Spaces:
Runtime error
Runtime error
Commit History
-
✨ Dashboard for all teachers (own-data scoped) + fix report IDOR
chih.yikuan +1: Claude Opus 4.8 (1M context)- Dashboard (後台) now open to every logged-in teacher; non-admins see ONLY their own quizzes/students/results. Admins still see everything. - Server-enforced scoping: get_stats/admin_list_sessions/admin_list_students take an optional teacher_id; detail+delete endpoints verify ownership (_owns_quiz/_owns_student) → 404 cross-teacher. User-management stays admin-only (403 for non-admins). - Frontend: dashboard button shown to all (我的資料 vs 管理後台); teachers tab, admin cards, schema version, and delete hidden for non-admins (cosmetic; server is source of truth). - SECURITY FIX (pre-existing): GET /api/reports/{id} had no ownership check — any teacher could read any report by id. Now enforced via parent quiz. - Defense-in-depth: get_student_timeline / get_quiz_results now filter by the owning teacher so authorization no longer relies on a write-time invariant. - Tests: scoping test added (83 pass). Reviewed adversarially (1 blocker fixed). Co-Authored-By: Claude Opus 4.8 (1M c…3ee2df6
-
Add database management: Supabase persistence, teacher profiles, admin dashboard (#1)
- ✨ Add database management: Supabase persistence, teacher profiles, admin dashboard (9f97e2888339dd0323b003479f8691cbcf0ea052) - 🐳 Bump frontend builder to node:22-slim for Vite 7 (>=20.19/22.12 required) (c7044b0c28cc90bebd5f45e00831a4cf5ca1accb) - 🛡️ Fail loud on misconfigured prod DB; Dockerfile migrate && serve (c43fd58ec8aff83b88ef376511e291a963d246a8)4c4a722
