TalentForge AI — Building a Production-Ready Authenticated AI App on Cloud Run

Submission for #AccelerateAIwithCloudRun — Beyond the Personal Gemini Journal starter

Live Demo (Cloud Run): https://talentforge-ai-xxxx-uc.a.run.app (or see Walkthrough Video below)
Repo: https://github.com/prabanjan127/talentforge-ai
Demo Video: https://youtu.be/XXXX / Blog: You are reading it — publish this to Medium/Dev.to/Hashnode and use that URL for submission
Firestore Rules: firestore.rules:3 — per-user isolation users/{uid}

---

1. What We Built

TalentForge AI is an authenticated AI Career Coach, not a generic journal. It helps users land jobs faster with 4 Gemini-powered modes, all secured per-user:

1. Resume Review (ATS) — Match score 0-100, missing keywords, 3-5 bullet rewrites
2. Cover Letter Generator — 250-word tailored letter from resume + JD
3. Gap Analysis — 30-60-90 day learning plan with courses/projects
4. Mock Interview Chat — Strict hiring manager, one question at a time, feedback after each answer

History persists in users/{uid}/applications (Firestore) and is deletable. All Gemini calls are server-side on Cloud Run.

Why beyond starter: Custom AI Studio system instructions per mode (backend/src/services/gemini.js:15), interview chat with history, hardened auth, single Cloud Run service serving Vite React + Express.

2. Architecture

[Vite React 19] -- Firebase Auth (Google SSO) --> [Express 5 on Cloud Run]
   |  Bearer ID Token                           | verifyIdToken (firebase-admin)
   |                                            |--> Gemini 3.6-flash (AI Studio)
   |                                            |--> Firestore users/{uid}/applications
   Dockerfile multi-stage: frontend build -> backend serves dist

• Frontend: frontend/ Vite + React Router + Firebase Client SDK + Tailwind 3. frontend/src/firebase.js:5 + frontend/src/contexts/AuthContext.jsx:12 (demo fallback demo-token for keyless preview)
• Backend: backend/ Express + firebase-admin/app:cert (backend/src/config/firebase.js:9) + @google/generative-ai. Serves frontend dist, health at /health (backend/src/index.js:19)
• Security: helmet, cors, authMiddleware (backend/src/middleware/auth.js:1), Firestore rules deny all except owner, Gemini key never exposed to client (Secret Manager / env var), morgan logging
• Stability: Input validation, try/catch on Gemini + Firestore (best-effort in demo), loading states, /api/health

3. Gemini via AI Studio — Custom Instructions

Designed in AI Studio, exported to backend/src/services/gemini.js:15:

• resumeReview: FAANG hiring manager + ATS, returns Score, Missing Keywords, Bullet Improvements, Verdict (markdown)
• coverLetter: Professional coach, 250-300 words, professional enthusiastic
• gapAnalysis: Career strategist, 30-60-90 plan with resources
• mockInterview: Strict supportive hiring manager, one Q at a time, feedback loop

Model: gemini-3.6-flash (tested via https://generativelanguage.googleapis.com/v1beta/models?key=... — gemini-1.5-flash deprecated, 2.5 no longer available to new users).

Edit: AI Studio → New Prompt → System Instructions → paste → Test → copy to SYSTEM_INSTRUCTIONS.

4. Walkthrough — Screenshots / Video Script

Record with Loom / OBS, 2-3 min:

0:00 — Show http://localhost:8080 or Cloud Run URL. Demo banner if DEMO_MODE=true (frontend/src/components/Navbar.jsx:8).
0:20 — Login: Click Sign in with Google (frontend/src/pages/Login.jsx:15), Firebase Auth popup, redirect to / (ProtectedRoute frontend/src/components/ProtectedRoute.jsx:1).
0:40 — Profile: Enter Target Role Software Engineer, paste resume + JD. Show prefilled example.
1:00 — Resume Review: Click Resume Review → Gemini thinking → markdown result with Score 78/100, missing keywords React 19, Cloud Run, bullet rewrites. Network tab shows POST /api/ai/resume-review with Authorization: Bearer <ID_TOKEN>.
1:20 — Cover Letter + Gap Analysis: Click each, show generated markdown, then History (Firestore) panel on right updates — proves per-user persistence users/{uid}/applications.
1:40 — Mock Interview: Click Mock Interview tab → send Hi I'm ready → Gemini asks Q1, answer, get feedback + Q2 — show chat history passed to backend/src/routes/ai.js:75 generate(..., history).
2:00 — Firestore Rules: Show firestore.rules + Firebase Console Firestore Data users/demo-user-123/applications — only owner sees it.
2:20 — Cloud Run: Show gcloud run deploy logs or Console → Cloud Run → Service talentforge-ai → URL → curl /health.

Screenshots to include in blog:

• Login page with Google SSO
• Dashboard with 3 textarea + 4 buttons + History panel
• Resume Review output markdown
• Mock interview chat
• Firestore console with users/{uid} path
• Cloud Run service URL + health JSON

5. Local Run

# Firebase setup: console.firebase.google.com → Auth (Google) → Firestore → Web app config
cp frontend/.env.example frontend/.env  # fill VITE_FIREBASE_*
cp backend/.env.example backend/.env    # fill GEMINI_API_KEY, FIREBASE_SERVICE_ACCOUNT, DEMO_MODE=false

cd frontend && npm install && npm run build
cd ../backend && npm install && npm start  # http://localhost:8080
# or dev: npm run dev in both

Test: curl http://localhost:8080/health → {"status":"ok"}

6. Deploy to Cloud Run

Console (no gcloud permission needed):

1. Enable APIs: console.cloud.google.com/apis/library/firestore.googleapis.com?project=target-13bf5 → Enable (same for run.googleapis.com, cloudbuild.googleapis.com, artifactregistry.googleapis.com)
2. Firestore → Create database → Production → us-central1
3. Cloud Run → Create Service → Continuously deploy from source → Connect github.com/prabanjan127/talentforge-ai → Dockerfile → Region us-central1 → Allow unauthenticated → Env vars GEMINI_MODEL=gemini-3.6-flash, FIREBASE_PROJECT_ID=target-13bf5 → Secrets GEMINI_API_KEY, FIREBASE_SERVICE_ACCOUNT (Secret Manager) → Deploy

CLI (after gcloud auth login as owner):

gcloud builds submit --tag gcr.io/target-13bf5/talentforge-ai
gcloud run deploy talentforge-ai --image gcr.io/target-13bf5/talentforge-ai --platform managed --region us-central1 --allow-unauthenticated --port 8080 --set-env-vars GEMINI_MODEL=gemini-3.6-flash,FIREBASE_PROJECT_ID=target-13bf5 --set-secrets GEMINI_API_KEY=gemini-key:latest,FIREBASE_SERVICE_ACCOUNT=firebase-sa:latest
curl https://talentforge-ai-xxxx.run.app/health
firebase deploy --only firestore:rules

7. Security & Evaluation

• Authenticity: 4 modes + chat beyond starter
• Usability: Google SSO, ProtectedRoute, error-free flows
• Stability: Server verifies ID token, handles Gemini 404/403, Firestore disabled fallback, health checks
• Security: firestore.rules per-user, API keys server-only, helmet, ID token auth

8. Submission Links

• Cloud Run Live URL: https://talentforge-ai-xxxx-uc.a.run.app (replace after deploy)
• Social Post: Publish this blog to Medium/Dev.to with #AccelerateAIwithCloudRun + video https://youtu.be/XXXX
• Repo: https://github.com/prabanjan127/talentforge-ai

---

Built by following Codelab “Build a User-Authenticated AI Application with Custom Instructions on Google AI Studio & Cloud Run” then extended with hardened security and unique career features.

AccelerateAIwithCloudRun #Firebase #CloudRun #Gemini #AIStudio