 a2nr
|
9ee92cfaaf
|
feat(teacher): manajemen akun guru canonical + first-run otomatis; cabut backend CSV (PG only)
- feat: ./elemes.sh teacher — upsert satu akun guru canonical (prompt nama default TEACHER_NAME, token tersembunyi via stdin, rotasi token saat guru sudah ada, idempotent); TEACHER_NAME/TEACHER_TOKEN di .env
- feat: first-run otomatis — db_init jalankan alembic upgrade head + bootstrap guru bila TEACHER_TOKEN terisi (run/runbuild/runclearbuild)
- refactor: backend CSV dicabut penuh — hapus mount tokens_siswa.csv, TOKENS_FILE, STORAGE_BACKEND=csv, csv_backend.py, csv_importer.py, generate_tokens.py, script migrate/verify/export CSV, command generatetoken/dbimport/dbverify/dbexport/synclessons; storage fail-loud postgresql-only
- fix: dbrestore gagal diam-diam saat restore ke DB berisi data (dump tanpa --clean) — dbbackup kini --clean --if-exists + dbrestore reset schema public; roundtrip terverifikasi
- test: suite kontrak PG-native + route auth/progress integrasi PG; 183 passed container, 96 passed host, frontend 91 passed
- docs: README, documentation.md, docs/01/02/11, load-test/README disinkronkan ke realita PostgreSQL-only; proposal.md dipertahankan (historis)
- chore: load-test token sintetis di-seed ke PG (content_parser), config.py bersih TOKENS_FILE, .dockerignore/.gitignore dibersihkan
|
2026-08-09 11:21:08 +07:00 |
|
a2nr
|
2a09ee77ab
|
feat(embed): add raw HTML embed fence with bleach sanitization
- Add embed markdown fence: user pastes raw embed HTML code
(from Canva/YouTube/Google Docs Share→Embed) into lesson markdown
and slide content. Backend sanitizes via bleach (whitelist
tags/attrs/styles) + checks iframe src against domain blacklist
(SSRF prevention). Frontend renders iframe directly — no lazy
action needed.
- Backend: _process_embed_embeds + _sanitize_embed_html in
lesson_service.py, applied to lesson_content, exercise,
lesson_info, and slide loop. Graceful fallback if tinycss2
missing (CSS unsanitized but tags/attrs still stripped).
- Tests: 9 pytest cases (Canva/YouTube HTML, script stripping,
onclick stripping, blocked domain, non-https iframe, empty,
unchanged, dangerous style).
- Frontend: remove renderEmbedEmbeds.ts + wire-up + .generic-embed
CSS (URL-only approach from earlier iteration, superseded).
Keep .embed-error CSS for error messages.
- Example: update test_slides.md with raw HTML Canva embed (slide)
+ YouTube embed (body).
- Deps: bleach>=6.0.0, tinycss2>=1.2.0 in requirements.txt.
- Docs: consolidate 4 plan files into docs/06-embed-content.md.
|
2026-07-19 15:39:38 +07:00 |