* fix(auth): sync profile email verification with auth user
Repair stale profile rows where user.email_verified is true but
profile.is_email_verified is false, which blocked the LMS with the
verify-email modal while send-verification-email returned
EMAIL_IS_ALREADY_VERIFIED.
Sync on session login, account fetch, and user update; update the
modal to respect session emailVerified and self-heal on that error.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* chore(db): add backfill script for stale profile email verification
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* docs(db): document profile email verification backfill command
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(auth): never demote profile email verification on sync
Greptile: self-hosted first signup can verify profile before
user.email_verified is set. Sync now only promotes verification.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(auth): promote user.email_verified when profile is verified
Self-hosted bootstrap and other flows can set profile.is_email_verified
before user.email_verified. Sync and createProfileHook now update both
tables when promoting verification.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(auth): strip internal port from OAuth redirects on BYOD domains
When BYOD custom domains proxy auth requests through the dashboard to
PRIVATE_SERVER_URL (e.g. http://cio-api-vymh:10000), Node's URL host setter
preserves the upstream port. Better Auth then redirects browsers to
https://customer.example:10000/... which fails.
- Add oauth-proxy-redirect helpers to clear backend ports explicitly
- Rewrite inbound auth request URLs and outbound oauth-proxy-callback Location headers
- Send hostname-only X-Forwarded-Host from dashboard proxy when port matches backend
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(auth): address Greptile review on oauth port stripping
- Only treat PRIVATE_SERVER_URL as an internal backend port
- Add test for rewriteAuthRequestUrl when forwarded host still has :10000
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org): serve OG images from CDN for Discord embeds
Discord times out on slow dynamic OG generation (~3-5s). Persist generated
images to R2, point meta tags at the media CDN, and warm the API endpoint
on org-site page loads so crawlers get a fast static PNG URL.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* docs: add org-site Open Graph and favicon guides
Document user-facing sharing behavior and contributor architecture
for dynamic OG images, favicon fallback, R2/CDN caching, and embed
cache invalidation.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org-site): address PR review on OG CDN fallback and docs
- Fall back to API OG URL when CDN object is not yet available (HEAD check)
- Cancel warm-fetch response body to avoid connection pool exhaustion
- Align tenant-router OG edge cache TTL with one-hour API revalidation
- Fix favicon docs navigation and add Custom Domain tab screenshot
- Replace Chiberry Artistry example with AI Academy
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org-site): accept docker hostnames for OG warm URL
Use isValidHttpUrl for PRIVATE_SERVER_URL so internal values like
http://api:3081 work for SSR warm fetches in Docker Compose.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
When no custom favicon is set, fall back to the organization logo on
public org-site pages instead of the default ClassroomIO icon.
For OG images, only apply the theme-color background behind the logo
when rendering initials; real logo images now render without the tint.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(org): add dynamic open graph images for school sites
Generate branded 1200x630 OG images for org public sites via GET /org/og/:siteName.png.
Paying cloud orgs include their landing-page tagline; free plans show a Powered by
ClassroomIO watermark. Dashboard org-site meta tags now point at the dynamic image.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(org): enable custom favicon upload and org-site rendering
Allow org admins to upload a favicon from domain settings, persist it via
PUT /organization, and render it on public org sites with logo fallback.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org): scope custom favicon to public org-site routes only
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(api): inline org-site OG rendering, remove @cio/og-images package
Move template and render helpers into apps/api/src/utils/org-site-og.ts.
Certificates stay in a shared package because they support multiple templates;
org OG is a single API-only concern.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* chore: remove packages/og-images directory
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(api): mount org OG image under /org-site/og
Align with existing org-site public routes (/org-site/course) instead of a
top-level /org prefix.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(plans): consolidate isOrgOnFreePlan into options-based utility
Move orgId guard and self-hosted/plan checks into @cio/utils/plans.
Dashboard and API callers pass plans, isSelfHosted, and optional orgId
directly; remove the dashboard store wrapper.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org): require orgId for free-plan check and translate favicon strings
Treat missing orgId as not on free plan so nav gating matches prior
behavior when currentOrg is unset. Pass organization.id from OG service.
Add favicon settings translations for all non-English locales.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(dashboard): move meta tag helpers to metaTags.server.ts
Keep PRIVATE_SERVER_URL resolution in a server-only module so dynamic
private env imports cannot leak into universal or client bundles.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(dashboard): allow File favicon in org update before upload
Skip favicon from pre-upload Zod validation when a File is provided,
matching how avatar uploads bypass ZUpdateOrganization until resolved.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(dashboard): use public API URL for org OG meta tags
Never emit PRIVATE_SERVER_URL in og:image URLs. Prefer PUBLIC_SERVER_URL
for crawlers; fall back to same-origin /proxy when unset.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(dashboard): use org landing copy and public OG URLs for org sites
Populate og:title, description, and site_name from org landing page hero
copy on cloud tenant sites. Build og:image from the tenant origin /proxy
path so crawlers never receive internal PRIVATE_SERVER_URL values.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(api): redesign org OG image with logo top-left
Replace the saturated gradient layout with a light theme-tinted card:
Academy label, org name, and tagline bottom-left; logo top-left;
decorative circle top-right; watermark on free plans.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(org): add dynamic open graph images for school sites
Generate branded 1200x630 OG images for org public sites via GET /org/og/:siteName.png.
Paying cloud orgs include their landing-page tagline; free plans show a Powered by
ClassroomIO watermark. Dashboard org-site meta tags now point at the dynamic image.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(org): enable custom favicon upload and org-site rendering
Allow org admins to upload a favicon from domain settings, persist it via
PUT /organization, and render it on public org sites with logo fallback.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org): scope custom favicon to public org-site routes only
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(api): inline org-site OG rendering, remove @cio/og-images package
Move template and render helpers into apps/api/src/utils/org-site-og.ts.
Certificates stay in a shared package because they support multiple templates;
org OG is a single API-only concern.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* chore: remove packages/og-images directory
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(api): mount org OG image under /org-site/og
Align with existing org-site public routes (/org-site/course) instead of a
top-level /org prefix.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(plans): consolidate isOrgOnFreePlan into options-based utility
Move orgId guard and self-hosted/plan checks into @cio/utils/plans.
Dashboard and API callers pass plans, isSelfHosted, and optional orgId
directly; remove the dashboard store wrapper.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(org): require orgId for free-plan check and translate favicon strings
Treat missing orgId as not on free plan so nav gating matches prior
behavior when currentOrg is unset. Pass organization.id from OG service.
Add favicon settings translations for all non-English locales.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(dashboard): move meta tag helpers to metaTags.server.ts
Keep PRIVATE_SERVER_URL resolution in a server-only module so dynamic
private env imports cannot leak into universal or client bundles.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(api): return Zod validation errors from public API routes
Public API handlers now surface ZodError details as 400 VALIDATION_ERROR
responses instead of generic 500 INTERNAL_ERROR payloads. Course import
services also rethrow ZodError so validation failures are not wrapped as
server errors.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* refactor(utils): centralize course type values without db dependency
Define COURSE_TYPE_VALUES once in @cio/utils/constants and use it for
ZCourseType validation and the Drizzle COURSE_TYPE pgEnum. Removes the
circular @cio/utils -> @cio/db import while keeping course-import schemas
aligned with all four course types including PUBLIC.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(validation): default missing course metadata allowNewStudent to true
Courses stored without allowNewStudent in metadata failed structure export
validation. Align Zod preprocessing with runtime behavior where absent
values mean enrollments are open.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* chore(db): drop unused COURSE_TYPE_VALUES re-export from schema
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(cohorts): rename Programs to Cohorts with data migration
- Add cohort database tables and Drizzle migration alongside legacy program tables
- Introduce migrate-programs-to-cohorts script to copy existing program data safely
- Rename API routes (/cohort), services, queries, validation, and error codes
- Rename dashboard feature module, routes (/cohorts), navigation, and translations
- Update docs, emails, and internal compliance cron endpoints for cohort terminology
- Keep legacy program tables in place for rollback until explicitly removed
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(db): restore migrate:answer-data script alongside cohort migration
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(db): cast program enums when migrating data to cohort tables
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(db): truncate cohort tables before program-to-cohort copy
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(db): report accurate row counts in programs-to-cohorts migration
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(automation): align public API plan gating across cloud and self-hosted
Add shared canUsePublicApi helper so cloud allows Early Adopter and
Enterprise while self-hosted requires Enterprise. Update the API key
dashboard page and backend key creation checks to use the same rules.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* docs(api): document bearer auth on public API reference
Add shared OpenAPI enrichment with bearerAuth security scheme and
authentication instructions. The interactive reference now loads an
enriched spec with Authorize support, and the API guide explains how
to create and use org API keys.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(dashboard): add API quick-start code snippets on automation page
Mirror the MCP client setup section with cURL, JavaScript, and Python
examples that show how to authenticate public API requests with org keys.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* ci(openapi): republish spec when public API OpenAPI helpers change
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* feat(dashboard): add Go snippet to API quick-start examples
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* docs(api): use /org/*/api and clarify dashboard key generation path
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(api): escape backticks in OpenAPI description template literal
Greptile flagged that unescaped backticks around * in
PUBLIC_API_OPENAPI_DESCRIPTION evaluated to NaN and dropped auth docs
from the Scalar spec. Also use plan-specific snackbar message on upgrade.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
- Add Types section to the Filter sidebar with all 4 course types
- Add full-text search input centered in the hero (title + description)
- Add Pricing section (Free / Paid) based on course cost
- Compact hero prop across all 10 themes to halve vertical padding
- Children snippet support in all hero themes for the search input
- All filters are URL-driven (?types=, ?search=, ?tags=, ?pricing=)
- Full-stack: validation schema, DB queries, service, API route, server load, UI
* feat: make upload file size limits configurable via .env
Add UPLOAD_MAX_*_MB environment variables for documents, images, videos,
exercise assignment files, AI assistant documents, landing page images,
and media thumbnails. API presign routes validate file size server-side;
dashboard UI reads the same limits from layout data.
* chore: wire upload limit env vars through Docker compose and docs
Pass UPLOAD_MAX_*_MB from the root .env into api and dashboard containers
in both compose files, document them in .env.example and self-hosting guides.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* docs: cross-link upload limits in README, Railway, Coolify, and Cloudflare guides
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix: address PR review feedback on upload limits
- Restore 5 MB default for thumbnail uploads (edit-asset-dialog regression)
- Add getResolvedUploadLimits() fallback for Storybook/tests
- Cache core getUploadLimits() like the dashboard helper
- Document presign fileSize as advisory; allow zero-byte fileSize in schema
- Only send fileSize to presign when greater than zero
* docs: remove upload limits from Cloudflare setup guide
---------
- Add .odt (application/vnd.oasis.opendocument.text) as a supported upload
format; extract text via JSZip + content.xml parsing
- Add attach_document_to_lesson agent tool so the AI can attach an uploaded
document to a lesson as a downloadable material
- Instruct the agent to create a "Course Materials" lesson (first lesson of
the first section) and attach the uploaded document to it on implementation
- Suppress hallucinated references: uploaded documents do not count as fetched
URLs — omit the References section when no fetch_documentation_url calls
were made
- Surface specific upload error snackbars (file_too_large, unsupported_file_type)
instead of silently logging; fix generic fallback message
- Allow typing in the chat textarea while a document is uploading; only block
Enter/send, not the whole input
- Fix retry endpoint to return the current run instead of erroring when the run
is already active (queued/running/waiting_for_input/paused)
- Connect @cio/core Redis singleton in the jobs bootstrap so course-generation
workers no longer fail with "The client is closed"
- Expose documentAssets (assetId + fileName) alongside documentText in
AgentContext and pass it through both the chat route and course runner
When a lesson has two or more uploaded videos each calls mintHlsCookie,
but all wrote to the same `cio_hls` cookie name. The last write won,
leaving every other video with a mismatched token and a 403 from the
CF Worker.
Cookie name is now `cio_hls_${assetId}` so each video owns its own
cookie. The tenant-router Worker, the Hono HLS fallback route, and the
transcripts route all read the per-asset name.
* feat(course): add reset student course progress action
Give course admins and tutors a destructive reset-progress flow on the
student people detail page. The backend clears learner progress for one
(courseId, memberId) pair in a single transaction while keeping the
groupmember enrolled, and logs an audit summary. The dashboard shows a
confirmation dialog with impact counts from analytics before deleting.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(i18n): add localized reset progress strings for all locales
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(course): scope reset progress to course data only
Stop deleting org-level community questions and answers during course
progress reset. Fix course newsfeed deletion order so comments on a
student's posts are removed before the posts themselves. Restrict reset
to student members, move analytics loading to the person detail layout,
and rename impact copy to course newsfeed only.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(course): address Greptile review on reset progress
Make progressImpact opt-in via includeProgressImpact query param so
analytics requests avoid extra DB work unless the reset dialog needs it.
Count only student-authored course newsfeed posts and comments in the
impact summary to avoid double-counting replies on the student's posts.
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>
* fix(dashboard): course menu icons, delete scroll, and settings tags auth
Remove inconsistent dropdown icons, scroll to settings sections for delete
and related actions when already on the settings page, and skip org tag
group fetches for non-admin users to avoid ORG_TEAM_NOT_AUTHORIZED errors.
* fix(api): allow org members to fetch organization tags
Use orgMemberMiddleware for GET /organization/tags instead of restricting
reads to admins. Revert the dashboard settings workaround that skipped tag
group fetches for non-admin users.
---------
Adds live-class session scheduling on lessons (join link, date/time,
timezone) with automatic 24h and 1h reminder emails plus a calendar
invite (.ics), a time-change notification with an updated invite, a
teacher-authored welcome email and session invite on enrollment, and a
"Notify students" quiz nudge.
LMS gets an upcoming live-sessions card and Join buttons, plus a
reusable live-session card component (3 states) in @cio/ui with a
Storybook story. The sidebar content tree now reflects sequential
progression locking like the content list, and the course-completion
confetti regression is fixed.
Org-based emails no longer reference ClassroomIO by name. Docs add
live-class, welcome-email, and course-progression guides, expand the
certificates guide (design, signatures, corrected labels), move
plan-required callouts to the top, flatten how-to-guides to the docs
root with redirects, and add screenshots. Includes an add-docs-image
skill.
Loosen the custom-domain regex to accept apex domains (1+ labels) in
addition to subdomains; the TLD already allowed any letters. Suppress
the CNAME record for apex hostnames since a CNAME is invalid at the zone
apex, and surface only the A record there. Drop the frontend apex
rejection and the misleading ".com" input suffix, and render the
domain-input prefix/suffix addons only when set.
Serve widgets from short public URLs via tenant-router with R2-backed
assets and runtime API_URL injection, so copy-paste snippets hide infra
paths. Update widget payloads, CSP, upload purge URLs, and dev-only API
inject; document format/stage workflow in AGENTS.md and fix ui-prefix-check
YAML syntax.
Gate student content by completion order, track per-video watch progress
with seek enforcement, and auto-complete lessons at the configured
threshold. Show ring progress in the lesson header, keep watch progress
on rewatch, and sync progression locks client-side so the next item
unlocks after completion.
- Add paginated recommended courses to LMS dashboard (top 3, list
view)
and explore page (12 per page); exclude courses blocking new
students
- Polish course preview modal: remove padding, render requirements as
HTML, round banner image, secondary close button
- Redirect to course start page after successful enrollment instead of
/lms;
keep spinner active until navigation completes
- Auto-enable "allow new students" when a course is published
- Move Explore after My Learning in LMS sidebar nav
- Move Certificates after Content in course sidebar
- Add hiddenColumns prop to CourseListRow; show "Learn more" button
instead of actions menu in LMS explore context
- Implemented a new endpoint to delete failed manual p1080 renditions, restoring the master manifest and updating metadata.
- Enhanced the HLS upload process with better error handling and cleanup for aborted uploads.
- Introduced tests for HLS encoder functionality to ensure correct selection of rungs based on video source properties.
- Updated video upload component to manage reserved asset IDs and perform cleanup on abo
Add get_lesson_transcript (teacher) and read_lesson_transcript (student)
tools that fetch a lesson's uploaded-video transcript from media_transcript
by the video assetIds. The agents call them only when a question is about
the video's spoken content, so text-only chats keep a cacheable prefix.
- Replaced email/token-based authentication with HTTP Basic Auth for the queue dashboard in production.
- Updated course components to use courseId instead of courseSlug for better consistency.
- Adjusted role-based security checks to utilize isStudentExperience for conditional rendering.
- Enhanced view-as-student functionality to redirect correctly based on courseId.
New features:
- HLS video encoding/streaming (hls routes, hls-encoder) and a media
transcripts pipeline (transcripts route + media-transcript queries)
- AI assistant chat vs. run model: agent-course-generation worker/queue,
run-monitor pane, chat-changes card, content ask-ai bar
- Per-theme course-page previews across org landing-page themes (bold,
classic, corporate, editorial, etc.) with a shared course token/component set
- View-as-student mode and login-link / link-invite invite flows
Refactor:
- Extract packages/core consolidating config (env, storage, dashboard-url),
services and utils previously duplicated under apps/api/src/config
- Remove legacy agent service modules (chat-tools, chat-context,
context-window, document, fetch-url, lesson-content)
- Relax Cross-Origin-Resource-Policy to allow cross-origin media embedding
- Add format script to tenant-router so turbo run format covers it
Resolve sessions before rate limiting so keys are per-user, exempt trusted server API key calls and get-session, and raise the GET /organization budget for layout loads.
Co-authored-by: Cursor <cursoragent@cursor.com>
