Commit Graph
1404 Commits
Author SHA1 Message Date
Rotimi BestandAbdulmuizz Hamzat 9fb6c7cbaa feat: migrate course UI from supabase (#615)
* chore: fix storybook build

* chore: implement theming

* community list not showing properly

* refactor: migrate Chip component to @cio/ui/custom/chip

- Updated imports for the Chip component across multiple files to use the new location in the @cio/ui package.
- Replaced the previous Chip implementation with a new version that utilizes a Badge for better styling and functionality.
- Adjusted related components to ensure consistent usage of the updated Chip component.

* fix: align course sidebar design to match organization design (#611)

* fix: align course sidebar design to match organization design

* feat: add hideSearch prop to AppHeader and update sidebar layout

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

* refactor: replace PrimaryButton with Button component across multiple files

- Updated various components to use the new Button component from @cio/ui/base/button instead of the deprecated PrimaryButton.
- Ensured consistent button usage throughout the application for improved styling and functionality.
- Removed the PrimaryButton component and its associated constants from the codebase.

* refactor: standardize button and input usage across components

- Replaced instances of deprecated components such as TextField, TextArea, and IconButton with their updated counterparts (InputField, TextareaField, and updated IconButton).
- Ensured consistent event handling by changing `onClick` to `onclick` for better alignment with Svelte's event binding conventions.
- Removed unused components and streamlined imports to enhance code maintainability and readability.

* chore: themeing, course card, use $features

* refactor: centralize UI components and update modal implementations

- Refactored various components to centralize UI elements, improving discoverability and maintainability.
- Replaced deprecated modal components with the new Dialog component for consistent modal behavior across the application.
- Removed unused components and streamlined imports to enhance code clarity and reduce complexity.

* feat: add new documentation and refactor org and lms UI components

- Introduced new documentation files for Auth Flow, Breadcrumbs Refactoring, Page and Route Creation, and Route Page Setup to enhance developer onboarding and reference.
- Refactored various UI components, including the Course Sidebar and Lesson Modal, to improve layout and functionality.
- Removed deprecated components and streamlined imports for better maintainability.
- Updated translations across multiple languages to ensure consistency in user experience.

* refactor: update UI components and improve styling consistency

- Refactored various components to enhance styling consistency, including updates to button and text color classes.
- Removed deprecated components and streamlined imports for better maintainability.
- Replaced instances of PageBody with a more flexible Page component structure across multiple routes.
- Updated translations and UI elements to align with the new design system.
- Deleted unused components to reduce code complexity and improve clarity.

* update output.css

---------

Co-authored-by: Abdulmuizz Hamzat <103611443+canhamzacode@users.noreply.github.com>
2025-12-22 02:36:48 +01:00
Rotimi Best d0699e6196 feat: implement comprehensive migration guide for transitioning documentation to classroomio.com/docs, including updated configurations and Vercel rewrites 2025-12-21 23:38:08 +00:00
Rotimi Best 0abe803e09 feat: add migration guide for transitioning documentation to classroomio.com/docs with Vercel rewrites and updated configurations 2025-12-21 23:24:54 +00:00
Rotimi Best 63306c6537 chore: clean up nitro configuration in vite.config.ts by removing commented baseURL and proxy settings 2025-12-21 23:10:37 +00:00
Rotimi Best d109b6af23 chore: update vercel.json to ensure consistent trailing slashes in /docs routing 2025-12-21 22:58:04 +00:00
Rotimi Best 8e8ef26d49 chore: refine routing in vercel.json and set consistent base paths in vite.config.ts and router.tsx 2025-12-21 22:40:14 +00:00
Rotimi Best f4739a1b38 chore: update vercel.json for improved routing to documentation and add asset path rewrites 2025-12-21 21:53:24 +00:00
Rotimi Best 2591dad3de chore: update vercel.json for new /docs routing and set base path in vite.config.ts and router.tsx 2025-12-21 21:44:57 +00:00
Rotimi Best b4e975bcd3 chore: remove '/docs' base path references from vite.config.ts and router.tsx 2025-12-21 21:38:19 +00:00
Rotimi Best 006322b7ca chore: add vercel.json for routing rewrites to external documentation and update base paths in vite.config.ts and router 2025-12-21 21:32:56 +00:00
Rotimi Best d12085917f chore: remove '/docs' base path references and update asset paths in layout 2025-12-21 21:23:31 +00:00
Rotimi Best 2086e8dfd3 chore: reset vercel.json to an empty configuration 2025-12-21 21:03:45 +00:00
Rotimi Best ead4593ad9 chore: update vercel.json and vite.config.ts for improved routing to /docs 2025-12-21 20:55:10 +00:00
Rotimi Best d410179a1f chore: update nitro configuration in vite.config.ts to use object syntax for proxy settings 2025-12-21 20:47:13 +00:00
Rotimi Best 3b0ed16a59 chore: add vercel.json for routing rewrites to ClassroomIO 2025-12-21 19:38:05 +00:00
Rotimi Best bcb8a4b295 chore: update .npmrc to set npm registry and remove vercel.json configuration 2025-12-21 19:26:07 +00:00
Rotimi Best 477ace9e2c chore: update nitro configuration in vite.config.ts to include proxy settings for routing 2025-12-21 19:00:09 +00:00
Rotimi Best 2ae49fdb28 chore: undo /docs rewrite 2025-12-21 18:39:54 +00:00
Rotimi Best ab772ca811 chore: simplify tanstackStart configuration in vite.config.ts 2025-12-21 18:20:24 +00:00
Rotimi Best 7e0bf2a5fc chore: add .npmrc and .nvmrc files for package management configuration 2025-12-21 13:20:41 +00:00
Rotimi Best ddee333dd3 chore: remove docs-v2 2025-12-21 12:40:11 +00:00
Rotimi Best 64cee7f3cd chore: update lock file 2025-12-21 12:39:42 +00:00
Rotimi Best cc04fba42e chore: rename docs-v2 to docs 2025-12-21 12:37:06 +00:00
Adeyemi AdetunjiandRotimi Best 2526f4c227 feat: migrate docs from Nextra to Fumadocs (#606)
* feat: checkpoint

* feat: Migrate docs to Fumadocs

* chore: docs layout

* chore:
- remove home route
- make docs home route
- remove docs prefix

* chore: docs layout

* chore:
- reorder sidebar
- fix home page redirect

* chore: rename package to avoid error during pnpm clean

* chore: remove private and sideEffects properties from package.json

* chore: requested fixes

* feat: update fumadocs layout

* feat: hide theme switch on sidebar

* add /docs

* feat: enhance documentation and layout with new guides and updates

- Added multiple how-to guides for creating courses, exercises, and managing organization settings.
- Updated existing documentation for clarity and consistency, including renaming sections for better navigation.
- Introduced new assets such as logos and favicon for improved branding.
- Modified layout components to enhance user experience and visual appeal.
- Updated package dependencies to include lucide-react for icon usage.

* chore: update pnpm-lock.yaml with dependency version changes

* add favicon

* fix: update links in documentation for consistency

- Corrected the links in the create-exercise and signup guides to ensure they point to the correct paths, enhancing clarity and navigation for users.

* delete docs

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-21 13:36:04 +01:00
Adeyemi AdetunjiandRotimi Best e6a3cf9332 feat: website release v2 (#616)
* feat: upgrade to svelte 5 & tailwind v4 + add navigation menu to ui package

* feat: website navigation with nav menu from shadcn

* chore: refactor navigation menu storybook

* fix: responsiveness bug

* chore: remove tailwind config file

* chore:
- remove carbon icons from repo
- add Geist font family

* refactor website

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-20 12:44:59 +01:00
Rotimi Best 690cf147ff Merge branch 'feat/release-v2' of https://github.com/classroomio/classroomio into feat/release-v2 2025-12-12 09:36:21 +01:00
Rotimi Best 907a41cef1 chore: move stars fetch to server 2025-12-12 09:35:59 +01:00
Abdulmuizz Hamzat c45f3443f8 refactor: remove Supabase dependency and related user validation logic (#610) 2025-12-07 15:41:42 +01:00
Rotimi Best 4b52906445 feat: enhance API route naming conventions and structure
- Added comprehensive guidelines for API route naming and structure in `ROUTE_NAMING_BEST_PRACTICES.md`.
- Updated `ARCHITECHTURE.md` to reference the new best practices document.
- Refactored course-related routes to follow new naming conventions, including changes to endpoint paths and validation schemas.
- Removed the deprecated course clone route and integrated cloning functionality directly into the course routes.
- Adjusted various API methods to ensure consistent usage of HTTP methods and parameter structures across the application.
2025-12-05 17:24:16 +01:00
Adeyemi Adetunji eff364baa4 feat: add Underline Tab component (#608)
* feat: add Underline Tab component

* chore: pr fixes

* chore: add .js extensions
2025-12-05 17:20:55 +01:00
Adeyemi Adetunji c1920e0c02 chore: removed unused folder from repo (#609) 2025-12-05 15:44:37 +01:00
Rotimi Best ac1a05f006 feat: move course analytics request to api 2025-12-05 11:20:12 +01:00
Rotimi Best 97d9e490b0 fix: update API endpoints and course marks page 2025-12-05 11:11:37 +01:00
Rotimi Best ac4fdf1dd3 feat: migrate client-side database calls to secure server-side API endpoints
- Create secure server-side API endpoints for course data, marks, exercises, newsfeeds, submissions, and organization management
- Implement role-based permission checking using checkUserCoursePermissions utility
- Move all client-side Supabase calls to authenticated server endpoints in /api/courses/ and /api/org/
- Add proper authentication and authorization middleware via hooks.server.ts
- Update service functions to use getAccessToken() for API authentication
- Ensure data filtering based on user roles (students only see their own data)
- Maintain backward compatibility with existing component interfaces
2025-12-05 10:48:01 +01:00
Rotimi Best bf614fd782 fix: update profile visibility policies to restrict access to user profiles 2025-12-05 06:07:39 +01:00
Rotimi Best 35b9afdde5 chore: remove public profile visibility policy for enhanced privacy 2025-12-05 05:54:42 +01:00
Adeyemi AdetunjiandRotimi Best ce216b1ade feat: Add Image Cropper to ui & storybook (#607)
* feat: add image cropper

* installation

* chore: add max width for dialogue container

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-04 01:51:58 +01:00
Rotimi Best ea93075bd5 fix: update content security policy to allow YouTube and refine source origins 2025-12-04 00:10:15 +01:00
Rotimi Best 964c036252 fix: enhance email verification protection by ensuring DOM manipulation only occurs in the browser 2025-12-04 00:00:48 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best 43e6cd611d chore: auto logout test emails. 2025-12-03 13:48:25 +01:00
Rotimi Best 900f5ec129 fix: critical SVG XSS vulnerability in file uploads
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads

Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components

Fixes reported vulnerability in profile image upload functionality.
2025-12-03 11:25:00 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Rotimi Best 4ac242d918 fix: add PostHog domains to CSP connect-src
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map

This ensures PostHog analytics work properly without CSP violations.
2025-12-03 10:28:02 +01:00
Rotimi Best 9fe7691f8d fix: CSP configuration for API and media access
- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.
2025-12-03 10:10:08 +01:00
Rotimi Best 07ecfcf967 fix: authorization bypass vulnerabilities in plan-restricted features
- Add plan validation to custom domain saving (Domains.svelte)
- Add plan validation to certificate customization (Design.svelte)
- Add plan validation to document upload (AddDocumentToLesson.svelte)
- Add plan validation to video upload (UploadVideo.svelte)
- Enhance team member function validation (TeamMembers.svelte)

Prevents free users from bypassing UI restrictions via DOM manipulation.
All restricted functions now enforce server-side plan validation.
2025-12-03 10:01:50 +01:00
Rotimi Best 7014757ed5 fix: add PostHog and Umami analytics to CSP
- Added https://eu-assets.i.posthog.com for PostHog scripts
- Added https://eu.i.posthog.com for PostHog API calls
- Added https://umami.hz.oncws.com for Umami analytics
- Maintains XSS protection while enabling analytics
2025-12-03 09:44:31 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Rotimi Best f2b719cd1b chore: more email validation 2025-12-03 07:31:35 +01:00
Adeyemi AdetunjiandRotimi Best 9a5aee1ee0 feat: setup dashboard analytics api (#604)
* feat: setup dashboard analytics api

* chore: requested pr fixes

* fix: dash analytics server side type

* refactor: update Avatar component usage across the dashboard

- Replaced custom Avatar component with the new @cio/ui/base/avatar implementation for consistency.
- Enhanced avatar rendering with fallback options and improved accessibility.
- Cleaned up unused Avatar component files and related functions.
- Updated various components to utilize the new Avatar structure, ensuring a uniform appearance and behavior across the application.

* chore: remove console.log statements from analytics routes and API calls

- Eliminated console.log statements for orgId and siteName in the dash analytics router and DashStatApi class to clean up the code and improve performance.

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-02 15:27:41 +01:00