Commit Graph
25 Commits
Author SHA1 Message Date
Adeyemi AdetunjiandRotimi Best 50d6ee3111 feat: mock exercise template api (#613)
* feat: move mock exercise template to api

* feat: add template migration file

* chore:
- remove exercise templates form api
- rework api to pull exercise templates from db
- add exercise template seed to seed file
- declutter seed file

* chore:
- refactor template fetch to be dependent on the selected tag
- add tag to schema, remote db and template's seed file
- clear remote db's template table and replace data and their respective tags

* chore: add number of questions and center loading screen on the frontend

* chore: pr fixes

* chore: type fixes

* chore:
- move seed functionality to /seed folder
- add typing for individual seed functions
- pr fixes

* chore: pr fixes v2

* update output css

* refactor: update seeding script and schema definitions

- Renamed `seedTypes` to `seedQuestionTypes` for clarity in the seeding process.
- Enhanced the seeding script to include a command-line interface for better usability, allowing specific seed functions to be executed based on flags.
- Removed redundant unique constraints in the schema definitions for `courseNewsfeedComment` and `exerciseTemplate` to streamline database structure.

* feat: add email verification error handling page and update session management

- Introduced a new page for handling email verification errors, providing user-friendly messages based on error types.
- Updated session management logic to improve handling of public routes and session states.
- Enhanced security policies in the Svelte configuration to include additional sources for styles and scripts.
- Removed the old email verification error page to streamline the codebase.

* move the exercise template to cloudflare cdn

---------

Co-authored-by: Rotimi Best <[email protected]>
2025-12-25 05:09:27 +01:00
Rotimi Best ac3f35a97f Merge branch 'main' of https://github.com/classroomio/classroomio into feat/release-v2 2025-12-24 04:18:39 +00:00
Rotimi BestandAbdulmuizz Hamzat 9fb6c7cbaa feat: migrate course UI from supabase (#615)
* chore: fix storybook build

* chore: implement theming

* community list not showing properly

* refactor: migrate Chip component to @cio/ui/custom/chip

- Updated imports for the Chip component across multiple files to use the new location in the @cio/ui package.
- Replaced the previous Chip implementation with a new version that utilizes a Badge for better styling and functionality.
- Adjusted related components to ensure consistent usage of the updated Chip component.

* fix: align course sidebar design to match organization design (#611)

* fix: align course sidebar design to match organization design

* feat: add hideSearch prop to AppHeader and update sidebar layout

---------

Co-authored-by: Rotimi Best <[email protected]>

* refactor: replace PrimaryButton with Button component across multiple files

- Updated various components to use the new Button component from @cio/ui/base/button instead of the deprecated PrimaryButton.
- Ensured consistent button usage throughout the application for improved styling and functionality.
- Removed the PrimaryButton component and its associated constants from the codebase.

* refactor: standardize button and input usage across components

- Replaced instances of deprecated components such as TextField, TextArea, and IconButton with their updated counterparts (InputField, TextareaField, and updated IconButton).
- Ensured consistent event handling by changing `onClick` to `onclick` for better alignment with Svelte's event binding conventions.
- Removed unused components and streamlined imports to enhance code maintainability and readability.

* chore: themeing, course card, use $features

* refactor: centralize UI components and update modal implementations

- Refactored various components to centralize UI elements, improving discoverability and maintainability.
- Replaced deprecated modal components with the new Dialog component for consistent modal behavior across the application.
- Removed unused components and streamlined imports to enhance code clarity and reduce complexity.

* feat: add new documentation and refactor org and lms UI components

- Introduced new documentation files for Auth Flow, Breadcrumbs Refactoring, Page and Route Creation, and Route Page Setup to enhance developer onboarding and reference.
- Refactored various UI components, including the Course Sidebar and Lesson Modal, to improve layout and functionality.
- Removed deprecated components and streamlined imports for better maintainability.
- Updated translations across multiple languages to ensure consistency in user experience.

* refactor: update UI components and improve styling consistency

- Refactored various components to enhance styling consistency, including updates to button and text color classes.
- Removed deprecated components and streamlined imports for better maintainability.
- Replaced instances of PageBody with a more flexible Page component structure across multiple routes.
- Updated translations and UI elements to align with the new design system.
- Deleted unused components to reduce code complexity and improve clarity.

* update output.css

---------

Co-authored-by: Abdulmuizz Hamzat <[email protected]>
2025-12-22 02:36:48 +01:00
Rotimi Best ea93075bd5 fix: update content security policy to allow YouTube and refine source origins 2025-12-04 00:10:15 +01:00
Rotimi Best 25d1a8d710 Security Release v0.2.6: Email Verification Bypass Vulnerabilities Fixed
Critical security fixes addressing email verification bypass vulnerabilities:

Security Issues Fixed:
- Email verification status manipulation through client-side profile updates
- Base64 token forgery allowing arbitrary email verification
- DOM manipulation bypasses of email verification modal

Backend Security Enhancements:
- Secure verification tokens table with cryptographic token generation
- RLS policies preventing direct email verification status changes
- Server-side validation functions with expiration and ownership checks
- Database triggers blocking unauthorized verification status updates
- IP address logging and audit trails for security monitoring

Frontend Security Protections:
- Multi-layered DOM protection preventing UI manipulation bypasses
- Continuous monitoring and re-application of interaction restrictions
- CSS-based backup protection even if JavaScript is disabled
- Mutation observer to protect dynamically added elements
- Enhanced CSP configuration for Senja widget support

API Security Updates:
- Secure token-based verification replacing insecure Base64 method
- Comprehensive error handling with security-focused user messages
- Token validation with signature verification and expiration checks
- Legacy verification method blocking with security warnings
- Enhanced verification email generation with secure tokens

Files Modified:
- Database: New email_verification_tokens table and security functions
- API: Secure verification endpoints with token validation
- Frontend: DOM protection and verification modal enhancements
- CSP: Updated Content Security Policy configuration
- Blog: Security advisory for CVE-2025-65675 disclosure

This release patches critical authentication bypass vulnerabilities and
implements defense-in-depth security measures across the entire platform.

Security researchers and users should upgrade immediately.
2025-12-03 15:33:04 +01:00
Rotimi Best 4ac242d918 fix: add PostHog domains to CSP connect-src
- Add https://*.i.posthog.com to both enforcement and reportOnly CSP
- Resolves CSP violations blocking PostHog source maps and assets
- Fixes blocked requests to recorder.js.map and surveys.js.map

This ensures PostHog analytics work properly without CSP violations.
2025-12-03 10:28:02 +01:00
Rotimi Best 9fe7691f8d fix: CSP configuration for API and media access
- Add https://api.classroomio.com to connect-src for API calls
- Add https://*.r2.cloudflarestorage.com for Cloudflare R2 storage
- Add media-src directive to allow video/document loading
- Fixes CSP violations blocking video downloads and API requests

Resolves CSP errors preventing presigned URL requests and media playback.
2025-12-03 10:10:08 +01:00
Rotimi Best 7014757ed5 fix: add PostHog and Umami analytics to CSP
- Added https://eu-assets.i.posthog.com for PostHog scripts
- Added https://eu.i.posthog.com for PostHog API calls
- Added https://umami.hz.oncws.com for Umami analytics
- Maintains XSS protection while enabling analytics
2025-12-03 09:44:31 +01:00
Rotimi Best 7b18c325da fix: cross site scripting with html content 2025-12-03 09:33:53 +01:00
Rotimi Best a3924100dd feat: migrate auth from supabase to better auth (#596)
* feat: add README for @cio/db package and remove existingAccounts.json

* load session, load profile and organization, add create profile hook

* chore: cache session request

The trick was passing all the cookies to the backend. Previously I was only passing the better-auth.session_token and not better-auth.session_data. Read about the difference here https://www.better-auth.com/docs/concepts/cookies#custom-cookies

* feat: login, logout, onboarding, verify email, reset password.

* feat: complete change email and email verification

* feat: standardise how we make rpc calls and create org endpoints

* fix ui errors

* fix: handle potential undefined customerId and standardize avatar URL property

* refactor: standardize custom domain handling and update telegram chat ID references

* chore: add tailwind prefix to @cio/ui

this fixed the media query issues because  @cio/ui classes were overriding this dashboard tailwind build

* chore: clean up org sidebar

* chore: persist mode state

* feat: implement order breadcrumbs

* chore: upgrade to better auth 1.4

* chore: address common auth flow bugs and setup app for others to setup locally.
2025-11-24 01:00:50 +01:00
Rotimi Bestandtunny17 f5a4156c8b feat: migrate dashboard to svelte 5 (#577)
* chore: migration to SvelteKit 2

* stage 1: migrate to svelte 5 and fix rerendering issues

* stage 2: fix more $: reactivity across dashboard

* fix merge conflicts

* chore: migrate code in main to svelte 5

* chore: update preventDefault

* chore: simplify tsconfig and remove unused mobileMenuRef in MobileMenu.svelte

* chore: enforce .ts across dashboard

* rename from classroomio-com to website

* stage-3: Replace carbon icon svelte with lucide icon

* update lock file

* chore: finish icon replacement

* fix: settings and setup page multiple rerender

* stage 3: More icon and rerendering fixes

* feat: checkpoint

* feat: update editor

* [not working] connect everything with ui build

* storybook + ui + dashboard all working independently

* add bg-black to +page.svelte

* feat: add editor to storybook

* chore: animate lucid icons (#590)

* v1 animations

* feat: change some course navigation icons & animate org navigation icons

* chore: change settings icon

* chore: use css instead of js for hover

* rename animations

---------

Co-authored-by: tunny17 <[email protected]>

* chore: update path to node_modules types in api tsconfig

* fix: update import path for DropdownMenu component

* fix: add rollupOptions to build configuration in vite.config.ts

* fix: remove rollupOptions from build configuration and add @floating-ui/dom dependency

* install

---------

Co-authored-by: tunny17 <[email protected]>
2025-11-01 16:18:29 +01:00
Rotimi Best b96d91cd7c feat: setup drizzle (#594)
* chore: migration to SvelteKit 2

* stage 1: migrate to svelte 5 and fix rerendering issues

* stage 2: fix more $: reactivity across dashboard

* fix merge conflicts

* chore: migrate code in main to svelte 5

* chore: update preventDefault

* chore: simplify tsconfig and remove unused mobileMenuRef in MobileMenu.svelte

* chore: enforce .ts across dashboard

* rename from classroomio-com to website

* stage-3: Replace carbon icon svelte with lucide icon

* update lock file

* chore: finish icon replacement

* fix: settings and setup page multiple rerender

* stage 3: More icon and rerendering fixes

* feat: setup drizzle and better auth

* fix: onboarding validation error showing translation key #586 (#593)

* fix: onboarding validation error showing translation key #586

* fix: remove debug log for profile update errors

* chore: add a clean command

* fix: remove message from email verification response
2025-11-01 15:49:29 +01:00
Rotimi Best 9a7018eb34 chore: remove unused dependencies 2025-10-04 11:01:22 +01:00
Rotimi Best fd2e3f5d76 chore: clean up environment variable usage and formatting in configuration files
- Updated docker-compose.yaml to use double quotes for version and port mappings.
- Removed DEPLOYMENT_PROVIDER from global environment variables in turbo.json and Dockerfile.
- Adjusted dashboard build command in package.json to remove DEPLOYMENT_PROVIDER.
- Cleaned up .env.example by removing the DEPLOYMENT_PROVIDER comment.
- Simplified SvelteKit adapter condition in svelte.config.js.
2025-10-04 08:13:01 +01:00
Rotimi Best 9055c45384 chore: move IS_SELFHOSTED to public env 2025-09-07 10:24:34 +01:00
Rotimi Best f8852ad34b chore: use vercel adapter in dashboard 2025-05-03 15:26:10 +01:00
Rotimi Best 91bd9d4414 docs: self-hosting guide v1 (#481)
* feat: selfhosting guide v1 #238

* use public env on frontend

* add docker desclaimer
2024-09-30 01:20:19 +01:00
Rotimi Best b203188091 chore: use package.json commands to build railway 2024-09-29 05:35:05 +01:00
Rotimi Best bd76342f0e chore: add new env DEPLOYMENT_PROVIDER 2024-09-27 02:50:27 +01:00
Rotimi Best 877b514a7b chore: minimize build output 2024-09-23 01:21:05 +01:00
Rotimi Best 786308ec82 feat: deploy to cloudflare (#365)
* chore: deploy to cf

* add wrangler.toml file

* update pnpm-lock

* set pnpm version

* use adapter auto
2024-06-17 00:45:51 +01:00
Rotimi Best 60ea5fb00a chore: rename 'nodemailer' to 'mail' 2024-04-12 05:37:50 +01:00
Em_DevandRotimi Best 3fe15e6633 feat: remove defer (#243)
* working on moving the email logic to the backend

* Moved nodemailer to the backend

* uninstall defer

* updated relative import path in tsconfig

* working on the zod validation

* Merge branch 'main' into send-email

* fixed the zod import issue

* fixed the zod import issue

* updated the env example files

* docs: update README.md (#249)

* fix: handle catex error

* chore: remove fly.io github action

* Update README.md

Updated the Readme to reflect changes made to the emailing flow

---------

Co-authored-by: Rotimi Best <[email protected]>

* chore: wrapp up email sending

---------

Co-authored-by: Rotimi Best <[email protected]>
2024-04-12 04:57:19 +01:00
Rotimi Best ff524fca27 feat: move all email to defer queue #185
fix: use relative part for defer func #185

chore: move sendEmail into defer

fix: remove anon function to defer #185

feat: implement batch email sending with defer.run #185

chore: debug sendEmails #185

chore: add robots.txt

chore: use promise.all in sendEmails

chore: debug defer sendEmails #185

chore: try defer sendEmail without loop #105

chore: comment code

chore: change loop style #185

chore: use promise.all for vercel edge #185

feat: add await to sendEmailNotification #185

chore: use sendEmails #185

fix: debug sendEmails #185

fix: email not updating in LMS

fix: remove early return in sendEmails #185
2024-03-01 14:10:40 +01:00
Rotimi Best 41e29014ef feat: 🚀 😃 convert repo into a monorepo 🚀 😃 (#51)
* Merge main into turbo-monrepo

* feat: rename apps

* feat: remove supbase videos and serve all from project

* feat: move supabase to root

* feat: update README

* docs: update link
2023-11-25 21:56:02 +00:00