlocked for each student (use a sent_drip_emails table to track which (student_id, lesson_id) combos have already been notified).

Add a completion email: trigger on progress table when completed_at IS NOT NULL and it's the final lesson in the course — send a 'Congratulations, you completed {course title}!' email via Resend.

Migrate lesson video storage from Supabase Storage to Cloudflare R2 to eliminate egress fees.

Create a new R2 bucket in Cloudflare Dashboard. Add these secrets to Cloud tab → Secrets: R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET_NAME, R2_PUBLIC_DOMAIN (your R2 custom domain or public endpoint).

Create upload-video-to-r2 Edge Function using the S3-compatible API (Cloudflare R2 implements S3 protocol). Accept multipart form data with the video file, upload to R2 at key `${courseId}/${lessonId}/${filename}`, return the R2 key.

Update the lessons.video_path column to store R2 keys instead of Supabase Storage paths.

Update LessonPlayer: instead of supabase.storage.createSignedUrl, call a get-video-signed-url Edge Function that verifies enrollment via is_enrolled(), generates a 1-hour presigned R2 URL using AWS4 signature scheme, and returns it. Player loads via this signed URL.

Delete the lesson-videos Supabase Storage bucket policy once all videos are on R2.

Add quizzes to lessons for assessment-driven courses.

Create two new tables:
- quizzes: id, lesson_id, title, pass_threshold_percent (default 70)
- quiz_questions: id, quiz_id, question_text, question_type (check in 'mcq','true_false'), options jsonb (array of {text, is_correct}), position
- quiz_attempts: id, student_id, quiz_id, score_percent, passed bool, submitted_at, answers jsonb

RLS: students read/write own quiz_attempts; instructors read all attempts for own courses; quiz_questions are readable by enrolled students only (via is_enrolled()).

In CourseEditor, add a Quiz tab per lesson. InstructorRoleGate ensures only the course owner edits it.

In LessonPlayer, after the video completes (or if the lesson has no video), render a Quiz component if quiz exists. MCQ questions shown one at a time with radio buttons. On submit, compute score client-side, INSERT quiz_attempts row, show result (pass/fail) with correct answers highlighted.

If quiz passed and it was the last lesson, trigger the completion email.