Hasil review pasca-fix upload asset:
Keamanan:
- Mitigasi stored-XSS via SVG (route /assets/* publik, same-origin):
CSP 'default-src none; sandbox' saat serve SVG — di backend
(send_assets) DAN di proxy SvelteKit (proxy hanya meneruskan
content-type/set-cookie, jadi CSP backend tak sampai ke browser).
- Deteksi 413 proxy kini ber-test status code + pesan.
Testing:
- Regression guard: error jaringan biasa tetap 502, bukan 413.
- 413 via status code saja (tanpa regex pesan) tetap 413.
- Boundary 5 MiB: file TEPAT 5 MiB lolos; 5 MiB+1 ditolak (cabang
len(raw) — SVG dipakai karena dikecualikan validasi PIL).
- CSP: SVG dapat header, raster tidak.
- E2E script (verify_asset_upload.py) memakai file asli
mr-edu/assets/ilustrasi_beban.jpeg + test 413 terintegrasi.
Reuseability:
- Komentar silang-referensi _MAX_ASSET_BYTES (sumber) dengan pesan 413
proxy dan BODY_SIZE_LIMIT compose.
- Optimize N+1 queries in get_all_students_progress via bulk fetch
- Backfill legacy progress in migration 0005 and startup sync
- Use arrayBuffer in hooks.server proxy for binary payload safety
- Restrict postMessage targetOrigin from wildcard to window.location.origin
- Harden iframe polling in TeacherVelxioEditor and reduce frequency
- Improve markdown section extractor line-boundary detection
- Clean up child subprocesses on exception in CLI runner
- Add console.error in contentEditor catch blocks and parameterize repro script
- Configure sequential vitest execution to optimize test runs
- Modularize orchestrator into Python modules under cli/ (config, runner, commands, tui)
- Introduce interactive Rich-based TUI with live container status, focused description panel, and arrow navigation
- Add multi-OS launcher wrappers: elemes.sh (Unix), elemes.bat (Windows CMD), elemes.ps1 (PowerShell), elemes.py
- Default isolated virtualenv to parent folder (../venv) to keep repository clean
- Add stopclean command for compose down with container & image pruning
- Fix submenu navigation when pressing ENTER on Kembali and Keluar
- Prevent keystroke bleeding across subprocess executions with DEVNULL stdin and tcflush
- Add unit test suite (make test-cli) covering 27 isolated CLI/TUI tests
- Maintain 100% backward compatibility with existing elemes.sh commands and shell regression tests
_scan_quiz_issues.py: cari soal MCQ dengan <2 opsi (ter-split).
repro_quiz_options.py: navigasi quiz di browser, assert jumlah opsi DOM
vs server quiz_data.
- Mengganti sanitizer manual dengan isomorphic-dompurify dan hook whitelist/blocklist (BF-01 & BF-02)
- Memperbaiki parsing penjelasan flashcard non-MCQ agar mencari blockquote di seluruh body (BF-03)
- Menambahkan node-polyfill.cjs dan konfigurasi NODE_OPTIONS untuk mengatasi incompatibilitas worker_threads.markAsUncloneable pada Node 20 runtime (SSR blank screen fix)
- Menambahkan unit test keamanan embed (BF-04) dan parity tests dengan fixture backend (BF-05)
- Mendokumentasikan deduplikasi quiz tab pada detectActiveTabs (BF-06)
a2nr
a2nr