Commit Graph
58 Commits
Author SHA1 Message Date
Rotimi Best bf614fd782 fix: update profile visibility policies to restrict access to user profiles 2025-12-05 06:07:39 +01:00
Rotimi Best 35b9afdde5 chore: remove public profile visibility policy for enhanced privacy 2025-12-05 05:54:42 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Adeyemi AdetunjiandRotimi Best 3692046077 feat: add danish support to dashboard (#580)
* feat: Add Danish Support

* feat: add migration file

* chore: update migrations

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-10-13 18:07:46 +01:00
Rotimi Best bcd17dd0df feat: add unique constraint to lesson_completion table 2025-09-18 09:16:46 +01:00
Nwosu EmmanuelandRotimi Best ec3875bac2 feat: course analytics (#574)
* feat: added anaytics for the course page

* feat: Added pagination

* feat: cleanup

* feat: added translations

* feat: added fixes

* my improvements

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-09-18 01:00:49 +01:00
Nwosu EmmanuelandRotimi Best 937f1d8155 feat: add documents to Lesson materials (#572)
* feat: Initial logic for the pdf upload

* feat: uploa logic, translations and ui flow complete

* chore:console log cleanup

* feat: fixed upload issue and added cancel upload button

* feat: fixing the download document ish

* feat: All done and ready for use

* feat: updated the document viewing logic

* feat: some minor refactor

* feat: added migration file

* fix: dark mode, translations, restyling,

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2025-09-10 11:39:06 +01:00
Rotimi Best 279d10a914 feat: add Polish language support 2025-08-08 04:53:38 +01:00
Rotimi Best 0d0719e8f9 feat: implement row-level security policies for course-related tables and actions 2025-08-08 04:12:46 +01:00
Rotimi Best be0d05abc6 fix: remove pgsodium extension creation from migration and clean up data.sql 2025-07-20 20:21:23 +01:00
Rotimi Best 50e89f90c9 Revert "db: squash migrations"
This reverts commit d010531ef7.
2025-04-21 01:01:23 +01:00
Rotimi Best d010531ef7 db: squash migrations 2025-04-19 23:21:43 +01:00
Rotimi Best 9ede3319b5 fix: migration syntax error 2025-01-06 04:03:19 +01:00
Rotimi Best 37f46b68c7 fix: make subscription_id not required 2025-01-06 04:00:19 +01:00
Rotimi Best de1398b3a2 feat: migrate from lemonsqueezy to polar (#535)
* feat: move from lemonsqueezy to polar

* update lock

* add migration files

* test with demo product id
2025-01-06 03:36:00 +01:00
Rotimi Best 5f367a9540 chore: sort top courses by completion and spacing fixes #531 2024-12-31 17:47:07 +01:00
Rotimi Best c68bfb62b5 feat: organisation home page with analytics (#532) 2024-12-31 17:04:07 +01:00
Rotimi Best ae55349f27 chore: use session to update lastSeen and UI tweaks 2024-12-30 12:25:43 +01:00
Adeyemi AdetunjiandRotimi Best f69bf920a9 feat: org and course student analytics page (#509)
* UI initialization

* feat: structure API

* feat: audience & people analytics

* feat: quick changes

* feat: add comments

* redesign course student page

* chore: make requests to db more efficient

* clean up analytics page for course

* feat: finish up audience analytics page

* chore: minor UI tweaks

* translate all

* replace inserts of log in events to update

* catch error if last_login isn't inserted

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-12-30 02:59:10 +01:00
Rotimi Best 0a1e3dc368 fix: failing migration #513 2024-12-23 02:58:23 +01:00
Rotimi Best b3ca8b00a6 chore: disable mark as complete if all exercises are not complete #513 2024-12-23 02:31:53 +01:00
Rotimi Best d1a089a369 chore: update supabase custom domain 2024-10-13 16:44:40 +01:00
Rotimi Best bd76342f0e chore: add new env DEPLOYMENT_PROVIDER 2024-09-27 02:50:27 +01:00
Rotimi Best 8a7a9f8370 fix: rls not allowing invite member 2024-09-17 14:48:33 +01:00
Rotimi Best 6bfae6ff13 feat: supabase custom domain 2024-09-16 09:50:28 +01:00
Rotimi Best bb3eb4ceb2 fix: format course card and missing migration 2024-09-12 08:14:28 +01:00
Rotimi Best 8ab51095a7 fix: course and org landing page improvements (#468)
* make gift section HTML rendered

* hide classroomio branding on landing page

* improve section expanding

* feat: toggle show sections on course landing page

* fix: show discount on landing page course card
2024-09-09 01:14:55 +01:00
Rotimi Best 12d7a1ac3c feat: support custom domain (#462)
* feat: add custom domain CRUD

* chore: fetch organization in layout in server before render

* debugging

* update log
2024-09-04 06:32:54 +01:00
Rotimi Best a00bb133af chore: restrict accounts 2024-08-24 20:44:16 +01:00
Rotimi Best 9e10259630 fix: allow admin edit organization 2024-08-19 20:00:57 +01:00
Rotimi Best 1c9dc004a0 feat: course section reordering & migration to course v2 (#437)
* feat: reorder sections and lessons gracefully

* convert course into version 2

* feat: get next and prev working
2024-08-17 17:10:15 +01:00
Rotimi Best ad421acf8d feat: lesson sections - v1 (#431)
* add todo

* update sidebar with sections

* add course versioning

* fix db reset issue

* v1 of working sections feature

* remove
2024-08-14 10:27:37 +01:00
Rotimi Best afeb80fb9e fix: student can't submit exercise 2024-07-29 14:22:46 +01:00
Rotimi Best fa4c1f55be fix: adding team member issue 2024-07-29 11:25:41 +01:00
Adeyemi AdetunjiandRotimi Best 72b58ed2c7 feat: add 4 certificate templates (#295)
* add cloud translation api package

* feat: Script that auto generates translations for other languages

* add comments

* fix: broken translation

* improve translation

* update locck file

* clean up

* all round trasnlations check

* checkpoint

* finish up

* move to dev dependencies

* fix vercel build error

* translations fix

* - add documentation
- translation bug fix

* quick adjust

* PR Fixes

* add new line

* update docs

* checkpoint

* feat: redesign & addition of certificates

* text color update

* patterned width fix

* "student-name" class remove

* checkpoint

* PR Fix

* quick fix

* PR Fixes

* update certificate ready page for students

* PR Fixes

* quick cleanup

* move fetchCourses into .ts file

* feat: give students access to certificates only after completing course

* checkpoint

* height fix

* Merge branch 'main' of https://github.com/rotimi-best/classroomio into classroomio-issue-272

* Fix; merge PR Fix

* fix: width of plain & professional certs

* PR Fix

* feat: add translation

* handle error when trying to download a certificate

* add fetchExploreCourses

* fix: requested reviews

* review fixes checkpoint

* replace the certificate background

* height fix for patterned certififcates

* fix more bugs

* rename schema

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-07-21 03:02:33 +01:00
Rotimi Best 0e72e792e4 fix: #404 autosave issue on lesson 2024-07-20 11:12:11 +01:00
Rotimi Best 4ab00923f1 fix: auth issue due to org insert rls policy 2024-07-18 21:06:26 +01:00
Rotimi Best df7a5818bb feat: RLS on all tables (#399)
* implement RLS

* set default course currency to USD

* remove unused import

* update default currency in course in db
2024-07-18 02:58:57 +01:00
Em_DevandRotimi Best 98575e4dd9 feat: show all courses available to students (#356)
* working on the fetch explore course

* working on the showing the right course

* finished the explore courses page

* finished the explore courses page

* updated the getcourseurl

* updated the migration file

* text and spacing improvements

* update translations

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-07-09 21:17:34 +01:00
Rotimi BestandIniubong Obonguko 931ccb1a09 feat: lesson note version history (#374)
* chore: install diff package

* chore: add id to render component

* feat: implement language lesson version history

* chore: fix darkmode colors and use tailwind css

* chore: add screensize conditional

* refactor: list updating after data fetch

* change mode to view to prevent duplicate data being saved

* chore: remove raw text

* chore: db migration

* feat: properly format timestamp

* feat: add snackbar for success

* chore: group by minutes, use icons instead of texts for buttons

* docs: generate translations

* refactor

---------

Co-authored-by: Iniubong Obonguko <iniubongobonguko2018@gmail.com>
2024-06-30 04:47:15 +01:00
Em_DevandRotimi Best decea8d1e5 feat: improve self paced lesson card (#344)
* finished the self paced card

* made the reorder for both course type

* added translations

* chore: refactor to positive naming and not negative

* ux improvements

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-06-29 06:27:29 +01:00
Rotimi Best 2224661b76 feat: migration file for versioning 2024-06-10 15:52:14 +01:00
Rotimi Best 6fafa2fc80 fix: enable lesson cascade delete (#335) 2024-05-28 06:15:23 +01:00
Rotimi Best 5efc1e1bda fix: isadmin update causes duplicate fetch for courses 2024-05-24 20:30:45 +01:00
Em_DevandRotimi Best 49d8539be9 feat: course types - self paced and live class (#309)
* working on the course type

* trying to mark it persist

* almost done here

* fixed sendig emtpy options bug

* created migration file

* created migration file

* made updates based on PR review

* merge

* update course type card

* add redirect logic with classroomio.com/new

* make new course modal only open/close with url

* feat: page active state (#315)

* finished the active link state

* updated the active link state based on review

* simplify code

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

* add type to course card

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-05-21 00:14:47 +01:00
Em_DevandRotimi Best 73eb0ad4b1 feat: customize the LMS from dashboard (#304)
* Done with the customization of the LMS task

* generated custom_lms migration file

* updated the migration file

* copy improvements

* update wording

* made updates based on reviews,i hope i didnt miss anything

* updated the translations and migration files

* refactoring

* disabled improvements for apps

* more improvements

* more custom improvements

* pr refactoring

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-05-17 01:28:59 +01:00
Em_DevandRotimi Best e243564113 feat: grade exercise with AI (#296)
* working on the UI of the grading

* working on the grading function of the radio and checkboxes

* ai grading fully implemented with dummy functions for generating scores

* working on the openai response

* working on the openai response

* finished with the ai_grading

* finished with the ai_grading

* creating new migration file

* working on reviews

* updated the translations

* improvements

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-05-13 19:35:06 +01:00
Adeyemi AdetunjiandRotimi Best d75e2f258e feat: multi language support (#254)
* feat: multitranslational support

* - completion of settings page
- completion of sidebar

* sidebar rerendering bug fix

* completion of the lesson navigation & materials page

* completion of the course navigation

* completion of requested languages

* - Implementation of Language Picker
- Rename Bug Fixes

* checkpoint save

* - addition of the language picker to the onboarding.
- addition of the language switcher for the lesson notes.

* merge completion

* initialization of the new branch

* add transition.svelte file

* lesson note bug fix

* feat: add translation migration

* completion of translation

* fix height issue of dropdown

* refactoring

* fix: improve code with LOCALE from db

* finally get it fully functional

* connect with AI

* backward compatibility for lesson note

* preserve old content, when generating AI content

* undo translations in upgrade modal

* fix duplicate key issue from codacy trigger

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-04-19 05:45:48 +01:00
Rotimi Bestandemmanuel fcd0bcc656 feat: dashboard billing (#193)
* feat: move plans into sharable json

* remove unused code

* update pnpm lock

* update plans.json

* implement early adopter pricing

* docs: update meta title and description

* Finished the UI for upgrading plans

* Updated the pricing plans

* Updated the cards ui

* use relative import

* improve styling of upgrade plan card

* styling improvements, lemonsqueezy setup

* trigger lemonsqueezy payment and add webhook

* update pnpm lock

* add logout route

* feat: complete billing functionality

* generate lock file

* make crypto false on browser

* feat: adding upgrade prompts to org

* chore: add upgrade icon to upload video

* feat: add upgrade prompt to certificate and settings

* feat: implement onboarding setup page (#229)

* working on the onboarding setup

* working on the onboarding page

* Almost done with the onboarding UI

* finished the UI of the onBoarding setup

* finished the UI of the onBoarding setup

* Implementing the functions to carryout the logic of updating the UI onmount if a user has carried out a certain step or not

* Implementing the functions to carryout the logic of updating the UI onmount if a user has carried out a certain step or not

* making some chnages

* finished the onBoarding task

* updated some logic

* Removed the uneeded svg from the static folder

* fixed isCoursePublished not returning a boolean

* improved the setup link protection

* chore: make menuItems reactive

* improve formatting

* format supabase queries

---------

Co-authored-by: Rotimi Best <best@classroomio.com>

* revamp setup

* improve the upgrade experience

* migration

* feat: add lemonsqueezy customer portal

---------

Co-authored-by: emmanuel <chifez1@gmail.com>
2024-04-07 06:08:34 +01:00
Em_DevandRotimi Best bd905b580a feat: verify users email (#215)
* worked on the email verification

* worked on the email verification

* fixed the emailing issue and the supabase updating issue

* chore: add timer to resend, add supabase.server, enforce unique email

* chore: remove nodemailer logger

* remove async

* remove disposable email verification

---------

Co-authored-by: Rotimi Best <best@classroomio.com>
2024-03-22 06:30:24 +01:00