- {#if docError}
+ {#if apiRefMode}
+ {#if apiRefError}
+ Gagal memuat API Reference.
+ {:else if !apiRefEntries}
+ Memuat API Reference…
+ {:else}
+
+ API Reference
+
+ Daftar endpoint Flask yang terdaftar ({apiRefEntries.length} endpoint).
+
+
+ {#each apiRefEntries as entry (entry.path + entry.method.join(','))}
+
+
+ {#if entry.doc}
+ {entry.doc}
+ {/if}
+
+ {/each}
+
Gagal memuat dokumen.
{:else if !docContent}
Pilih dokumen dari sidebar untuk memulai.
@@ -134,6 +201,11 @@
border-left: 3px solid var(--color-accent, #2563eb);
}
+ .docs-nav .api-ref-entry {
+ border-bottom: 1px solid var(--color-border);
+ margin-bottom: 0.5rem;
+ }
+
.doc-order {
font-size: 0.7rem;
color: var(--color-text-muted, #888);
@@ -173,6 +245,90 @@
color: var(--color-text-muted, #888);
}
+ /* ── API Reference ─────────────────────────────────────────── */
+
+ .api-ref {
+ max-width: 860px;
+ }
+
+ .api-ref h1 {
+ font-size: 2rem;
+ margin-bottom: 0.25rem;
+ border-bottom: 1px solid var(--color-border);
+ padding-bottom: 0.5rem;
+ }
+
+ .api-ref-subtitle {
+ color: var(--color-text-muted, #888);
+ margin: 0.5rem 0 1.5rem;
+ }
+
+ .api-ref-list {
+ display: flex;
+ flex-direction: column;
+ gap: 0.75rem;
+ }
+
+ .endpoint {
+ border: 1px solid var(--color-border);
+ border-radius: var(--radius, 6px);
+ padding: 0.75rem 1rem;
+ }
+
+ .endpoint-header {
+ display: flex;
+ align-items: center;
+ flex-wrap: wrap;
+ gap: 0.5rem;
+ }
+
+ .endpoint-methods {
+ display: flex;
+ gap: 0.25rem;
+ }
+
+ .method {
+ font-size: 0.7rem;
+ font-weight: 700;
+ padding: 0.15rem 0.45rem;
+ border-radius: 4px;
+ letter-spacing: 0.03em;
+ }
+
+ .method-get { background: #e6f4ea; color: #137333; }
+ .method-post { background: #e8f0fe; color: #1a73e8; }
+ .method-put { background: #fef7e0; color: #b06000; }
+ .method-patch { background: #f3e8fd; color: #7627bb; }
+ .method-delete { background: #fce8e6; color: #c5221f; }
+
+ .endpoint-path {
+ font-size: 0.9rem;
+ font-weight: 600;
+ color: var(--color-text);
+ word-break: break-all;
+ }
+
+ .endpoint-auth {
+ margin-left: auto;
+ font-size: 0.7rem;
+ padding: 0.15rem 0.5rem;
+ border-radius: 999px;
+ background: #e6f4ea;
+ color: #137333;
+ }
+
+ .endpoint-auth.auth-required {
+ background: #fce8e6;
+ color: #c5221f;
+ }
+
+ .endpoint-doc {
+ margin: 0.5rem 0 0;
+ font-size: 0.85rem;
+ color: var(--color-text-muted, #555);
+ white-space: pre-wrap;
+ }
+
@media (max-width: 768px) {
.docs-layout {
flex-direction: column;
diff --git a/routes/docs.py b/routes/docs.py
index 7098b05..5cea7ab 100644
--- a/routes/docs.py
+++ b/routes/docs.py
@@ -9,7 +9,7 @@ Endpoints:
import re
-from flask import Blueprint, jsonify
+from flask import Blueprint, current_app, jsonify
from services.docs_service import get_docs_index, get_doc_content
@@ -40,33 +40,12 @@ def api_reference():
them as structured API reference entries.
Each entry: {method, path, name, auth, doc}
+
+ Uses ``current_app`` (bukan ``create_app()``) agar tidak membuat instance
+ app baru / memicu DB sync ulang pada setiap request.
"""
- from app import create_app
-
- app = create_app()
entries = []
- # Import all route modules to capture docstrings
- route_modules = [
- "routes.auth",
- "routes.compile",
- "routes.lessons",
- "routes.progress",
- "routes.help",
- "routes.student_management",
- "routes.quiz_attempts",
- "routes.docs",
- ]
-
- # Build a map of rule -> endpoint function for docstring extraction
- rule_map = {}
- for rule in app.url_map.iter_rules():
- if rule.endpoint != "static" and rule.endpoint != "api_reference":
- rule_map[rule.rule] = {
- "methods": sorted(rule.methods - {"HEAD", "OPTIONS"}),
- "endpoint": rule.endpoint,
- }
-
# Known auth requirements per route (derived from code inspection)
auth_map = {
"/login": False,
@@ -100,7 +79,7 @@ def api_reference():
# Extract from Flask view functions directly
seen = set()
- for rule in app.url_map.iter_rules():
+ for rule in current_app.url_map.iter_rules():
if rule.endpoint == "static":
continue
path = rule.rule
@@ -111,7 +90,7 @@ def api_reference():
methods = sorted(rule.methods - {"HEAD", "OPTIONS"})
# Try to get the view function's docstring
- view_func = app.view_functions.get(rule.endpoint)
+ view_func = current_app.view_functions.get(rule.endpoint)
doc = ""
if view_func:
doc = (view_func.__doc__ or "").strip()
diff --git a/services/docs_service.py b/services/docs_service.py
index 433cf17..1ec37e9 100644
--- a/services/docs_service.py
+++ b/services/docs_service.py
@@ -61,12 +61,12 @@ def _parse_frontmatter(filename):
if not abs_path.startswith(_DOCS_DIR + os.sep) and abs_path != _DOCS_DIR:
return None
+ current_mtime = os.path.getmtime(file_path) if os.path.exists(file_path) else None
+
with _file_cache_lock:
cached = _file_cache.get(abs_path)
- if cached and cached.get("mtime") == os.path.getmtime(file_path) if os.path.exists(file_path) else False:
- cached_mtime = os.path.getmtime(file_path)
- if cached and cached.get("mtime") == cached_mtime:
- return cached["data"]
+ if cached and current_mtime is not None and cached.get("mtime") == current_mtime:
+ return cached["data"]
if not os.path.exists(file_path):
return None
@@ -78,7 +78,6 @@ def _parse_frontmatter(filename):
print(f"Warning: Could not read {file_path}: {e}")
return None
- current_mtime = os.path.getmtime(file_path)
# Parse frontmatter
title = None
@@ -134,35 +133,6 @@ def _parse_frontmatter(filename):
return result
-def _read_md_cached(path):
- """Read any markdown file with mtime-based caching (mirrors lesson_service pattern)."""
- if not os.path.exists(path):
- return ""
- try:
- current_mtime = os.path.getmtime(path)
- except OSError:
- cached = _file_cache.get(path)
- return (cached["content"] if cached else "") or ""
-
- with _file_cache_lock:
- cached = _file_cache.get(path)
- if cached and cached.get("mtime") == current_mtime:
- return cached["content"]
-
- try:
- with open(path, "r", encoding="utf-8") as f:
- content = f.read()
- except (OSError, PermissionError) as e:
- print(f"Warning: Could not read {path}: {e}")
- cached = _file_cache.get(path)
- return (cached["content"] if cached else "") or ""
-
- with _file_cache_lock:
- _file_cache[path] = {"content": content, "mtime": current_mtime}
-
- return content
-
-
# ---------------------------------------------------------------------------
# Docs index (list all docs files, sorted by order)
# ---------------------------------------------------------------------------
diff --git a/services/lesson_service.py b/services/lesson_service.py
index b43a4b7..8b50b83 100644
--- a/services/lesson_service.py
+++ b/services/lesson_service.py
@@ -640,25 +640,20 @@ def _process_flowchart_embeds(text):
def _sanitize_embed_html(html_text):
"""Sanitize raw embed HTML: whitelist tags/attrs/styles + check iframe src domain."""
- cleaned = bleach.clean(
- html_text,
- tags=EMBED_ALLOWED_TAGS,
- attributes=EMBED_ALLOWED_ATTRS,
- strip=True,
- )
- # Optional CSS sanitization — requires tinycss2 (skip if not installed)
+ # CSS sanitization requires tinycss2 — bila tidak ada, style dipertahankan
+ # tanpa disanitasi (tags/attrs tetap di-strip). Jangan pernah pass
+ # css_sanitizer=None bersamaan dengan atribut `style` — bleach mengeluarkan
+ # NoCssSanitizerWarning.
try:
from bleach.css_sanitizer import CSSSanitizer
css_sanitizer = CSSSanitizer(allowed_css_properties=EMBED_ALLOWED_STYLES)
- cleaned = bleach.clean(
- html_text,
- tags=EMBED_ALLOWED_TAGS,
- attributes=EMBED_ALLOWED_ATTRS,
- css_sanitizer=css_sanitizer,
- strip=True,
- )
except ImportError:
- pass # tinycss2 missing — CSS styles left unsanitized but tags/attrs still stripped
+ css_sanitizer = None
+
+ kwargs = dict(tags=EMBED_ALLOWED_TAGS, attributes=EMBED_ALLOWED_ATTRS, strip=True)
+ if css_sanitizer is not None:
+ kwargs["css_sanitizer"] = css_sanitizer
+ cleaned = bleach.clean(html_text, **kwargs)
# Check every iframe src: must be https + not blacklisted
for match in re.finditer(r']+src="([^"]*)"', cleaned):
src = match.group(1)
diff --git a/services/tests/conftest.py b/services/tests/conftest.py
index 8830730..b8535b3 100644
--- a/services/tests/conftest.py
+++ b/services/tests/conftest.py
@@ -78,14 +78,22 @@ def seed_demo_users():
@pytest.fixture(autouse=True)
-def _isolate_database():
+def _isolate_database(request):
"""Isolasi integration test: truncate semua tabel sebelum SETIAP test.
Test importer/lesson-registry/progress berbagi DATABASE_URL yang sama;
tanpa reset, data sisa antar test saling mengotori (mis. total lessons
bertambah). Contract test (backend CSV) tidak terpengaruh — SessionLocal
None bila DATABASE_URL tidak diset.
+
+ Test bertanda `unit` tidak pernah menyentuh DB — lewati isolasi sepenuhnya
+ supaya `make test-unit` tetap jalan cepat & tanpa DB walau DATABASE_URL
+ diset di environment (atau server PostgreSQL sedang mati).
"""
+ if request.node.get_closest_marker("unit") is not None:
+ yield
+ return
+
from sqlalchemy import text
from services.database import SessionLocal
diff --git a/services/tests/test_teacher_bootstrap.py b/services/tests/test_teacher_bootstrap.py
index 08a4ab7..1eb870f 100644
--- a/services/tests/test_teacher_bootstrap.py
+++ b/services/tests/test_teacher_bootstrap.py
@@ -28,21 +28,26 @@ CLI = REPO_ROOT / "scripts" / "bootstrap_teacher.py"
# ── unit: validasi (tanpa DB) ────────────────────────────────────────────
+
+@pytest.mark.unit
def test_validation_empty_name():
with pytest.raises(TeacherBootstrapError, match="Nama guru"):
upsert_teacher(None, display_name=" ", raw_token="TOKEN_X")
+@pytest.mark.unit
def test_validation_empty_token():
with pytest.raises(TeacherBootstrapError, match="Token guru"):
upsert_teacher(None, display_name="Pak Guru", raw_token="")
+@pytest.mark.unit
def test_validation_name_too_long():
with pytest.raises(TeacherBootstrapError, match="terlalu panjang"):
upsert_teacher(None, display_name="G" * 256, raw_token="TOKEN_X")
+@pytest.mark.unit
def test_cli_exit_2_without_database():
"""Tanpa DATABASE_URL, CLI harus gagal dengan exit code 2 (bukan crash)."""
env = os.environ.copy()