a2nr
/
elemes
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
elemes/requirements.txt

15 lines
249 B
Plaintext
Raw Permalink Normal View History

init
2026-01-02 06:18:48 +07:00
Flask==2.3.3
markdown==3.5
update example
2026-01-06 21:38:54 +07:00
gunicorn==21.2.0
refactor to make it better
2026-03-25 09:39:51 +07:00
flask-cors==4.0.0
security: implement gVisor sandboxing and harden API endpoints - Menambahkan service 'compiler-worker' terpisah untuk isolasi eksekusi kode C/Python. - Mengintegrasikan gVisor (runsc) pada worker untuk mencegah RCE pada level kernel. - Menggunakan Gunicorn (4 workers) pada compiler-worker untuk mendukung concurrency. - Menambahkan otentikasi token wajib pada endpoint /compile dan laporan progres. - Memperketat CORS policy menggunakan environment variable ORIGIN. - Menerapkan secure_filename pada rute pelajaran untuk mencegah Path Traversal. - Mengubah volume mounting backend utama menjadi Read-Only (:ro) untuk perlindungan data. - Memperbarui proposal.md dan .env.example dengan standar keamanan terbaru.
2026-04-21 15:13:16 +07:00
python-dotenv==1.0.0
feat(security): implement anonymous access with rate limiting and secure proxy, harden authentication and implement session protection Implements multiple layers of security to address high-risk session and authentication vulnerabilities identified in the security review: - Allow code compilation (C, Python, Arduino) for anonymous users. - Enforce a 1-request-per-2-minutes rate limit for anonymous IPs. - Implement a global anonymous compilation queue with 20 concurrent slots. - Proxy Velxio (Arduino) compilation through Flask to prevent API hijacking. - Exempt authenticated users (tokens/cookies) from all rate limits. - Fix networking and DNS resolution in podman-compose. - Fix Svelte a11y warnings and trailing slash routing issues. - Cookie Security: Added dynamic 'secure' flag support via COOKIE_SECURE env variable for HTTPS/Tailscale Funnel compatibility. - Rate Limiting: Integrated Flask-Limiter on /login (50 req/min) to prevent API abuse while accommodating shared school networks (NAT). - Tarpitting: Added 1.5s artificial delay on failed logins to neutralize automated brute-force tools without blocking legitimate users. - Session Invalidation: Implemented an in-memory token blacklist on logout to ensure session tokens cannot be reused. - Documentation: Updated technical docs and proposal status to reflect the current security architecture. Ref: @elemes/proposal.md (Poin 6.1, 6.2, 6.3)
2026-04-22 12:57:54 +07:00
requests==2.31.0
feat: implement LaTeX support with KaTeX and python-markdown-math 3 - Integration of KaTeX in frontend (SvelteKit) with a custom renderMath` action. - Added `python-markdown-math` extension in backend (Flask). to handle math blocks. - Configured Vite to handle KaTeX during SSR and browser rendering. - Added a LaTeX test lesson and updated home navigation. - Supported both inline ($) and block ($$) math rendering, including multi-line support.
2026-04-26 15:47:11 +07:00
flask-limiter==3.5.0
feat(embed): add raw HTML embed fence with bleach sanitization - Add embed markdown fence: user pastes raw embed HTML code (from Canva/YouTube/Google Docs Share→Embed) into lesson markdown and slide content. Backend sanitizes via bleach (whitelist tags/attrs/styles) + checks iframe src against domain blacklist (SSRF prevention). Frontend renders iframe directly — no lazy action needed. - Backend: _process_embed_embeds + _sanitize_embed_html in lesson_service.py, applied to lesson_content, exercise, lesson_info, and slide loop. Graceful fallback if tinycss2 missing (CSS unsanitized but tags/attrs still stripped). - Tests: 9 pytest cases (Canva/YouTube HTML, script stripping, onclick stripping, blocked domain, non-https iframe, empty, unchanged, dangerous style). - Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed CSS (URL-only approach from earlier iteration, superseded). Keep .embed-error CSS for error messages. - Example: update test_slides.md with raw HTML Canva embed (slide) + YouTube embed (body). - Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt. - Docs: consolidate 4 plan files into docs/06-embed-content.md.
2026-07-19 15:39:38 +07:00
python-markdown-math==0.8
bleach>=6.0.0
refactor(quiz): restructure quiz session, question view, and tab safety Restructure quiz flow into QuizSession primitive + atomic quiz state in LessonManager, and extract QuizQuestionView for split-view display. Tab-safety fix: add lesson-tabs.ts with pickDefaultTab(), getAvailableTabs() mirroring the exact {#if} conditions in +page.svelte, and ensureActiveTab() safety-net that falls back to pickDefaultTab() when the desired tab is not rendered. A reactive $effect in lesson/[slug]/+page.svelte validates activeTab against lesson data on every change, preventing the "tab quiz kosong" (empty workspace) regression for quiz-only lessons and phantom-tab state after data changes. Files: - lib/services/lesson-tabs.ts (+test): pure helpers, 18 tests pass - lesson/[slug]/+page.svelte: ensureActiveTab reactive guard + QuizQuestionView - lesson/[slug]/lesson.svelte.ts: atomic startQuiz, getExitStatus, idempotent submit on navigate/exit - lib/services/quiz-session.ts (+test), lib/types/quiz.ts, QuizTab.svelte (mgr-driven), QuizQuestionView.svelte, lesson.css - services/lesson_service.py, services/tests/test_lesson_service_quiz.py (test_lesson_service_quiz.py), requirements.txt (+pytest) - docs/07-quiz-authoring.md - version.ts APP_VERSION 21 -> 22 (forces SW update for the fix) - examples/content/dasar/quiz_test.md synced to live content root
2026-08-01 00:14:29 +07:00
tinycss2>=1.2.0
feat(storage): migrasi penyimpanan CSV ke PostgreSQL (SQLAlchemy + Alembic) - facade storage: csv_backend + postgres_backend, dipilih via STORAGE_BACKEND - token disimpan sebagai HMAC-SHA256 digest (TOKEN_PEPPER), tanpa plaintext - schema alembic 0001: users, access_tokens, lessons, student_progress - importer CSV idempotent + dry-run + sparse model (not_started tanpa row) - lesson registry: sync dari home.md (lesson hilang di-deactivate, bukan dihapus) - routes progress/auth: report & reset via DB, validasi via token hash - elemes.sh: dbupgrade/dbstatus/dbimport/synclessons/dbverify/dbbackup/dbrestore/dbexport - podman-compose: service postgres (PG18), tokens_siswa.csv mount :ro - frontend: api client + progress page; tests kontrak dual-backend + isolasi DB - load-test: skenario database (locustfile_db.py) - docs: 01-11 termasuk 11-database-migration.md (arsitektur & operasional)
2026-08-08 11:57:08 +07:00
pytest==7.4.4
SQLAlchemy==2.0.51
alembic==1.19.0
psycopg[binary]==3.3.4