Commit Graph
160 Commits
Author SHA1 Message Date
Rotimi Best ac3f35a97f Merge branch 'main' of https://github.com/classroomio/classroomio into feat/release-v2 2025-12-24 04:18:39 +00:00
Abdulmuizz HamzatandRotimi Best fdadc7bccf feat: include image cropper (#617)
* fix: include image cropper

* clean styles

* ui improvements

* bug bot feedbacks

* fix: update image upload format to PNG for consistency with cropping output

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-12-23 11:25:38 +01:00
Adeyemi AdetunjiandRotimi Best bc9e3b41ae feat: move community supabase request to api layer (#612)
* feat: move community supabase request to api layer

* chore: pr review checkpoint

* chore: PR fixes

* feat: implement role-based authorization middleware and align the community features with the developer guide.

- Added role-based authorization middleware for organization and course membership checks, including `orgMemberMiddleware`, `orgTeamMemberMiddleware`, and `courseMemberMiddleware`.
- Introduced route-specific middleware for comment and question authorization, ensuring only authors or team members can modify content.
- Updated community routes to utilize the new middleware for enhanced security and access control.
- Refactored community services to streamline upvote functionality and improve error handling.
- Enhanced UI components for community interactions, including new comment and question pages, and improved state management for user actions.
- Updated documentation to reflect new middleware usage and best practices for authorization in the API layer.

* feat: enhance course and organization routes with middleware for improved access control

- Added `courseMemberMiddleware` to course download and clone routes to enforce membership checks.
- Updated lesson route to include `courseMemberMiddleware` for PDF downloads.
- Integrated `orgMemberMiddleware` into organization routes for team and audience access, ensuring only authorized members can retrieve data.
- Refactored lesson and organization routes for consistency and clarity in middleware usage.

* chore: streamline dashboard and API development scripts in package.json

- Consolidated dashboard and API development commands to include all relevant filters in a single line for improved clarity and ease of use.
- Removed redundant full command variants to simplify the script section.

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-12-22 19:57:27 +01:00
Rotimi BestandAbdulmuizz Hamzat 9fb6c7cbaa feat: migrate course UI from supabase (#615)
* chore: fix storybook build

* chore: implement theming

* community list not showing properly

* refactor: migrate Chip component to @cio/ui/custom/chip

- Updated imports for the Chip component across multiple files to use the new location in the @cio/ui package.
- Replaced the previous Chip implementation with a new version that utilizes a Badge for better styling and functionality.
- Adjusted related components to ensure consistent usage of the updated Chip component.

* fix: align course sidebar design to match organization design (#611)

* fix: align course sidebar design to match organization design

* feat: add hideSearch prop to AppHeader and update sidebar layout

---------

Co-authored-by: Rotimi Best <[email protected]>

* refactor: replace PrimaryButton with Button component across multiple files

- Updated various components to use the new Button component from @cio/ui/base/button instead of the deprecated PrimaryButton.
- Ensured consistent button usage throughout the application for improved styling and functionality.
- Removed the PrimaryButton component and its associated constants from the codebase.

* refactor: standardize button and input usage across components

- Replaced instances of deprecated components such as TextField, TextArea, and IconButton with their updated counterparts (InputField, TextareaField, and updated IconButton).
- Ensured consistent event handling by changing `onClick` to `onclick` for better alignment with Svelte's event binding conventions.
- Removed unused components and streamlined imports to enhance code maintainability and readability.

* chore: themeing, course card, use $features

* refactor: centralize UI components and update modal implementations

- Refactored various components to centralize UI elements, improving discoverability and maintainability.
- Replaced deprecated modal components with the new Dialog component for consistent modal behavior across the application.
- Removed unused components and streamlined imports to enhance code clarity and reduce complexity.

* feat: add new documentation and refactor org and lms UI components

- Introduced new documentation files for Auth Flow, Breadcrumbs Refactoring, Page and Route Creation, and Route Page Setup to enhance developer onboarding and reference.
- Refactored various UI components, including the Course Sidebar and Lesson Modal, to improve layout and functionality.
- Removed deprecated components and streamlined imports for better maintainability.
- Updated translations across multiple languages to ensure consistency in user experience.

* refactor: update UI components and improve styling consistency

- Refactored various components to enhance styling consistency, including updates to button and text color classes.
- Removed deprecated components and streamlined imports for better maintainability.
- Replaced instances of PageBody with a more flexible Page component structure across multiple routes.
- Updated translations and UI elements to align with the new design system.
- Deleted unused components to reduce code complexity and improve clarity.

* update output.css

---------

Co-authored-by: Abdulmuizz Hamzat <[email protected]>
2025-12-22 02:36:48 +01:00
Rotimi Best 4b52906445 feat: enhance API route naming conventions and structure
- Added comprehensive guidelines for API route naming and structure in `ROUTE_NAMING_BEST_PRACTICES.md`.
- Updated `ARCHITECHTURE.md` to reference the new best practices document.
- Refactored course-related routes to follow new naming conventions, including changes to endpoint paths and validation schemas.
- Removed the deprecated course clone route and integrated cloning functionality directly into the course routes.
- Adjusted various API methods to ensure consistent usage of HTTP methods and parameter structures across the application.
2025-12-05 17:24:16 +01:00
Rotimi Best ac4fdf1dd3 feat: migrate client-side database calls to secure server-side API endpoints
- Create secure server-side API endpoints for course data, marks, exercises, newsfeeds, submissions, and organization management
- Implement role-based permission checking using checkUserCoursePermissions utility
- Move all client-side Supabase calls to authenticated server endpoints in /api/courses/ and /api/org/
- Add proper authentication and authorization middleware via hooks.server.ts
- Update service functions to use getAccessToken() for API authentication
- Ensure data filtering based on user roles (students only see their own data)
- Maintain backward compatibility with existing component interfaces
2025-12-05 10:48:01 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best 43e6cd611d chore: auto logout test emails. 2025-12-03 13:48:25 +01:00
Rotimi Best 900f5ec129 fix: critical SVG XSS vulnerability in file uploads
- Add comprehensive file type validation to prevent SVG uploads
- Update upload widgets to restrict file types at input level
- Enhanced HTML sanitization to block SVG tags and data URLs
- Create centralized file validation utilities with shared constants
- Add client-side and server-side protection against malicious uploads

Security Impact:
- Prevents stored XSS attacks through malicious SVG profile uploads
- Blocks execution of JavaScript embedded in SVG files
- Enforces whitelist of safe image formats (JPEG, PNG, GIF, WebP)
- Provides defense-in-depth protection across all upload components

Fixes reported vulnerability in profile image upload functionality.
2025-12-03 11:25:00 +01:00
Rotimi Best fb2ea885e1 chore: update translation 2025-12-03 10:59:08 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Adeyemi AdetunjiandRotimi Best 9a5aee1ee0 feat: setup dashboard analytics api (#604)
* feat: setup dashboard analytics api

* chore: requested pr fixes

* fix: dash analytics server side type

* refactor: update Avatar component usage across the dashboard

- Replaced custom Avatar component with the new @cio/ui/base/avatar implementation for consistency.
- Enhanced avatar rendering with fallback options and improved accessibility.
- Cleaned up unused Avatar component files and related functions.
- Updated various components to utilize the new Avatar structure, ensuring a uniform appearance and behavior across the application.

* chore: remove console.log statements from analytics routes and API calls

- Eliminated console.log statements for orgId and siteName in the dash analytics router and DashStatApi class to clean up the code and improve performance.

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-12-02 15:27:41 +01:00
Rotimi Best c7854efae3 feat: redo settings and all org pages. (#601)
* feat: new components, deploy storybook

* refactor: simplify component field definitions and enhance button loading state

- Removed unnecessary type imports and simplified the FIELDS array definitions across multiple components in Storybook.
- Updated button component to use a loading state instead of isLoading, improving clarity and consistency in props.
- Adjusted button stories to reflect the new loading prop and enhanced the button's loading visual feedback.
- Minor CSS adjustments for better layout and styling consistency.

* chore: add field, card, password components

* feat: improve page component & update AuthUI path

* chore: update bits-ui to version 2.14.4 and all org related UI's

- Updated bits-ui dependency in pnpm-lock.yaml and package.json to version 2.14.4.
- Refactored imports for RoleBasedSecurity and UpgradeBanner components to use the new ui feature directory.
- Removed unused Course components and related files to clean up the codebase.
- Enhanced various components to improve consistency and maintainability.

* chore: move all setting buttons to the top and update auth ui styles

* chore: remove svelte-loading-spinners and replace with @cio/ui/base/spinner

- Removed all instances of svelte-loading-spinners from the project.
- Updated components to use the new Spinner from @cio/ui/base/spinner.
- Cleaned up pnpm-lock.yaml and package.json to reflect the removal of svelte-loading-spinners.
- Added new CSS animations for rocket launch effects in app.css.
- Enhanced email change flow with updated verification messages in translations.

* chore: remove supabase file upload from dashboard and move to r2

* chore: update organization API and UI components

- Added new API methods for organization plan operations and team management.
- Introduced middleware for API key authentication and organization admin checks.
- Refactored organization-related components to utilize the new API structure.
- Updated various UI components to improve consistency and maintainability.
- Enhanced error handling and validation for organization-related actions.
- Removed deprecated services and streamlined the codebase.
2025-12-02 09:54:38 +01:00
Rotimi Best a3924100dd feat: migrate auth from supabase to better auth (#596)
* feat: add README for @cio/db package and remove existingAccounts.json

* load session, load profile and organization, add create profile hook

* chore: cache session request

The trick was passing all the cookies to the backend. Previously I was only passing the better-auth.session_token and not better-auth.session_data. Read about the difference here https://www.better-auth.com/docs/concepts/cookies#custom-cookies

* feat: login, logout, onboarding, verify email, reset password.

* feat: complete change email and email verification

* feat: standardise how we make rpc calls and create org endpoints

* fix ui errors

* fix: handle potential undefined customerId and standardize avatar URL property

* refactor: standardize custom domain handling and update telegram chat ID references

* chore: add tailwind prefix to @cio/ui

this fixed the media query issues because  @cio/ui classes were overriding this dashboard tailwind build

* chore: clean up org sidebar

* chore: persist mode state

* feat: implement order breadcrumbs

* chore: upgrade to better auth 1.4

* chore: address common auth flow bugs and setup app for others to setup locally.
2025-11-24 01:00:50 +01:00
Adeyemi AdetunjiandRotimi Best cbf6ae7e63 feat: move away from carbon components and TinyMCE (#597)
* feat: remove tinymce & replace org sidebar

* chore: PR Fixes

* chore: move ui font into src dir

* remove files in vite config

* use google font import for loading font

* remove custom font

* more fonts update

* remove font bold

* more removals of font bold

* fix import

* checkpoint

* chore: checkpoint (add course & lms shadcn sidebar)

* minor css improvements and try out font sans

* chore: replace carbon components with shadcn's

* chore: replace carbon components with shadcn _ v3

* chore: ui fixes & storybook update

* feat: UI cleanup

* fix: quick ui fixes

* chore: update pnpm-lock.yaml with new dependencies and versions; fix output.css formatting

* chore: add isloading to button

* feat: add loading state to button stories

* chore: feedback fixes

* fix: feedback fixes

* chore: remove console

* fix: PR comments

* fix: PR comments

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-11-21 12:18:04 +01:00
Rotimi Best 1e966aaf0f fix: redirect to 404 page after user closes welcome modal.
This is because when you close the modal we redirect you to /org/siteName/courses but if you click close before we get your organization siteName the route is just /courses which redirects to a 404.
2025-11-18 19:16:51 +01:00
Rotimi Best ba47b06647 Merge branch 'main' of https://github.com/classroomio/classroomio into feat/release-v2 2025-11-08 20:22:53 +01:00
Rotimi Best b783940cee fix: keep org store after logout
This fix tackled a bug where if I logged out, go to org landing page, open a course and enrol then it gets redirected to a 404 page because `$currentOrg.siteName` is undefined.
2025-11-08 17:58:03 +01:00
Rotimi Best 93db0c97e8 chore: use hasSession to check if auth token exists 2025-11-08 17:30:22 +01:00
Rotimi Bestandtunny17 f5a4156c8b feat: migrate dashboard to svelte 5 (#577)
* chore: migration to SvelteKit 2

* stage 1: migrate to svelte 5 and fix rerendering issues

* stage 2: fix more $: reactivity across dashboard

* fix merge conflicts

* chore: migrate code in main to svelte 5

* chore: update preventDefault

* chore: simplify tsconfig and remove unused mobileMenuRef in MobileMenu.svelte

* chore: enforce .ts across dashboard

* rename from classroomio-com to website

* stage-3: Replace carbon icon svelte with lucide icon

* update lock file

* chore: finish icon replacement

* fix: settings and setup page multiple rerender

* stage 3: More icon and rerendering fixes

* feat: checkpoint

* feat: update editor

* [not working] connect everything with ui build

* storybook + ui + dashboard all working independently

* add bg-black to +page.svelte

* feat: add editor to storybook

* chore: animate lucid icons (#590)

* v1 animations

* feat: change some course navigation icons & animate org navigation icons

* chore: change settings icon

* chore: use css instead of js for hover

* rename animations

---------

Co-authored-by: tunny17 <[email protected]>

* chore: update path to node_modules types in api tsconfig

* fix: update import path for DropdownMenu component

* fix: add rollupOptions to build configuration in vite.config.ts

* fix: remove rollupOptions from build configuration and add @floating-ui/dom dependency

* install

---------

Co-authored-by: tunny17 <[email protected]>
2025-11-01 16:18:29 +01:00
Rotimi Best b96d91cd7c feat: setup drizzle (#594)
* chore: migration to SvelteKit 2

* stage 1: migrate to svelte 5 and fix rerendering issues

* stage 2: fix more $: reactivity across dashboard

* fix merge conflicts

* chore: migrate code in main to svelte 5

* chore: update preventDefault

* chore: simplify tsconfig and remove unused mobileMenuRef in MobileMenu.svelte

* chore: enforce .ts across dashboard

* rename from classroomio-com to website

* stage-3: Replace carbon icon svelte with lucide icon

* update lock file

* chore: finish icon replacement

* fix: settings and setup page multiple rerender

* stage 3: More icon and rerendering fixes

* feat: setup drizzle and better auth

* fix: onboarding validation error showing translation key #586 (#593)

* fix: onboarding validation error showing translation key #586

* fix: remove debug log for profile update errors

* chore: add a clean command

* fix: remove message from email verification response
2025-11-01 15:49:29 +01:00
Rotimi Best 86adad9358 fix: onboarding validation error showing translation key #586 (#593)
* fix: onboarding validation error showing translation key #586

* fix: remove debug log for profile update errors
2025-11-01 09:54:19 +01:00
Nwosu Emmanuel 8efffcb7f6 feat: clone course (#582)
* feat: clone course work

* feat: clone and delete a course

* feat: clone and delete a course

* feat: clean up

* feat: attending to reviews

* feat: attended to revies
2025-10-29 09:57:29 +01:00
Adeyemi Adetunji f8271d850f fix: dashboard i18n build/console warnings (#587)
* fix: build warnings

* feat: remove other instances of invalid_type_error and the unused translation key
2025-10-29 09:34:30 +01:00
Adeyemi Adetunji b9b19d8a2e feat: add search and replace to tinymce editor (#585) 2025-10-28 11:59:21 +01:00
Adeyemi AdetunjiandRotimi Best 3692046077 feat: add danish support to dashboard (#580)
* feat: Add Danish Support

* feat: add migration file

* chore: update migrations

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-10-13 18:07:46 +01:00
Rotimi Best c31e5e131f chore: update org mock data 2025-10-13 15:49:50 +01:00
Rotimi Best 23ef0661eb fix: add address translation to en.json 2025-10-13 15:46:28 +01:00
Nwosu Emmanuel 6cae0f1506 fix: pushed fix for landing page (#579) 2025-10-13 14:39:57 +01:00
Rotimi Best 92cc922a40 chore: reorder org import 2025-10-12 17:30:39 +01:00
Rotimi Best 41de98083f fix: show navigation if slugname include routes to hide nav 2025-10-12 14:02:47 +01:00
Nwosu EmmanuelandRotimi Best 27ee51155e feat: add custom navigation link to org landing page (#569)
* feat: custom navbar UI complete

* chore: added translations

* fear: attending to reviews

* add orgname to org landing page

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-10-09 01:13:06 +01:00
Rotimi Best 9a7018eb34 chore: remove unused dependencies 2025-10-04 11:01:22 +01:00
Nwosu EmmanuelandRotimi Best 594eb97caa feat: AI grading bug (#420)
* worked on the AI grading task

* worked on the AI grading task

* improved the ai grading function

* improved the ai grading function

* update types

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-28 20:08:56 +01:00
Rotimi Best 6d68351a46 feat: end to end api type safety with redis rate limiting (#573)
* feat: support hono rpc

* add wrangler file

* update name of wrangler file

* add wrangler as a dependency

* add compatibility_flags

* trigger ci

* core: add health check to docker file

* expose port 80

* update custom healthcheck

* feat: implement openapi

* install dependencies in root

* debug yml

* update yml

* update port

* update dockerfile with envs

* completely move away from apiClient

* rename backend to api

* refactor: update server descriptions and comment out local spec saving

* update lock file

* use api.classroomio.com

* add support for redis

* fix: add missing line break in WelcomeModal.svelte

* refactor: remove wrangler configuration and update Vite config for API integration
2025-09-21 19:35:41 +01:00
Rotimi Best a6880f1b54 feat: implement percentage calculation utility and refactor analytics to use it
- Added `calcPercentageWithRounding` function for consistent percentage calculations with rounding.
- Updated course and user analytics to utilize the new utility for progress and average grade calculations.
- Removed redundant rounding logic from analytics functions.
2025-09-18 10:34:54 +01:00
Nwosu EmmanuelandRotimi Best ec3875bac2 feat: course analytics (#574)
* feat: added anaytics for the course page

* feat: Added pagination

* feat: cleanup

* feat: added translations

* feat: added fixes

* my improvements

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-18 01:00:49 +01:00
Nwosu Emmanuel f3de6a063e feat: Trigger confirm warning for unsaved changes (#547)
* added the triger warning for the settings page

* all done

* added translation to the window message

* window issue now fixed
2025-09-16 09:21:41 +01:00
Rotimi Best caa48003af fix: include types 2025-09-15 19:15:50 +01:00
Rotimi Best 98acd93133 fix: disable accept button if still fetching user details 2025-09-10 20:39:16 +01:00
Rotimi Best f60809a249 fix: only redirect in layout only if on redirect page 2025-09-10 17:18:01 +01:00
Rotimi Best 12c0f00007 debug: auth redirect 2025-09-10 16:50:31 +01:00
Nwosu EmmanuelandRotimi Best 937f1d8155 feat: add documents to Lesson materials (#572)
* feat: Initial logic for the pdf upload

* feat: uploa logic, translations and ui flow complete

* chore:console log cleanup

* feat: fixed upload issue and added cancel upload button

* feat: fixing the download document ish

* feat: All done and ready for use

* feat: updated the document viewing logic

* feat: some minor refactor

* feat: added migration file

* fix: dark mode, translations, restyling,

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-09-10 11:39:06 +01:00
Rotimi Best 7a77bd6c79 chore: check permission only after org is loaded 2025-09-09 13:12:56 +01:00
Rotimi Best 9055c45384 chore: move IS_SELFHOSTED to public env 2025-09-07 10:24:34 +01:00
Rotimi Best 279d10a914 feat: add Polish language support 2025-08-08 04:53:38 +01:00
Rotimi Best 1eb0099938 chore: update org.ts to trigger CI 2025-07-21 21:53:00 +01:00
Rotimi Best 8a6d35b8ed fix: update currentOrgDomain to derive root domain from window location 2025-07-21 21:33:50 +01:00
Rotimi BestandIniubong Obonguko 82be557a42 chore: move backend to hono + typescript (#558)
* feat: setup secure presigned uploads and downloads

* clean up

* update lock

* Get presigned url finally working

* 557: Migrate backend to hono + ts

* chore: update Dockerfile and package.json for backend configuration

* add dev command

* remove unused packages

* Enhance backend API and frontend components for course management

- Updated CORS configuration in the backend to allow specific methods and headers.
- Refactored lesson download endpoint to use a new route for PDF downloads.
- Removed unused certificate download functionality from the lesson router.
- Updated frontend components to reflect changes in API endpoints and improve video upload functionality.
- Introduced new video upload component and adjusted video handling in lesson materials.
- Cleaned up unnecessary imports and optimized component structure for better performance.

* PR cleanups

* Enhance email configuration by adding SMTP_SENDER environment variable

- Updated docker-compose.yaml to include SMTP_SENDER.
- Modified Dockerfile to accept SMTP_SENDER as an argument.
- Updated environment schema in env.ts to define SMTP_SENDER as optional.
- Adjusted mail service to use SMTP_SENDER for the email 'from' field.
- Updated documentation to reflect the new SMTP_SENDER variable.

* Remove debug log statement from sendEmail function

---------

Co-authored-by: Iniubong Obonguko <[email protected]>
2025-06-09 01:38:57 +01:00
Rotimi Best 9aeefc9f4f feat: Finally support a docker compose files that works (#555) 2025-05-20 01:37:58 +01:00