a2nr
|
ac37db5c91
|
feat(storage): migrasi penyimpanan CSV ke PostgreSQL (SQLAlchemy + Alembic)
- facade storage: csv_backend + postgres_backend, dipilih via STORAGE_BACKEND
- token disimpan sebagai HMAC-SHA256 digest (TOKEN_PEPPER), tanpa plaintext
- schema alembic 0001: users, access_tokens, lessons, student_progress
- importer CSV idempotent + dry-run + sparse model (not_started tanpa row)
- lesson registry: sync dari home.md (lesson hilang di-deactivate, bukan dihapus)
- routes progress/auth: report & reset via DB, validasi via token hash
- elemes.sh: dbupgrade/dbstatus/dbimport/synclessons/dbverify/dbbackup/dbrestore/dbexport
- podman-compose: service postgres (PG18), tokens_siswa.csv mount :ro
- frontend: api client + progress page; tests kontrak dual-backend + isolasi DB
- load-test: skenario database (locustfile_db.py)
- docs: 01-11 termasuk 11-database-migration.md (arsitektur & operasional)
|
2026-08-08 04:57:08 +00:00 |
 a2nr
|
2a09ee77ab
|
feat(embed): add raw HTML embed fence with bleach sanitization
- Add embed markdown fence: user pastes raw embed HTML code
(from Canva/YouTube/Google Docs Share→Embed) into lesson markdown
and slide content. Backend sanitizes via bleach (whitelist
tags/attrs/styles) + checks iframe src against domain blacklist
(SSRF prevention). Frontend renders iframe directly — no lazy
action needed.
- Backend: _process_embed_embeds + _sanitize_embed_html in
lesson_service.py, applied to lesson_content, exercise,
lesson_info, and slide loop. Graceful fallback if tinycss2
missing (CSS unsanitized but tags/attrs still stripped).
- Tests: 9 pytest cases (Canva/YouTube HTML, script stripping,
onclick stripping, blocked domain, non-https iframe, empty,
unchanged, dangerous style).
- Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed
CSS (URL-only approach from earlier iteration, superseded).
Keep .embed-error CSS for error messages.
- Example: update test_slides.md with raw HTML Canva embed (slide)
+ YouTube embed (body).
- Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt.
- Docs: consolidate 4 plan files into docs/06-embed-content.md.
|
2026-07-19 15:39:38 +07:00 |