- Create secure server-side API endpoints for course data, marks, exercises, newsfeeds, submissions, and organization management
- Implement role-based permission checking using checkUserCoursePermissions utility
- Move all client-side Supabase calls to authenticated server endpoints in /api/courses/ and /api/org/
- Add proper authentication and authorization middleware via hooks.server.ts
- Update service functions to use getAccessToken() for API authentication
- Ensure data filtering based on user roles (students only see their own data)
- Maintain backward compatibility with existing component interfaces
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map
This ensures PostHog analytics work properly without CSP violations.
- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests
Resolves CSP errors preventing presigned URL requests and media playback.
- Add plan validation to custom domain saving (Domains.svelte)
- Add plan validation to certificate customization (Design.svelte)
- Add plan validation to document upload (AddDocumentToLesson.svelte)
- Add plan validation to video upload (UploadVideo.svelte)
- Enhance team member function validation (TeamMembers.svelte)
Prevents free users from bypassing UI restrictions via DOM manipulation.
All restricted functions now enforce server-side plan validation.
* feat: setup dashboard analytics api
* chore: requested pr fixes
* fix: dash analytics server side type
* refactor: update Avatar component usage across the dashboard
- Replaced custom Avatar component with the new @cio/ui/base/avatar implementation for consistency.
- Enhanced avatar rendering with fallback options and improved accessibility.
- Cleaned up unused Avatar component files and related functions.
- Updated various components to utilize the new Avatar structure, ensuring a uniform appearance and behavior across the application.
* chore: remove console.log statements from analytics routes and API calls
- Eliminated console.log statements for orgId and siteName in the dash analytics router and DashStatApi class to clean up the code and improve performance.
---------
Co-authored-by: Rotimi Best <best@classroomio.com>
* feat: new components, deploy storybook
* refactor: simplify component field definitions and enhance button loading state
- Removed unnecessary type imports and simplified the FIELDS array definitions across multiple components in Storybook.
- Updated button component to use a loading state instead of isLoading, improving clarity and consistency in props.
- Adjusted button stories to reflect the new loading prop and enhanced the button's loading visual feedback.
- Minor CSS adjustments for better layout and styling consistency.
* chore: add field, card, password components
* feat: improve page component & update AuthUI path
* chore: update bits-ui to version 2.14.4 and all org related UI's
- Updated bits-ui dependency in pnpm-lock.yaml and package.json to version 2.14.4.
- Refactored imports for RoleBasedSecurity and UpgradeBanner components to use the new ui feature directory.
- Removed unused Course components and related files to clean up the codebase.
- Enhanced various components to improve consistency and maintainability.
* chore: move all setting buttons to the top and update auth ui styles
* chore: remove svelte-loading-spinners and replace with @cio/ui/base/spinner
- Removed all instances of svelte-loading-spinners from the project.
- Updated components to use the new Spinner from @cio/ui/base/spinner.
- Cleaned up pnpm-lock.yaml and package.json to reflect the removal of svelte-loading-spinners.
- Added new CSS animations for rocket launch effects in app.css.
- Enhanced email change flow with updated verification messages in translations.
* chore: remove supabase file upload from dashboard and move to r2
* chore: update organization API and UI components
- Added new API methods for organization plan operations and team management.
- Introduced middleware for API key authentication and organization admin checks.
- Refactored organization-related components to utilize the new API structure.
- Updated various UI components to improve consistency and maintainability.
- Enhanced error handling and validation for organization-related actions.
- Removed deprecated services and streamlined the codebase.
* feat: Add .gitignore file and update package.json with pnpm version
feat: Enhance course queries with error handling and new course retrieval
feat: Implement exercise queries for creating and fetching exercises, questions, and options
feat: Create group queries for managing groups and group members
feat: Add lesson queries for creating lessons and fetching sections by course ID
feat: Update seed script to include seeding for users, profiles, accounts, organizations, groups, courses, lessons, exercises, questions, and options
* feat: Enhance course cloning functionality by refining course and lesson data handling
* chore: remove console.log
* feat: update role assignment in cloneCourse function and clean up unused types in database.ts
* feat: add README for @cio/db package and remove existingAccounts.json
* load session, load profile and organization, add create profile hook
* chore: cache session request
The trick was passing all the cookies to the backend. Previously I was only passing the better-auth.session_token and not better-auth.session_data. Read about the difference here https://www.better-auth.com/docs/concepts/cookies#custom-cookies
* feat: login, logout, onboarding, verify email, reset password.
* feat: complete change email and email verification
* feat: standardise how we make rpc calls and create org endpoints
* fix ui errors
* fix: handle potential undefined customerId and standardize avatar URL property
* refactor: standardize custom domain handling and update telegram chat ID references
* chore: add tailwind prefix to @cio/ui
this fixed the media query issues because @cio/ui classes were overriding this dashboard tailwind build
* chore: clean up org sidebar
* chore: persist mode state
* feat: implement order breadcrumbs
* chore: upgrade to better auth 1.4
* chore: address common auth flow bugs and setup app for others to setup locally.
This is because when you close the modal we redirect you to /org/siteName/courses but if you click close before we get your organization siteName the route is just /courses which redirects to a 404.
This point I have fixed 2 major issues
1. After signing in with Google auth, join a course and going to the course, when you click the back button in the page nav, it takes you to admin instead of lms
2. When you open a course landing page, click enroll, it redirects to 404 instead of the invite page.
This fix tackled a bug where if I logged out, go to org landing page, open a course and enrol then it gets redirected to a 404 page because `$currentOrg.siteName` is undefined.
The use case for this is that if a person went from course page to invite page, and isn't authenticated then the user should be redirected to login page with a redirect query param
Adeyemi Adetunji