| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Add Folders & Media library, drop Collections, configurable public menu Replaces the flat Collections grouping with a Drive-like library: nested folders that hold courses plus references to podcasts, communities, boards, playgrounds and a new Media resource (uploaded files or embeds). Root behaves like Drive too — loose content sits alongside folders. Backend - New folder, foldercontent and media tables (+ Alembic migration) and a migration that drops collection / collectioncourse. - Folders & media wired into the config-driven RBAC layer, so public flag, authorship, admin role and usergroup membership all gate them with no per-resource code. - Whole-tree library search with folder-path context; item counts on folders. - Media uploads now accept MS Office (docx/xlsx/pptx + legacy doc/xls/ppt) and zip alongside images/video/audio/pdf. All validated by magic bytes, with a zip-bomb guard, SVG still blocked, and the stored extension derived from the validated content type rather than the client filename. - Org config gains a menu section with its own PUT endpoint. Frontend - Library section on the dashboard and a read-only public /library, sharing the same folder/course/media cards. Manage-access popover on folders and course cards, folder colour + cover customisation, share links. - Media previews everywhere: og:image (via link-preview) then screenshot for embeds, first-page render for PDFs, first frame for video, the image itself for images. - New "Menu" tab in org settings to toggle, reorder, rename and add public nav links, with a Phosphor icon picker for custom links and plan/feature gating shown inline. Removed the org-settings Features tab and every link to it; features are now plan-driven only. | 2 个月前 | |
feat: add analytics feature | 7 个月前 | |
fix: high-severity bug fixes + backend security hardening Backend security (broken access control / IDOR): cross-org create checks for usergroups/courses/podcasts/boards, usergroup member validation, MagicBlocks authz + session ownership, RAG chat ownership, chapter mass-assignment relocation, reorder cross-org grafting, student self-grading + assignment due-date, org Explore field lockdown, collection same-org links, trail read-access, content_files default-deny. Backend security (injection/file/config): RAG arbitrary file read, import manifest traversal, upload_sqlite traversal, upload type-from-content, CSV formula injection (org+analytics exports), magic-link open redirect, email/CORS host pinning, CSRF fullmatch + dev fail-open, JWT purpose confusion, playground org resolution. Backend bugs: await on 2 broken AI endpoints, AI credit refunds on failure, cookie max_age fix, third_party_login guard, credit summary extra_limit, admin_seats purchased seats, trail step serialization, certificate completion count, upvote race, webhook log prune, join_org transaction. Frontend bugs: fetch-race guards, DOMPurify hook leak, stable useDebounce, useOnboarding persistence, OAuth login route, CourseProgress null-guards, AuthContext stale closure + token refresh, AIChatBot reducer payload, contributor id normalization. Verification: backend 2529 tests pass, app boots; frontend tsc clean. Tests updated to assert new behavior. | 3 个月前 | |
fix(web): make next-lint pass on changed files Add argsIgnorePattern/varsIgnorePattern/caughtErrorsIgnorePattern '^_' to no-unused-vars (core rule from js.configs.recommended had no _-ignore, so it flagged underscore-prefixed type-signature params). Remove dead progress-circle vars in CourseProgress and use 'as Function' cast in useDebounce. Verified 0 eslint errors locally with eslint 9.39.4 (CI version) and 0 new tsc errors. | 3 个月前 | |
feat(web): add PostHog product analytics + learnhouse-analytics event layer Adds PostHog to the web frontend behind a single opt-in env var (NEXT_PUBLIC_POSTHOG_KEY — absent = fully off). Session replay with masked inputs/text, reverse-proxied via /ingest so adblockers can't strip it (works on custom domains too). - New services/analytics mini-lib: one typed useLHAnalytics().track() that fans out to PostHog and the existing backend analytics hook, with auto-injected standard props (org, plan, surface, locale, role, membership) and central identify/group/reset wired across all auth paths via a session watcher. - Instrument ~140 explicit product events across every feature area (auth, courses, activities, communities, podcasts, playgrounds, boards, library, search/copilot, store/checkout, course-mgmt, editor, assignments, org settings, billing/upgrade, admin, navigation), including impression and drop-off funnel events. - Remove Umami (layout script, /umami proxy rewrites, telemetry getter). - Declare @codemirror/language as a direct dependency (it is imported directly and was relying on transitive resolution). | 2 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 个月前 | ||
| 7 个月前 | ||
| 3 个月前 | ||
| 3 个月前 | ||
| 2 个月前 |