Commit Graph
1360 Commits
Author SHA1 Message Date
Rotimi Best b31ccf3037 feat: lint codebase and run precommit hook 2025-12-25 09:01:51 +00:00
Rotimi Best 334c67f22a migrate web to svelte 5 2025-12-25 05:37:21 +00:00
Adeyemi AdetunjiandRotimi Best 50d6ee3111 feat: mock exercise template api (#613)
* feat: move mock exercise template to api

* feat: add template migration file

* chore:
- remove exercise templates form api
- rework api to pull exercise templates from db
- add exercise template seed to seed file
- declutter seed file

* chore:
- refactor template fetch to be dependent on the selected tag
- add tag to schema, remote db and template's seed file
- clear remote db's template table and replace data and their respective tags

* chore: add number of questions and center loading screen on the frontend

* chore: pr fixes

* chore: type fixes

* chore:
- move seed functionality to /seed folder
- add typing for individual seed functions
- pr fixes

* chore: pr fixes v2

* update output css

* refactor: update seeding script and schema definitions

- Renamed `seedTypes` to `seedQuestionTypes` for clarity in the seeding process.
- Enhanced the seeding script to include a command-line interface for better usability, allowing specific seed functions to be executed based on flags.
- Removed redundant unique constraints in the schema definitions for `courseNewsfeedComment` and `exerciseTemplate` to streamline database structure.

* feat: add email verification error handling page and update session management

- Introduced a new page for handling email verification errors, providing user-friendly messages based on error types.
- Updated session management logic to improve handling of public routes and session states.
- Enhanced security policies in the Svelte configuration to include additional sources for styles and scripts.
- Removed the old email verification error page to streamline the codebase.

* move the exercise template to cloudflare cdn

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-25 05:09:27 +01:00
Rotimi Best ac3f35a97f Merge branch 'main' of https://github.com/classroomio/classroomio into feat/release-v2 2025-12-24 04:18:39 +00:00
Abdulmuizz HamzatandRotimi Best fdadc7bccf feat: include image cropper (#617)
* fix: include image cropper

* clean styles

* ui improvements

* bug bot feedbacks

* fix: update image upload format to PNG for consistency with cropping output

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-23 11:25:38 +01:00
Adeyemi AdetunjiandRotimi Best bc9e3b41ae feat: move community supabase request to api layer (#612)
* feat: move community supabase request to api layer

* chore: pr review checkpoint

* chore: PR fixes

* feat: implement role-based authorization middleware and align the community features with the developer guide.

- Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`.
- Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content.
- Updated community routes to utilize the new middleware for enhanced security and access control.
- Refactored community services to streamline upvote functionality and improve error handling.
- Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions.
- Updated documentation to reflect new middleware usage and best practices for authorization in the API layer.

* feat: enhance course and organization routes with middleware for improved access control

- Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks.
- Updated lesson route to include `courseMemberMiddleware` for PDF downloads.
- Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data.
- Refactored lesson and organization routes for consistency and clarity in middleware usage.

* chore: streamline dashboard and API development scripts in package.json

- Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use.
- Removed redundant full command variants to simplify the script section.

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-22 19:57:27 +01:00
Rotimi BestandAbdulmuizz Hamzat 9fb6c7cbaa feat: migrate course UI from supabase (#615)
* chore: fix storybook build

* chore: implement theming

* community list not showing properly

* refactor: migrate Chip component to @cio/ui/custom/chip

- Updated imports for the Chip component across multiple files to use the new location in the @cio/ui package.
- Replaced the previous Chip implementation with a new version that utilizes a Badge for better styling and functionality.
- Adjusted related components to ensure consistent usage of the updated Chip component.

* fix: align course sidebar design to match organization design (#611)

* fix: align course sidebar design to match organization design

* feat: add hideSearch prop to AppHeader and update sidebar layout

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

* refactor: replace PrimaryButton with Button component across multiple files

- Updated various components to use the new Button component from @cio/ui/base/button instead of the deprecated PrimaryButton.
- Ensured consistent button usage throughout the application for improved styling and functionality.
- Removed the PrimaryButton component and its associated constants from the codebase.

* refactor: standardize button and input usage across components

- Replaced instances of deprecated components such as TextField, TextArea, and IconButton with their updated counterparts (InputField, TextareaField, and updated IconButton).
- Ensured consistent event handling by changing `onClick` to `onclick` for better alignment with Svelte's event binding conventions.
- Removed unused components and streamlined imports to enhance code maintainability and readability.

* chore: themeing, course card, use $features

* refactor: centralize UI components and update modal implementations

- Refactored various components to centralize UI elements, improving discoverability and maintainability.
- Replaced deprecated modal components with the new Dialog component for consistent modal behavior across the application.
- Removed unused components and streamlined imports to enhance code clarity and reduce complexity.

* feat: add new documentation and refactor org and lms UI components

- Introduced new documentation files for Auth Flow, Breadcrumbs Refactoring, Page and Route Creation, and Route Page Setup to enhance developer onboarding and reference.
- Refactored various UI components, including the Course Sidebar and Lesson Modal, to improve layout and functionality.
- Removed deprecated components and streamlined imports for better maintainability.
- Updated translations across multiple languages to ensure consistency in user experience.

* refactor: update UI components and improve styling consistency

- Refactored various components to enhance styling consistency, including updates to button and text color classes.
- Removed deprecated components and streamlined imports for better maintainability.
- Replaced instances of PageBody with a more flexible Page component structure across multiple routes.
- Updated translations and UI elements to align with the new design system.
- Deleted unused components to reduce code complexity and improve clarity.

* update output.css

---------

Co-authored-by: Abdulmuizz Hamzat <103611443+canhamzacode@users.noreply.github.com>
2025-12-22 02:36:48 +01:00
Rotimi Best d0699e6196 feat: implement comprehensive migration guide for transitioning documentation to classroomio.com/docs, including updated configurations and Vercel rewrites 2025-12-21 23:38:08 +00:00
Rotimi Best 0abe803e09 feat: add migration guide for transitioning documentation to classroomio.com/docs with Vercel rewrites and updated configurations 2025-12-21 23:24:54 +00:00
Rotimi Best 63306c6537 chore: clean up nitro configuration in vite.config.ts by removing commented baseURL and proxy settings 2025-12-21 23:10:37 +00:00
Rotimi Best d109b6af23 chore: update vercel.json to ensure consistent trailing slashes in /docs routing 2025-12-21 22:58:04 +00:00
Rotimi Best 8e8ef26d49 chore: refine routing in vercel.json and set consistent base paths in vite.config.ts and router.tsx 2025-12-21 22:40:14 +00:00
Rotimi Best f4739a1b38 chore: update vercel.json for improved routing to documentation and add asset path rewrites 2025-12-21 21:53:24 +00:00
Rotimi Best 2591dad3de chore: update vercel.json for new /docs routing and set base path in vite.config.ts and router.tsx 2025-12-21 21:44:57 +00:00
Rotimi Best b4e975bcd3 chore: remove '/docs' base path references from vite.config.ts and router.tsx 2025-12-21 21:38:19 +00:00
Rotimi Best 006322b7ca chore: add vercel.json for routing rewrites to external documentation and update base paths in vite.config.ts and router 2025-12-21 21:32:56 +00:00
Rotimi Best d12085917f chore: remove '/docs' base path references and update asset paths in layout 2025-12-21 21:23:31 +00:00
Rotimi Best 2086e8dfd3 chore: reset vercel.json to an empty configuration 2025-12-21 21:03:45 +00:00
Rotimi Best ead4593ad9 chore: update vercel.json and vite.config.ts for improved routing to /docs 2025-12-21 20:55:10 +00:00
Rotimi Best d410179a1f chore: update nitro configuration in vite.config.ts to use object syntax for proxy settings 2025-12-21 20:47:13 +00:00
Rotimi Best 3b0ed16a59 chore: add vercel.json for routing rewrites to ClassroomIO 2025-12-21 19:38:05 +00:00
Rotimi Best bcb8a4b295 chore: update .npmrc to set npm registry and remove vercel.json configuration 2025-12-21 19:26:07 +00:00
Rotimi Best 477ace9e2c chore: update nitro configuration in vite.config.ts to include proxy settings for routing 2025-12-21 19:00:09 +00:00
Rotimi Best 2ae49fdb28 chore: undo /docs rewrite 2025-12-21 18:39:54 +00:00
Rotimi Best ab772ca811 chore: simplify tanstackStart configuration in vite.config.ts 2025-12-21 18:20:24 +00:00
Rotimi Best 7e0bf2a5fc chore: add .npmrc and .nvmrc files for package management configuration 2025-12-21 13:20:41 +00:00
Rotimi Best ddee333dd3 chore: remove docs-v2 2025-12-21 12:40:11 +00:00
Rotimi Best 64cee7f3cd chore: update lock file 2025-12-21 12:39:42 +00:00
Rotimi Best cc04fba42e chore: rename docs-v2 to docs 2025-12-21 12:37:06 +00:00
Adeyemi AdetunjiandRotimi Best 2526f4c227 feat: migrate docs from Nextra to Fumadocs (#606)
* feat: checkpoint

* feat: Migrate docs to Fumadocs

* chore: docs layout

* chore:
- remove home route
- make docs home route
- remove docs prefix

* chore: docs layout

* chore:
- reorder sidebar
- fix home page redirect

* chore: rename package to avoid error during pnpm clean

* chore: remove private and sideEffects properties from package.json

* chore: requested fixes

* feat: update fumadocs layout

* feat: hide theme switch on sidebar

* add /docs

* feat: enhance documentation and layout with new guides and updates

- Added multiple how-to guides for creating courses, exercises, and managing organization settings.
- Updated existing documentation for clarity and consistency, including renaming sections for better navigation.
- Introduced new assets such as logos and favicon for improved branding.
- Modified layout components to enhance user experience and visual appeal.
- Updated package dependencies to include lucide-react for icon usage.

* chore: update pnpm-lock.yaml with dependency version changes

* add favicon

* fix: update links in documentation for consistency

- Corrected the links in the create-exercise and signup guides to ensure they point to the correct paths, enhancing clarity and navigation for users.

* delete docs

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-21 13:36:04 +01:00
Adeyemi AdetunjiandRotimi Best e6a3cf9332 feat: website release v2 (#616)
* feat: upgrade to svelte 5 & tailwind v4 + add navigation menu to ui package

* feat: website navigation with nav menu from shadcn

* chore: refactor navigation menu storybook

* fix: responsiveness bug

* chore: remove tailwind config file

* chore:
- remove carbon icons from repo
- add Geist font family

* refactor website

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-20 12:44:59 +01:00
Rotimi Best 690cf147ff Merge branch 'feat/release-v2' of https://github.com/classroomio/classroomio into feat/release-v2 2025-12-12 09:36:21 +01:00
Rotimi Best 907a41cef1 chore: move stars fetch to server 2025-12-12 09:35:59 +01:00
Abdulmuizz Hamzat c45f3443f8 refactor: remove Supabase dependency and related user validation logic (#610) 2025-12-07 15:41:42 +01:00
Rotimi Best 4b52906445 feat: enhance API route naming conventions and structure
- Added comprehensive guidelines for API route naming and structure in `ROUTE_NAMING_BEST_PRACTICES.md`.
- Updated `ARCHITECHTURE.md` to reference the new best practices document.
- Refactored course-related routes to follow new naming conventions, including changes to endpoint paths and validation schemas.
- Removed the deprecated course clone route and integrated cloning functionality directly into the course routes.
- Adjusted various API methods to ensure consistent usage of HTTP methods and parameter structures across the application.
2025-12-05 17:24:16 +01:00
Adeyemi Adetunji eff364baa4 feat: add Underline Tab component (#608)
* feat: add Underline Tab component

* chore: pr fixes

* chore: add .js extensions
2025-12-05 17:20:55 +01:00
Adeyemi Adetunji c1920e0c02 chore: removed unused folder from repo (#609) 2025-12-05 15:44:37 +01:00
Rotimi Best ac1a05f006 feat: move course analytics request to api 2025-12-05 11:20:12 +01:00
Rotimi Best 97d9e490b0 fix: update API endpoints and course marks page 2025-12-05 11:11:37 +01:00
Rotimi Best ac4fdf1dd3 feat: migrate client-side database calls to secure server-side API endpoints
- Create secure server-side API endpoints for course data, marks, exercises, newsfeeds, submissions, and organization management
- Implement role-based permission checking using checkUserCoursePermissions utility
- Move all client-side Supabase calls to authenticated server endpoints in /api/courses/ and /api/org/
- Add proper authentication and authorization middleware via hooks.server.ts
- Update service functions to use getAccessToken() for API authentication
- Ensure data filtering based on user roles (students only see their own data)
- Maintain backward compatibility with existing component interfaces
2025-12-05 10:48:01 +01:00
Rotimi Best bf614fd782 fix: update profile visibility policies to restrict access to user profiles 2025-12-05 06:07:39 +01:00
Rotimi Best 35b9afdde5 chore: remove public profile visibility policy for enhanced privacy 2025-12-05 05:54:42 +01:00
Adeyemi AdetunjiandRotimi Best ce216b1ade feat: Add Image Cropper to ui & storybook (#607)
* feat: add image cropper

* installation

* chore: add max width for dialogue container

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-12-04 01:51:58 +01:00
Rotimi Best ea93075bd5 fix: update content security policy to allow YouTube and refine source origins 2025-12-04 00:10:15 +01:00
Rotimi Best 964c036252 fix: enhance email verification protection by ensuring DOM manipulation only occurs in the browser 2025-12-04 00:00:48 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best 43e6cd611d chore: auto logout test emails. 2025-12-03 13:48:25 +01:00
Rotimi Best 900f5ec129 fix: critical SVG XSS vulnerability in file uploads
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads

Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components

Fixes reported vulnerability in profile image upload functionality.
2025-12-03 11:25:00 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Rotimi Best 4ac242d918 fix: add PostHog domains to CSP connect-src
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map

This ensures PostHog analytics work properly without CSP violations.
2025-12-03 10:28:02 +01:00