mathly2: written work, rounds, caching, one course for all classes, lesson schedule

docs/tasks/prd-mathly.md

@@ -18,7 +18,7 @@ The app has five roles (see 4.1):
   Students can also get help with a photographed problem and have handwritten answers checked, always through their teacher.
 - **Teachers** give and check assignments, set tests, review the AI's checks of their students' work, and see the
   progress of the classes they teach, per skill and per lesson.
-- **Managers** create the classes: name, lessons, teacher and students.
+- **Managers** create the classes: name, teacher and students.
 - **Admins** give roles to accounts.
 - **Developers** (the app's operators) have every permission and the developer tools.
 
@@ -34,7 +34,7 @@ reused as files (see 7.1); everything else is rebuilt.
 | skill | מיומנות | A specific topic, e.g. פירוק טרינום. Shown on the path as a star |
 | exercise | תרגיל | A question on a certain topic. Can be either open-ended or multiple choice |
 | lesson | שיעור | A set of skills, e.g. טכניקה אלגברית 1. Shown on the path as a hub with its skills around it |
-| class | כיתה | A named group of students with one teacher and the lessons it studies |
+| class | כיתה | A named group of students with one teacher. Every class studies the whole course |
 | quiz | בוחן | A test on a single lesson. Can be retaken; best grade wins; each retake draws new questions. It is the only quiz type (no one-time summary quiz); its best grade is the lesson's grade |
 | exercise test | מבחן תרגול | A timed test on a set of lessons. Can be retaken; best grade wins |
 | simulation test | מבחן סימולציה | A timed test on a set of lessons. One time only |
@@ -82,7 +82,7 @@ reused as files (see 7.1); everything else is rebuilt.
 - As a teacher, I want to see how much of each lesson each student has covered.
 
 **Manager**
-- As a manager, I want to create a class with its lessons, its teacher and its students, so a new group can start practicing.
+- As a manager, I want to create a class with its teacher and its students, so a new group can start practicing.
 - As a manager, I want to edit or delete a class and set its daily AI budget, so I can keep rosters and costs right.
 
 **Admin**
@@ -135,15 +135,14 @@ Requirements are grouped; each id (for example `ACC-3`) is stable and is what Op
 
 - **CLS-1 Who manages classes.** Only a manager (and a developer) can create, edit and delete classes. They do it in the classes screen (MGR-1).
   A class's teacher can also add and remove the students of that class, and nothing else about it (TCH-9).
-- **CLS-2 A class** has: a **name** (1–80 characters, unique ignoring case), the **lessons** it studies (chosen from the exercise bank, at least one),
-  its **students** (email addresses), one **teacher** (an email address), an **AI switch** (off for a new class; see AI-10) and a **daily AI budget** (a number of AI checks a day, default 150, used only while the AI is on).
+- **CLS-2 A class** has: a **name** (1–80 characters, unique ignoring case), its **students** (email addresses), one **teacher** (an email address), an **AI switch** (off for a new class; see AI-10) and a **daily AI budget** (a number of AI checks a day, default 150, used only while the AI is on).
 - **CLS-3 Adding students.** The manager (or the class's teacher) pastes email addresses, one per line (commas and spaces also separate them). Repeated addresses are ignored and
   invalid ones are reported. A student may belong to more than one class.
 - **CLS-4 The teacher.** A class has at most one teacher, given by email. A teacher is never also a student of the same class. A teacher may teach several classes.
-- **CLS-5 Editing.** The manager can change a class's name, lessons, students, teacher and AI budget. Removing a student from a class does not delete that student's progress.
+- **CLS-5 Editing.** The manager can change a class's name, students, teacher and AI budget. Removing a student from a class does not delete that student's progress.
 - **CLS-6 Deleting.** The manager can delete a class after confirming. Deleting a class does not delete its students' progress.
-- **CLS-7 Class list.** The list shows, for each class, its name, lessons, number of students and their emails, and its teacher, with shortcuts to edit and delete.
-- **CLS-8 Lessons in the path.** A student's path shows the lessons of their classes (all of them, when the student is in several classes).
+- **CLS-7 Class list.** The list shows, for each class, its name, number of students and their emails, and its teacher, with shortcuts to edit and delete.
+- **CLS-8 Lessons in the path.** A class has no chosen lessons: every class studies every lesson of the bank, one course called "מתמטיקה כיתה ט - מצוינות". A student in at least one class sees every lesson in the path.
   Within those lessons everything is open (PTH-4).
 
 ### 4.3 The exercise bank (BNK)
@@ -179,8 +178,10 @@ The path is the student's main screen: a trail of stars.
 - **PTH-7 Accessibility.** Each star is a control whose accessible name is its number, the skill's name and its state in words. It can be reached and opened from the keyboard.
   Animations stop when the device asks for reduced motion. The path is dark, like the rest of the app.
 - **PTH-9 Choosing a subject.** After sign-in a student first sees the subjects of their classes as cards (as in mathly1), each with an icon, the subject's name
-  and a bar "N מתוך M מיומנויות" (skills mastered of all skills in the student's lessons). Today the only subject is math (מתמטיקה), so there is one card.
-  Tapping a card opens that subject's home (STU-1, as in mathly1), and the tab bar leads from there to the path, the grades and the collection; the subject's screens have a way back to the subjects. A reload or a link to a skill (`#/skill/…`) opens its path directly.
+  and a bar "N מתוך M מיומנויות" (skills mastered of all skills in the student's lessons). Today the only subject is math, named "מתמטיקה כיתה ט - מצוינות", so there is one card.
+  Tapping a card opens that subject's home (STU-1, as in mathly1), and the tab bar leads from there to the path, the submissions, the grades and the collection; the subject's screens have a way back to the subjects. A reload or a link to a skill (`#/skill/…`) opens its path directly.
+- **PTH-10 Completed lessons.** A lesson is **completed** when every one of its skills is mastered (about 50 exercises: five skills of ten questions), or when its quiz was passed (QZ-7). The hub says "הושלם".
+- **PTH-11 The curriculum.** Each lesson may have a **date** by which it should be completed, one curriculum for the whole school, set by a manager (MGR-3). The path marks every lesson that should be finished by now: its date has passed and it is not completed. The hub shows a marker and "היה אמור להסתיים ב־<date>", and the top of the path says how many lessons are behind. A lesson without a date, with a date ahead, or completed is not marked. Nothing is locked (PTH-4).
 - **PTH-8 Phone first.** The path fits a 360px-wide screen without sideways scrolling, including the lesson with the most skills.
 
 ### 4.5 The exercise screen (EXR)
@@ -271,10 +272,11 @@ The exercise screen is where a student practices one skill.
 
 - **QZ-1 Quiz per lesson.** Every lesson has one quiz: the lesson's "boss level", a node on the trail after the lesson's ring. It is always open (PTH-4). The student can retake it at any time;
   the best grade counts, and the quiz's best grade is the lesson's grade.
-- **QZ-2 Format.** A quiz is **10 multiple-choice questions** drawn from the bank questions of the lesson's skills, at least one per skill and the rest spread evenly across the skills, in **15 minutes**.
+- **QZ-2 Format.** A quiz is **15 multiple-choice questions** drawn from the bank questions of the lesson's skills, at least one per skill and the rest spread evenly across the skills, in **20 minutes**. It is **passed** with a grade of at least 87 (13 right out of 15); a pass stays whatever a later retake scores (QZ-7).
   The timer runs on the server; when it ends the quiz is submitted as it stands and unanswered questions count as wrong. Skill names are not shown and there is no feedback until the end.
   The smart board and the calculator are available.
-- **QZ-3 Retakes draw new questions.** Each retake prefers questions the student has not had in earlier attempts at this lesson's quiz, the least-used first. The bank has at least 10 questions per skill, so this is always possible.
+- **QZ-3 Retakes draw new questions.** Each retake prefers questions the student has not had in earlier attempts at this lesson's quiz, the least-used first. While the lesson has enough unused questions (four skills of ten give two quizzes in a row without a repeat), none repeats; after that the least-used come first.
+- **QZ-7 Passing.** A quiz is passed with a grade of at least 87 (13 of 15). Passing completes the lesson (PTH-10) and does not change any skill's mastery.
 - **QZ-4 After a quiz.** The student sees the grade, the skills where points were lost (each linked to its star, so they can practice before retaking) and, for each missed question, the name and tip of the mistake they made (as in EXR-5).
   The correct answers are never shown, so a retake tests understanding and not memory.
 - **QZ-5 Grades on the server.** Quiz grades and timers are computed and stored on the server.
@@ -382,13 +384,14 @@ The exercise screen is where a student practices one skill.
 
 ### 4.16 Student screens (STU)
 
-A tab bar at the bottom of the screen leads between them.
+A tab bar at the bottom of the screen leads between them: home, path, submissions (STU-7), grades and collection.
 
-- **STU-1 Home:** my assignments (המשימות שלי) from the teacher; the upcoming-test reminder (TST-3); a button that continues the path at the next skill; my AI requests and their state (AI-1).
+- **STU-1 Home** shows only what is critical: the nearest test's reminder with its readiness and today's task (TST-3), a required simulation, the **new** assignments (המשימות שלי: not handed in yet), and a button that continues the path at the next skill; my AI requests and their state (AI-1).
 - **STU-2 Path:** see 4.4.
 - **STU-3 Grades:** all quiz (best grade), exercise test, simulation and assignment grades.
 - **STU-4 Collection:** see MST-7.
 - **STU-5 Assignments.** The student opens an assignment, works on it (on the smart board, or by photographing paper; ANS-1) and hands it in; they see the teacher's grade and note, or that it was sent back for correction.
+- **STU-7 Submissions tab (הגשות).** Lists every assignment from the student's teachers, grouped by state: new, sent back for correction, handed in and waiting for a check, and checked (with the grade and note). Each opens its page; one past its due date and not handed in is marked "באיחור". The switch for phone notifications (PSH-1) is at the bottom of this tab, not on home.
 - **STU-6 Photo help.** A camera button lets the student photograph a problem (AI-3). Pressing it opens the device's camera or gallery. The picture is shrunk on the device and its metadata is dropped before it is sent
   (JPEG, PNG or WebP). A sheet then shows the student's picture and the request's state, and the hints once the teacher has sent it.
   The button appears in two places, and only for students of a class with the AI on (AI-10):
@@ -399,7 +402,7 @@ A tab bar at the bottom of the screen leads between them.
 
 ### 4.17 Teacher screens (TCH)
 
-- **TCH-1 Teacher home.** A teacher's home lists the classes they teach, each with its students and a shortcut to its progress. A teacher does not see the student path as their main screen. A teacher who teaches no class is told that a manager chooses who teaches each class.
+- **TCH-1 Teacher home.** A teacher's home lists the classes they teach, each with its students and a shortcut to its progress. A teacher does not see the student path as their main screen. A teacher who teaches no class is told that a manager chooses who teaches each class. Each tab of the teacher's screen shows how many items are in it: classes, tests, assignments, and submissions waiting in the inbox.
 - **TCH-2 Give an assignment.** The teacher creates an assignment (title, note, due date) and loads its content from:
   - the computer (file upload: PDF or images);
   - a photo taken with the device camera;
@@ -424,6 +427,7 @@ A tab bar at the bottom of the screen leads between them.
 ### 4.18 Manager screens (MGR)
 
 - **MGR-1 Classes.** The manager's home lists all classes (CLS-7) with a button for a new class, and an editor for creating and changing a class (CLS-2 – CLS-6). When a save is refused (for example the teacher is also one of the students), the editor says why right above the save button, in view, and keeps what was typed.
+- **MGR-3 Curriculum.** A tab "תכנית לימודים" lists every lesson in the bank's order, with the bank's month as a hint and a date the manager can set, change or clear (PTH-11).
 - **MGR-2 Students.** A list of all students with the classes each belongs to.
 
 ### 4.19 Admin screens (ADM)
@@ -460,6 +464,7 @@ A tab bar at the bottom of the screen leads between them.
 
 - Hebrew, right-to-left. Works on phones first; the teacher, manager, admin and developer views (heat map, coverage, classes, roles) must also work well on a computer.
 - The look follows the path's "sky" theme: a dark-blue night with aurora and starlight accents, gold for mastery, and an owl mascot that perches on the next skill. The app is always dark, as mathly1 is: the page background is a dark night with two soft glows and small fixed stars; it does not move. There is no light mode.
+- A button whose action takes longer than about a third of a second shows it (a spinner, a second press ignored), everywhere in the app; with reduced motion it shows "…".
 - Math is written in `$…$` text in the exercise bank; the app must render it as formulas.
 - State and result never rely on color alone: every state has a symbol or a word (stars, heat map cells, feedback).
 - Mastered skills must look clearly different from "learning" and "not started" ones.
@@ -502,6 +507,7 @@ Rebuilt, not copied as a whole; read the places named in each requirement group.
   Settings come from, in order, real environment variables, the app's own `.env` if it has one, and the repository's `.env` (the one mathly1 uses, with the same keys); earlier sources win. With Supabase unset, local development uses an in-memory store and a "dev only" email sign-in, and a half-configured server refuses to start.
   The app page and its styles and scripts are sent with `Cache-Control: no-cache`, so after an update every device gets the new version without clearing its cache (an unchanged file is still answered from the cache). The page declares mathly1's icon (`static/icons/`), shown in the browser tab.
   The server reads the same fact once per request, makes independent database reads at the same time, and reuses its connections: a student's screen waits for the database at most 3 times in a row and a practice answer at most 4 (each call to a remote database costs about 0.4 seconds).
+  The server remembers the classes, their students, the roles, the tests and the assignments for at most 30 seconds (`MATHLY_CACHE_SECONDS`, 0 turns it off) and forgets them at once when the app changes one; a screen opened again shows what it last knew and refreshes it, without redrawing over something being typed. One server process is assumed.
   Further settings: the AI key and model (`ANTHROPIC_API_KEY`, `MATH_MODEL`), the push keys (`VAPID_PRIVATE_KEY`, `VAPID_SUBJECT`), the private bucket for answer pictures, and the teacher and developer email lists.
 - **Server decides.** Correctness of answers, the date of each answer, mastery, grades, the budgets, and the simulation and exercise-test timers are decided and stored on the server.
   Grades that matter cannot be changed from the device.

mathly2/assignments.py

@@ -0,0 +1,390 @@
+"""Assignments: a teacher gives work to a class (pages from a file, a photo or the board; one of the bank's written quizzes; or an exercise test
+of a real test), students hand in pictures, the teacher checks them from one inbox."""
+from __future__ import annotations
+
+from datetime import date as Day
+from datetime import datetime
+from typing import Literal
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from pydantic import BaseModel, Field
+from starlette.concurrency import run_in_threadpool
+
+from . import attempts, cleanup, clock, pictures, reads
+from .access import allowed, learner, need
+from .pictures import PictureError
+from .realtests import _my_class, lesson_names
+from .written import picture_error
+
+router = APIRouter(prefix="/api")
+MAX_PAGES = 20
+
+
+class NewAssignment(BaseModel):
+    title: str = Field(min_length=1, max_length=200)
+    note: str = Field(default="", max_length=1000)
+    due_date: Day
+    kind: Literal["pages", "quiz", "exercise_test"]
+    pages: list[str] = Field(default_factory=list, max_length=MAX_PAGES)
+    quiz_lesson: str | None = None
+    test_id: int | None = None
+    exercise_number: Literal[1, 2] | None = None
+
+
+def written_quiz(bank, lesson_id: str) -> dict | None:
+    """The authored written quiz of a lesson (minutes and questions with points), or None."""
+    unit = next((u for u in bank.data["units"] if u["id"] == lesson_id), None)
+    return (unit or {}).get("quiz") or None
+
+
+def quiz_view(bank, lesson_id: str) -> dict | None:
+    quiz = written_quiz(bank, lesson_id)
+    if not quiz:
+        return None
+    return {"minutes": quiz["minutes"], "points": sum(q["points"] for q in quiz["questions"]),
+            "questions": [{k: q[k] for k in ("question", "points", "figure", "graph") if k in q} for q in quiz["questions"]]}
+
+
+# ---- the teacher: pages, giving, listing, removing ----
+
+@router.post("/assignments/pages", status_code=201)
+async def upload_pages(request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    """One file of an assignment: an image (one page) or a PDF (a page per sheet). Returns the page pictures' ids, in order."""
+    declared = request.headers.get("content-length")
+    if declared and declared.isdigit() and int(declared) > pictures.MAX_PDF + 1024:
+        raise picture_error(PictureError(413, "pdf_too_large"))
+    data = await request.body()
+    kind = request.headers.get("content-type", "").split(";")[0].strip().lower()
+
+    def work() -> list[str]:
+        sheets = pictures.render_pdf(data) if kind == "application/pdf" else [pictures.clean_image(data, kind)]
+        made = [pictures.store_picture(request.app.state.store, request.app.state.pictures, user["id"], "page", jpeg) for jpeg in sheets]
+        return [row["id"] for row in made]
+    try:
+        ids = await run_in_threadpool(work)
+    except PictureError as exc:
+        raise picture_error(exc) from exc
+    return {"pictures": ids}
+
+
+def _checked_pages(request: Request, user: dict, ids: list[str]) -> list[str]:
+    store = request.app.state.store
+    found = list(dict.fromkeys(ids))
+    for pid in found:
+        pic = store.get_picture(pid)
+        if pic is None or pic["kind"] != "page" or pic["owner_id"] != user["id"] or pic["deleted_at"]:
+            raise HTTPException(422, "אחד העמודים לא תקין")
+    return found
+
+
+@router.post("/classes/{class_id}/assignments", status_code=201)
+def give_assignment(class_id: int, body: NewAssignment, request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    klass = _my_class(request, user, class_id)
+    store, bank, today = request.app.state.store, request.app.state.bank, clock.school_day()
+    if body.due_date < today:
+        raise HTTPException(422, "תאריך ההגשה כבר עבר")
+    fields: dict = {}
+    if body.kind == "pages":
+        fields["pages"] = _checked_pages(request, user, body.pages)
+        if not fields["pages"]:
+            raise HTTPException(422, "צריך לפחות עמוד אחד")
+    elif body.kind == "quiz":
+        if body.quiz_lesson not in klass["lessons"] or not written_quiz(bank, body.quiz_lesson):
+            raise HTTPException(422, "לשיעור הזה אין בוחן כתוב, או שהוא לא של הכיתה")
+        fields["quiz_lesson"] = body.quiz_lesson
+    else:
+        test = store.get_test(body.test_id) if body.test_id is not None else None
+        if test is None or test["removed_at"] or test["class_id"] != class_id or body.exercise_number is None:
+            raise HTTPException(422, "המבחן לא נמצא בכיתה הזו")
+        fields.update(test_id=body.test_id, exercise_number=body.exercise_number)
+    row = store.create_assignment(class_id, body.title.strip(), body.due_date, user["email"], body.kind, note=body.note.strip(),
+                                  created_at=clock.now(), **fields)
+    return teacher_assignment(request, row, klass, [], today)
+
+
+def teacher_assignment(request: Request, row: dict, klass: dict, subs: list[dict], today: Day) -> dict:
+    """An assignment as its teacher sees it, with how many students handed in, were checked, were sent back, and (for an exercise test) did it."""
+    store, here = request.app.state.store, reads.of(request)
+    members = store.members(klass["id"])
+    out = {"id": row["id"], "class": {"id": klass["id"], "name": klass["name"]}, "title": row["title"], "note": row["note"], "kind": row["kind"],
+           "due_date": row["due_date"].isoformat(), "days_left": (row["due_date"] - today).days, "students": len(members), "pages": row["pages"]}
+    if row["kind"] == "quiz":
+        out["quiz_lesson"] = {"id": row["quiz_lesson"], "name": (lesson_names(request, [row["quiz_lesson"]]) or [""])[0]}
+    if row["kind"] == "exercise_test":
+        test = store.get_test(row["test_id"])
+        out["test"] = {"id": row["test_id"], "number": row["exercise_number"], "date": test["date"].isoformat() if test else None}
+        scope = f'{row["test_id"]}:{row["exercise_number"]}'
+        ids = [m["user_id"] for m in members if m["user_id"]]
+        here.prefetch(*[("attempts_of", uid, "exercise_test") for uid in ids])
+        out["done"] = sum(1 for uid in ids if any(r["scope"] == scope and not attempts.is_open(r) for r in here.attempts_of(uid, "exercise_test")))
+    else:
+        out.update(handed_in=sum(1 for s in subs if s["state"] == "handed_in"), graded=sum(1 for s in subs if s["state"] == "graded"),
+                   returned=sum(1 for s in subs if s["state"] == "returned"))
+        out["waiting"] = out["handed_in"]
+    return out
+
+
+@router.get("/teaching/assignments")
+def teaching_assignments(request: Request, user: dict = Depends(need("class.teach"))) -> list[dict]:
+    """The assignments of the classes I teach (a developer: every class), with the counts."""
+    store, today = request.app.state.store, clock.school_day()
+    classes = store.classes() if allowed(user["roles"], "*") else store.classes_taught(user["email"])
+    result = []
+    for klass in classes:
+        rows = store.assignments_of_classes([klass["id"]])
+        subs = store.submissions_of_assignments([r["id"] for r in rows])
+        bank = request.app.state.bank
+        result.append({"class": {"id": klass["id"], "name": klass["name"],
+                                 "lessons": [{"id": i, "name": n, "has_quiz": bool(written_quiz(bank, i))} for i, n in zip(klass["lessons"], lesson_names(request, klass["lessons"]))],
+                                 "tests": [{"id": t["id"], "date": t["date"].isoformat(), "lessons": lesson_names(request, t["lessons"])} for t in store.tests_of_classes([klass["id"]])]},
+                       "assignments": [teacher_assignment(request, r, klass, [s for s in subs if s["assignment_id"] == r["id"]], today) for r in rows]})
+    return result
+
+
+@router.delete("/assignments/{assignment_id}", status_code=204)
+def remove_assignment(assignment_id: int, request: Request, user: dict = Depends(need("class.teach"))) -> None:
+    store = request.app.state.store
+    row = store.get_assignment(assignment_id)
+    if row is None or row["removed_at"]:
+        raise HTTPException(404, "המשימה לא נמצאה")
+    _my_class(request, user, row["class_id"])
+    store.remove_assignment(assignment_id, clock.now())
+
+
+# ---- the student: my assignments and handing in ----
+
+MAX_ANSWER_PICTURES = 10
+OPEN_STATES = ("not_handed", "returned", "not_done")
+
+
+def _my_assignment(request: Request, user: dict, assignment_id: int) -> dict:
+    """An assignment of one of the student's classes (404 for anything else, and for a removed one)."""
+    here = reads.of(request)
+    row = here.get_assignment(assignment_id)
+    mine = {c["id"] for c in here.classes_of_student(user["email"])}
+    if row is None or row["removed_at"] or row["class_id"] not in mine:
+        raise HTTPException(404, "המשימה לא נמצאה")
+    return row
+
+
+def _exercise_result(request: Request, user: dict, row: dict) -> tuple[str, int | None]:
+    """The state of an exercise-test assignment: done once the student has a submitted attempt at it, and the best grade of those."""
+    scope = f'{row["test_id"]}:{row["exercise_number"]}'
+    grades = [r["grade"] for r in reads.of(request).attempts_of(user["id"], "exercise_test") if r["scope"] == scope and not attempts.is_open(r)]
+    return ("done", max(grades)) if grades else ("not_done", None)
+
+
+def student_assignment(request: Request, user: dict, row: dict, sub: dict | None, today: Day) -> dict:
+    """An assignment as its student sees it: its state, grade and the teacher's note."""
+    out = {"id": row["id"], "title": row["title"], "note": row["note"], "kind": row["kind"], "due_date": row["due_date"].isoformat(),
+           "days_left": (row["due_date"] - today).days, "grade": None, "teacher_note": "", "late": False}
+    klass = reads.of(request).get_class(row["class_id"])
+    out["class"] = {"id": row["class_id"], "name": klass["name"] if klass else ""}
+    if row["kind"] == "exercise_test":
+        out["state"], out["grade"] = _exercise_result(request, user, row)
+        out["test"] = {"id": row["test_id"], "number": row["exercise_number"]}
+    elif sub is None:
+        out["state"] = "not_handed"
+    else:
+        out.update(state=sub["state"], grade=sub["grade"], teacher_note=sub["teacher_note"], late=sub["late"], handed_at=sub["handed_at"].isoformat())
+    out["overdue"] = out["days_left"] < 0 and out["state"] in OPEN_STATES
+    return out
+
+
+@router.get("/assignments")
+def my_assignments(request: Request, user: dict = Depends(learner)) -> list[dict]:
+    """The student's assignments: the open ones first by due date, then the done ones."""
+    here, today = reads.of(request), clock.school_day()
+    class_ids = [c["id"] for c in here.classes_of_student(user["email"])]
+    here.prefetch(("assignments_of_classes", class_ids), ("submissions_of_user", user["id"]), ("attempts_of", user["id"], "exercise_test"))
+    subs = {s["assignment_id"]: s for s in here.submissions_of_user(user["id"])}
+    shown = [student_assignment(request, user, r, subs.get(r["id"]), today) for r in here.assignments_of_classes(class_ids)]
+    return sorted(shown, key=lambda a: (a["state"] not in OPEN_STATES, a["due_date"], a["id"]))
+
+
+@router.get("/assignments/{assignment_id}")
+def my_assignment(assignment_id: int, request: Request, user: dict = Depends(learner)) -> dict:
+    row = _my_assignment(request, user, assignment_id)
+    here, bank, today = reads.of(request), request.app.state.bank, clock.school_day()
+    sub = here.get_submission(assignment_id, user["id"])
+    out = student_assignment(request, user, row, sub, today)
+    out["pages"] = row["pages"]
+    if row["kind"] == "quiz":
+        out["quiz"] = quiz_view(bank, row["quiz_lesson"])
+    pics = []
+    for pid in (sub["pictures"] if sub else []):
+        pic = request.app.state.store.get_picture(pid)
+        pics.append({"id": pid, "deleted": bool(pic and pic["deleted_at"])})
+    out["pictures"] = pics
+    return out
+
+
+class Handing(BaseModel):
+    pictures: list[str] = Field(min_length=1, max_length=MAX_ANSWER_PICTURES)
+
+
+@router.post("/assignments/{assignment_id}/submission")
+def hand_in(assignment_id: int, body: Handing, request: Request, user: dict = Depends(learner)) -> dict:
+    """Hand in (or replace, or hand in again after a return) the student's picture answers. A graded submission cannot be changed."""
+    store, today = request.app.state.store, clock.school_day()
+    row = _my_assignment(request, user, assignment_id)
+    if row["kind"] == "exercise_test":
+        raise HTTPException(422, "מבחן תרגול לא מגישים בתמונה: עושים אותו באפליקציה")
+    existing = store.get_submission(assignment_id, user["id"])
+    if existing and existing["state"] == "graded":
+        raise HTTPException(409, "המשימה כבר נבדקה ולא אפשר לשנות אותה")
+    ids = list(dict.fromkeys(body.pictures))
+    for pid in ids:
+        pic = store.get_picture(pid)
+        if pic is None or pic["kind"] != "answer" or pic["owner_id"] != user["id"] or pic["deleted_at"]:
+            raise HTTPException(422, "אחת התמונות לא תקינה")
+    saved = store.save_submission(assignment_id, user["id"], pictures=ids, state="handed_in", late=today > row["due_date"], handed_at=clock.now(),
+                                  grade=None, teacher_note="" if not existing else existing["teacher_note"], checked_at=None, checked_by=None)
+    return student_assignment(request, user, row, saved, today)
+
+
+# ---- the teacher: the inbox and checking ----
+
+class Check(BaseModel):
+    grade: int = Field(ge=0, le=100)
+    note: str = Field(default="", max_length=2000)
+    seen: str                                   # the handed_at the teacher was looking at
+
+
+class SendBack(BaseModel):
+    note: str = Field(min_length=1, max_length=2000)
+    seen: str
+
+
+def _teachable_classes(request: Request, user: dict) -> list[dict]:
+    store = request.app.state.store
+    return store.classes() if allowed(user["roles"], "*") else store.classes_taught(user["email"])
+
+
+def _student_emails(request: Request, class_id: int) -> dict[str, str]:
+    return {m["user_id"]: m["email"] for m in request.app.state.store.members(class_id) if m["user_id"]}
+
+
+def inbox_item(request: Request, sub: dict, assignment: dict, klass: dict, emails: dict[str, str]) -> dict:
+    return {"kind": "submission", "id": sub["id"], "assignment": {"id": assignment["id"], "title": assignment["title"], "kind": assignment["kind"],
+                                                                  "class": {"id": klass["id"], "name": klass["name"]}},
+            "student": emails.get(sub["user_id"], ""), "handed_at": sub["handed_at"].isoformat(), "late": sub["late"], "seen": sub["handed_at"].isoformat(),
+            "pictures": [{"id": p} for p in sub["pictures"]]}
+
+
+@router.get("/teaching/inbox")
+def inbox(request: Request, user: dict = Depends(need("class.teach"))) -> list[dict]:
+    """Everything the teacher's students handed in that waits for them, oldest first. A submission sent back waits for the student and is not here."""
+    store, items = request.app.state.store, []
+    for klass in _teachable_classes(request, user):
+        rows = {r["id"]: r for r in store.assignments_of_classes([klass["id"]]) if r["kind"] != "exercise_test"}
+        emails = _student_emails(request, klass["id"])
+        items += [inbox_item(request, s, rows[s["assignment_id"]], klass, emails) for s in store.submissions_of_assignments(list(rows)) if s["state"] == "handed_in"]
+    return sorted(items, key=lambda i: (i["handed_at"], i["id"]))
+
+
+def _my_submission(request: Request, user: dict, submission_id: int) -> tuple[dict, dict, dict]:
+    store = request.app.state.store
+    sub = store.get_submission_by_id(submission_id)
+    row = store.get_assignment(sub["assignment_id"]) if sub else None
+    if sub is None or row is None or row["removed_at"]:
+        raise HTTPException(404, "ההגשה לא נמצאה")
+    return sub, row, _my_class(request, user, row["class_id"])
+
+
+@router.get("/submissions/{submission_id}")
+def open_submission(submission_id: int, request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    sub, row, klass = _my_submission(request, user, submission_id)
+    out = inbox_item(request, sub, row, klass, _student_emails(request, klass["id"]))
+    out.update(state=sub["state"], grade=sub["grade"], teacher_note=sub["teacher_note"], pages=row["pages"], note=row["note"],
+               quiz=quiz_view(request.app.state.bank, row["quiz_lesson"]) if row["kind"] == "quiz" else None)
+    out["pictures"] = [{"id": p, "deleted": bool((request.app.state.store.get_picture(p) or {}).get("deleted_at"))} for p in sub["pictures"]]
+    return out
+
+
+def _check(request: Request, user: dict, submission_id: int, seen: str) -> tuple[dict, dict]:
+    sub, row, _ = _my_submission(request, user, submission_id)
+    try:
+        saw = datetime.fromisoformat(seen)
+    except ValueError:
+        raise HTTPException(422, "seen לא תקין") from None
+    if sub["state"] != "handed_in":
+        raise HTTPException(409, "ההגשה כבר נבדקה או הוחזרה")
+    if saw != sub["handed_at"]:
+        raise HTTPException(409, "ההגשה השתנתה. פתחו אותה שוב.")
+    return sub, row
+
+
+@router.post("/submissions/{submission_id}/grade")
+def grade_submission(submission_id: int, body: Check, request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    sub, _ = _check(request, user, submission_id, body.seen)
+    saved = request.app.state.store.save_submission(sub["assignment_id"], sub["user_id"], state="graded", grade=body.grade, teacher_note=body.note.strip(),
+                                                    checked_at=clock.now(), checked_by=user["email"])
+    return {"id": saved["id"], "state": saved["state"], "grade": saved["grade"]}
+
+
+@router.post("/submissions/{submission_id}/return")
+def return_submission(submission_id: int, body: SendBack, request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    sub, _ = _check(request, user, submission_id, body.seen)
+    if not body.note.strip():
+        raise HTTPException(422, "צריך לכתוב מה לתקן")
+    saved = request.app.state.store.save_submission(sub["assignment_id"], sub["user_id"], state="returned", grade=None, teacher_note=body.note.strip(),
+                                                    checked_at=clock.now(), checked_by=user["email"])
+    return {"id": saved["id"], "state": saved["state"]}
+
+
+# ---- the grades screen's rows ----
+
+def grade_rows(request: Request, user: dict) -> list[dict]:
+    """Graded assignments and done exercise-test assignments, with the teacher's note. A removed assignment keeps its grade."""
+    store, here = request.app.state.store, reads.of(request)
+    class_ids = [c["id"] for c in here.classes_of_student(user["email"])]
+    rows = {r["id"]: r for r in store.assignments_of_classes(class_ids, include_removed=True)}
+    out = []
+    subs = {s["assignment_id"]: s for s in store.submissions_of_user(user["id"])}
+    here.prefetch(("attempts_of", user["id"], "exercise_test"))
+    for row in rows.values():
+        item = {"assignment": {"id": row["id"], "title": row["title"], "kind": row["kind"], "due_date": row["due_date"].isoformat(), "removed": bool(row["removed_at"])}}
+        if row["kind"] == "exercise_test":
+            state, grade = _exercise_result(request, user, row)
+            if state == "done":
+                out.append({**item, "grade": grade, "note": ""})
+        elif row["id"] in subs and subs[row["id"]]["state"] == "graded":
+            out.append({**item, "grade": subs[row["id"]]["grade"], "note": subs[row["id"]]["teacher_note"]})
+    return sorted(out, key=lambda r: (r["assignment"]["due_date"], r["assignment"]["id"]))
+
+
+# ---- deleting a student's pictures on request ----
+
+@router.delete("/classes/{class_id}/pictures/{email:path}")
+def delete_student_pictures(class_id: int, email: str, request: Request, user: dict = Depends(need("class.roster"))) -> dict:
+    """Delete a student's answer pictures for this class's assignments now. The class's teacher, a manager or a developer may. The submissions
+    keep their grade and note."""
+    store = request.app.state.store
+    klass = store.get_class(class_id)
+    is_teacher = klass is not None and (klass["teacher_email"] or "").lower() == user["email"]
+    if klass is None or not (is_teacher or allowed(user["roles"], "classes.manage") or allowed(user["roles"], "*")):
+        raise HTTPException(404, "הכיתה לא נמצאה")
+    member = next((m for m in store.members(class_id) if m["email"] == email.strip().lower()), None)
+    if member is None:
+        raise HTTPException(404, "התלמיד לא נמצא בכיתה")
+    if not member["user_id"]:
+        return {"deleted": 0}                                                    # never signed in: nothing was handed in
+    ids = [a["id"] for a in store.assignments_of_classes([class_id], include_removed=True)]
+    return {"deleted": cleanup.delete_answer_pictures(store, request.app.state.pictures, ids, member["user_id"], clock.now())}
+
+
+# ---- the numbers on the teacher's tabs ----
+
+@router.get("/teaching/counts")
+def teaching_counts(request: Request, user: dict = Depends(need("class.teach"))) -> dict:
+    """How many items each tab of the teacher's screen holds: the classes they teach, their tests, their assignments, and the submissions waiting."""
+    store = request.app.state.store
+    classes = _teachable_classes(request, user)
+    ids = [c["id"] for c in classes]
+    here = reads.of(request)
+    here.prefetch(("tests_of_classes", ids), ("assignments_of_classes", ids))
+    tests, assignments = here.tests_of_classes(ids), here.assignments_of_classes(ids)
+    graded_by_student = [a["id"] for a in assignments if a["kind"] != "exercise_test"]
+    waiting = sum(1 for s in store.submissions_of_assignments(graded_by_student) if s["state"] == "handed_in")
+    return {"classes": len(classes), "tests": len(tests), "assignments": len(assignments), "inbox": waiting}

mathly2/attempts.py

@@ -6,8 +6,9 @@ from __future__ import annotations
 
 from datetime import datetime
 
-QUIZ_SIZE = 10
-QUIZ_MINUTES = 15
+QUIZ_SIZE = 15
+QUIZ_MINUTES = 20
+PASS_RIGHT = 13                    # right answers out of QUIZ_SIZE that pass a lesson quiz
 
 
 def percent(right: int, total: int) -> int:
@@ -15,6 +16,9 @@ def percent(right: int, total: int) -> int:
     return 0 if total <= 0 else (200 * right + total) // (2 * total)
 
 
+PASS_GRADE = percent(PASS_RIGHT, QUIZ_SIZE)    # 87: a quiz is passed with this grade or better
+
+
 def _right(bank, question: dict, answers: dict) -> bool:
     choice = answers.get(question["key"])
     graded = bank.grade(question["skill_id"], question["key"], choice) if isinstance(choice, int) else None

mathly2/cached.py

@@ -0,0 +1,69 @@
+"""A store that remembers slow-changing reads (classes, members, roles, tests, assignments) for a short time.
+
+Any change made through it to one of those forgets everything remembered at once. Rows come back as copies.
+"""
+from __future__ import annotations
+
+import copy
+import threading
+import time
+
+READS = frozenset({
+    "classes", "classes_of_student", "classes_taught", "members", "get_class", "roles_of",
+    "tests_of_classes", "get_test", "assignments_of_classes", "get_assignment", "all_students", "accounts", "curriculum",
+})
+CHANGES = frozenset({
+    "create_class", "update_class", "delete_class", "add_member", "remove_member", "give_role", "take_role", "link_user",
+    "create_test", "update_test", "remove_test", "create_assignment", "remove_assignment", "set_lesson_dates",
+})
+
+
+def _key(name: str, args: tuple, kwargs: dict):
+    def freeze(v):
+        if isinstance(v, (set, frozenset)):
+            return tuple(sorted(v, key=repr))
+        if isinstance(v, (list, tuple)):
+            return tuple(freeze(x) for x in v)
+        return v
+    return name, freeze(args), tuple(sorted((k, freeze(v)) for k, v in kwargs.items()))
+
+
+class CachedStore:
+    def __init__(self, store, seconds: float, clock=time.monotonic) -> None:
+        self._store, self._seconds, self._clock = store, seconds, clock
+        self._lock = threading.Lock()
+        self._kept: dict = {}            # key -> (expires, value)
+        self._generation = 0             # bumped by every change, so a read that began before one is not kept
+
+    def forget(self) -> None:
+        with self._lock:
+            self._kept.clear()
+            self._generation += 1
+
+    def __getattr__(self, name: str):
+        target = getattr(self._store, name)
+        if self._seconds <= 0 or not callable(target):
+            return target
+        if name in CHANGES:
+            def change(*args, **kwargs):
+                try:
+                    return target(*args, **kwargs)
+                finally:
+                    self.forget()
+            return change
+        if name in READS:
+            def read(*args, **kwargs):
+                key = _key(name, args, kwargs)
+                now = self._clock()
+                with self._lock:
+                    hit = self._kept.get(key)
+                    if hit and hit[0] > now:
+                        return copy.deepcopy(hit[1])
+                    generation = self._generation
+                value = target(*args, **kwargs)
+                with self._lock:
+                    if generation == self._generation:
+                        self._kept[key] = (now + self._seconds, copy.deepcopy(value))
+                return value
+            return read
+        return target

mathly2/classes.py

@@ -3,10 +3,12 @@ removes its students; a teacher sees the classes they teach; a manager sees ever
 from __future__ import annotations
 
 import re
+from datetime import date
 
 from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel, Field
 
+from . import reads
 from .access import allowed, need
 from .auth import EMAIL
 from .store import ClassExists, MemberExists, TeacherIsStudent
@@ -19,7 +21,7 @@ teaching = APIRouter(prefix="/api")
 
 class ClassBody(BaseModel):
     name: str = Field(max_length=200)
-    lessons: list[str] = Field(default_factory=list, max_length=200)
+    lessons: list[str] = Field(default_factory=list, max_length=200)   # ignored: kept so older clients still work
     teacher_email: str | None = Field(default=None, max_length=300)
     students: str | None = Field(default=None, max_length=40000)   # pasted text: the whole roster of the class
     ai_enabled: bool = False
@@ -55,10 +57,7 @@ def checked(request: Request, body: ClassBody) -> dict:
     name = " ".join(body.name.split())
     if not 1 <= len(name) <= MAX_NAME:
         raise HTTPException(422, f"שם הכיתה צריך להיות בין תו אחד ל־{MAX_NAME} תווים")
-    known = [lesson["id"] for lesson in request.app.state.bank.lessons]
-    lessons = [lesson for lesson in dict.fromkeys(body.lessons) if lesson in known]
-    if len(lessons) != len(set(body.lessons)) or not lessons:
-        raise HTTPException(422, "יש לבחור לפחות שיעור אחד מהרשימה")
+    lessons = [lesson["id"] for lesson in request.app.state.bank.lessons]      # every class studies the whole course
     teacher = (body.teacher_email or "").strip().lower() or None
     if teacher and not EMAIL.match(teacher):
         raise HTTPException(422, "כתובת המורה לא נראית כמו מייל")
@@ -100,13 +99,6 @@ def list_classes(request: Request, user: dict = Depends(need("classes.manage")))
     return [shown(request, c) for c in request.app.state.store.classes()]
 
 
-@router.get("/lessons")
-def lessons_to_choose(request: Request, user: dict = Depends(need("classes.manage"))) -> list[dict]:
-    """The bank's lessons, for choosing what a class studies (a manager has no student path, so no /api/lessons)."""
-    return [{"id": lesson["id"], "name": lesson["name"], "skills": len(lesson["skills"])}
-            for lesson in request.app.state.bank.lessons_with_skills()]
-
-
 @router.post("", status_code=201)
 def create_class(body: ClassBody, request: Request, user: dict = Depends(need("classes.manage"))) -> dict:
     fields = checked(request, body)
@@ -199,3 +191,36 @@ def my_classes(request: Request, user: dict = Depends(need("class.teach"))) -> l
 @teaching.get("/students")
 def all_students(request: Request, user: dict = Depends(need("students.list"))) -> list[dict]:
     return request.app.state.store.all_students()
+
+
+# ---- the curriculum: the date by which each lesson should be completed (one for the whole school) ----
+
+curriculum = APIRouter(prefix="/api/curriculum")
+
+
+class Dates(BaseModel):
+    dates: dict[str, str | None] = Field(max_length=200)        # lesson id -> "YYYY-MM-DD", or null to clear
+
+
+@curriculum.get("")
+def read_curriculum(request: Request, user: dict = Depends(need("classes.manage"))) -> list[dict]:
+    """Every lesson in the bank's order with its date (or null) and the bank's month as a hint."""
+    dates = reads.of(request).curriculum()
+    return [{"id": lesson["id"], "name": lesson["name"], "month": lesson.get("when", ""), "due_date": dates[lesson["id"]].isoformat() if lesson["id"] in dates else None}
+            for lesson in request.app.state.bank.lessons]
+
+
+@curriculum.put("")
+def change_curriculum(body: Dates, request: Request, user: dict = Depends(need("classes.manage"))) -> list[dict]:
+    known = {lesson["id"] for lesson in request.app.state.bank.lessons}
+    parsed: dict[str, date | None] = {}
+    for lesson, text in body.dates.items():
+        if lesson not in known:
+            raise HTTPException(422, "שיעור לא מוכר")
+        try:
+            parsed[lesson] = date.fromisoformat(text) if text else None
+        except ValueError:
+            raise HTTPException(422, "תאריך לא תקין") from None
+    request.app.state.store.set_lesson_dates(parsed)
+    request.state.reads = None                                     # what this request read is out of date now
+    return read_curriculum(request, user)

mathly2/cleanup.py

@@ -0,0 +1,83 @@
+"""The hourly cleanup of pictures, and deleting a student's pictures on request. `python -m mathly2.cleanup` runs it once; the server runs it
+every hour when it is connected to Supabase."""
+from __future__ import annotations
+
+import logging
+import threading
+from datetime import datetime
+
+from . import clock, pictures, retention
+
+log = logging.getLogger("mathly.cleanup")
+
+
+def run(store, backend, now: datetime | None = None) -> dict:
+    """Remove pictures nothing refers to (after a day), answer pictures past their school year, and the pages of removed assignments.
+    Returns how many of each were removed. A picture whose bytes cannot be deleted now is left for the next run."""
+    now = now or clock.now()
+    today = clock.school_day(now)
+    removed = {"orphans": 0, "expired": 0, "removed_assignments": 0}
+    for pic in store.pictures():
+        refs = store.picture_refs(pic["id"])
+        referenced = any(refs.values())
+        if pic["kind"] == "answer" and retention.is_expired(clock.school_day(pic["created_at"]), today):
+            reason = "expired"
+        elif not referenced and now - pic["created_at"] > retention.ORPHAN_AGE:
+            reason = "orphans"
+        elif pic["kind"] == "page" and refs["assignments"] and all((store.get_assignment(a) or {}).get("removed_at") for a in refs["assignments"]):
+            reason = "removed_assignments"
+        else:
+            continue
+        try:
+            pictures.remove_picture(store, backend, pic, now)
+            removed[reason] += 1
+        except pictures.PictureError as exc:
+            log.warning("could not delete a picture (%s); it stays for the next run", exc.code)
+    return removed
+
+
+def delete_answer_pictures(store, backend, assignment_ids, user_id: str, now: datetime | None = None) -> int:
+    """Delete a student's answer pictures for these assignments now (a teacher of the class, a manager or a developer asked). The submissions
+    keep their grade and note. Returns how many pictures were deleted."""
+    count = 0
+    for sub in store.submissions_of_assignments(assignment_ids):
+        if sub["user_id"] != user_id:
+            continue
+        for pid in sub["pictures"]:
+            pic = store.get_picture(pid)
+            if pic and pic["kind"] == "answer" and pic["owner_id"] == user_id and not pic["deleted_at"]:
+                pictures.remove_picture(store, backend, pic, now)
+                count += 1
+    return count
+
+
+def start_hourly(store, backend, every: float = 3600.0) -> threading.Event:
+    """Run the cleanup now and then every `every` seconds in a background thread. Returns an event that stops it when set."""
+    stop = threading.Event()
+
+    def loop() -> None:
+        while True:
+            try:
+                log.info("cleanup removed %s", run(store, backend))
+            except Exception:                                    # a failed run must not stop the next one
+                log.exception("the picture cleanup failed")
+            if stop.wait(every):
+                return
+
+    threading.Thread(target=loop, name="picture-cleanup", daemon=True).start()
+    return stop
+
+
+def main() -> None:
+    from .config import load_settings
+    from .store import SupabaseStore
+    settings = load_settings()
+    if not settings.supabase_on:
+        raise SystemExit("Set the Supabase settings: the cleanup works on the real database.")
+    store = SupabaseStore(settings.supabase_url, settings.supabase_secret)
+    backend = pictures.SupabasePictures(settings.supabase_url, settings.supabase_secret, settings.answer_bucket)
+    print("Removed", run(store, backend))
+
+
+if __name__ == "__main__":
+    main()

mathly2/config.py

@@ -24,6 +24,10 @@ class Settings:
     teachers: frozenset[str] = field(default_factory=frozenset)
     developers: frozenset[str] = field(default_factory=frozenset)   # the developer role comes only from here
     admins: frozenset[str] = field(default_factory=frozenset)       # the first admins; others are given the role by an admin
+    answer_bucket: str = "m2-answers"                               # the private bucket for answer pictures (not mathly1's)
+    cache_seconds: float = 30                                       # how long slow-changing reads are remembered; 0 is off
+    vapid_private_key: str = ""                                     # the server's push key; push notifications are off without it
+    vapid_subject: str = ""                                         # a contact the push services may write to ("mailto:...")
 
     @property
     def supabase_on(self) -> bool:
@@ -51,4 +55,8 @@ def load_settings(env_file: Path | None = None) -> Settings:
         teachers=_emails("TEACHER_EMAILS"),
         developers=_emails("DEVELOPER_EMAILS"),
         admins=_emails("ADMIN_EMAILS"),
+        answer_bucket=env("MATHLY_M2_ANSWER_BUCKET") or "m2-answers",
+        cache_seconds=float(env("MATHLY_CACHE_SECONDS") or 30),
+        vapid_private_key=env("VAPID_PRIVATE_KEY"),
+        vapid_subject=env("VAPID_SUBJECT"),
     ).check()

mathly2/main.py

@@ -3,19 +3,24 @@ from __future__ import annotations
 
 import json
 import logging
+from contextlib import asynccontextmanager
 from pathlib import Path
 
 from fastapi import Depends, FastAPI, HTTPException
 from fastapi import Request
-from fastapi.responses import HTMLResponse, JSONResponse
+from fastapi.responses import FileResponse, HTMLResponse, JSONResponse
 from fastapi.staticfiles import StaticFiles
 
 from .access import RoleResolver, learner, permissions_of
 from .auth import DevAuthenticator, SupabaseAuthenticator, current_user
 from .bank import Bank, load_bank
-from . import accounts, classes, quizzes, reads, realtests, skills
+
+from . import accounts, assignments, classes, cleanup, quizzes, reads, realtests, skills, written
 from .config import Settings, load_settings
+from .cached import CachedStore
 from .store import InMemoryStore, StoreUnavailable, SupabaseStore
+from .pictures import MemoryPictures, PictureError, SupabasePictures
+from .push import Pusher, default_subject
 
 STATIC = Path(__file__).parent / "static"
 
@@ -31,29 +36,49 @@ class FreshStaticFiles(StaticFiles):
 log = logging.getLogger("mathly2")
 
 
-def create_app(settings: Settings | None = None, bank: Bank | None = None, store=None, authenticator=None) -> FastAPI:
-    app = FastAPI(title="Mathly 2")
+def create_app(settings: Settings | None = None, bank: Bank | None = None, store=None, authenticator=None, picture_store=None, pusher=None) -> FastAPI:
+    @asynccontextmanager
+    async def lifespan(application: FastAPI):
+        # Against the real database the pictures are tidied every hour (nothing runs without Supabase, so local runs and tests are quiet).
+        stop = cleanup.start_hourly(application.state.store, application.state.pictures) if application.state.settings.supabase_on else None
+        application.state.cleanup_stop = stop
+        yield
+        if stop:
+            stop.set()
+
+    app = FastAPI(title="Mathly 2", lifespan=lifespan)
     app.state.settings = settings = (settings or load_settings()).check()
     app.state.bank = bank or load_bank()   # a broken bank stops the server from starting
     if settings.supabase_on:
-        app.state.store = store or SupabaseStore(settings.supabase_url, settings.supabase_secret)
+        app.state.store = store or CachedStore(SupabaseStore(settings.supabase_url, settings.supabase_secret), settings.cache_seconds)
         app.state.authenticator = authenticator or SupabaseAuthenticator(settings.supabase_url, settings.supabase_key)
     else:
         app.state.store = store or InMemoryStore()
         app.state.authenticator = authenticator or DevAuthenticator()
 
+    app.state.pictures = picture_store or (SupabasePictures(settings.supabase_url, settings.supabase_secret, settings.answer_bucket)
+                                           if settings.supabase_on else MemoryPictures())
+    app.state.pusher = pusher or Pusher(app.state.store, settings.vapid_private_key, default_subject(settings))
+    app.state.notify_request = written.notify_new_request
     app.state.roles = RoleResolver(settings, app.state.store)
     @app.exception_handler(StoreUnavailable)
     async def store_unavailable(request: Request, exc: StoreUnavailable) -> JSONResponse:
         log.warning("database problem on %s %s: %s", request.method, request.url.path, exc)
         return JSONResponse({"detail": "מסד הנתונים לא ענה או סירב לבקשה. נסו שוב, ואם זה חוזר, בדקו שהמיגרציות הוחלו (ראו את יומן השרת)."}, status_code=503)
 
+    @app.exception_handler(PictureError)
+    async def picture_trouble(request: Request, exc: PictureError) -> JSONResponse:
+        return JSONResponse({"detail": written.MESSAGES.get(exc.code, exc.code)}, status_code=exc.status)
+
     app.include_router(classes.router)
     app.include_router(classes.teaching)
+    app.include_router(classes.curriculum)
     app.include_router(accounts.router)
     app.include_router(skills.router)
     app.include_router(quizzes.router)
     app.include_router(realtests.router)
+    app.include_router(written.router)
+    app.include_router(assignments.router)
 
     @app.get("/api/health")
     def health() -> dict:
@@ -78,8 +103,7 @@ def create_app(settings: Settings | None = None, bank: Bank | None = None, store
         everything = app.state.bank.lessons_with_skills()
         if set(user["roles"]) - {"student"}:
             return everything
-        mine = {lesson for c in reads.of(request).classes_of_student(user["email"]) for lesson in c["lessons"]}
-        return [lesson for lesson in everything if lesson["id"] in mine]
+        return everything if reads.of(request).classes_of_student(user["email"]) else []
 
     @app.get("/", include_in_schema=False)
     def index() -> HTMLResponse:
@@ -90,6 +114,12 @@ def create_app(settings: Settings | None = None, bank: Bank | None = None, store
         html = (STATIC / "index.html").read_text(encoding="utf-8").replace("__CONFIG__", text)
         return HTMLResponse(html, headers={"Cache-Control": "no-cache"})
 
+    @app.get("/service-worker.js", include_in_schema=False)
+    def service_worker() -> FileResponse:
+        # served from the root so it covers the whole app; the browser must check it for changes each time
+        return FileResponse(STATIC / "service-worker.js", media_type="text/javascript",
+                            headers={"Cache-Control": "no-cache", "Service-Worker-Allowed": "/"})
+
     app.mount("/static", FreshStaticFiles(directory=STATIC), name="static")
     return app
 

mathly2/pictures.py

@@ -0,0 +1,193 @@
+"""Pictures: students' written answers and the pages of a teacher's assignment. The server is the only door to them.
+
+An uploaded image is checked (JPEG, PNG or WebP, at most 5 MB and 20 million pixels), turned upright, stripped of its metadata and
+re-encoded as JPEG. A teacher's PDF becomes one picture per page. The bytes live in a private bucket read and written only with the server's
+key (`SupabasePictures`; `MemoryPictures` for tests and local development); the rows that name them are in `m2_pictures`."""
+from __future__ import annotations
+
+import io
+import json
+import logging
+import time
+import urllib.error
+import urllib.parse
+import uuid
+import warnings
+from datetime import datetime
+
+from PIL import Image, ImageOps, UnidentifiedImageError
+
+from . import pooled
+
+log = logging.getLogger("mathly.pictures")
+
+MAX_IMAGE = 5_000_000
+MAX_PDF = 10_000_000
+MAX_PAGES = 20
+MAX_SIDE = 2400                 # the longest side of a stored picture, in pixels
+PAGE_WIDTH = 1600               # a rendered PDF page
+RENDER_BUDGET = 30.0            # seconds for all the pages of one PDF
+ALLOWED = {"image/jpeg": "JPEG", "image/png": "PNG", "image/webp": "WEBP"}
+Image.MAX_IMAGE_PIXELS = 20_000_000
+
+
+class PictureError(Exception):
+    """A picture that cannot be taken, with the HTTP status to answer and a short code."""
+
+    def __init__(self, status: int, code: str) -> None:
+        super().__init__(code)
+        self.status, self.code = status, code
+
+
+def clean_image(data: bytes, content_type: str) -> bytes:
+    """A stored picture from an uploaded one: checked, upright, without metadata, as JPEG."""
+    if len(data) > MAX_IMAGE:
+        raise PictureError(413, "image_too_large")
+    expected = ALLOWED.get((content_type or "").split(";")[0].strip().lower())
+    if expected is None:
+        raise PictureError(415, "unsupported_image")
+    try:
+        with warnings.catch_warnings():
+            warnings.simplefilter("error", Image.DecompressionBombWarning)
+            image = Image.open(io.BytesIO(data))
+            if image.format != expected:
+                raise PictureError(415, "unsupported_image")
+            image.load()
+    except PictureError:
+        raise
+    except (UnidentifiedImageError, Image.DecompressionBombError, Image.DecompressionBombWarning, OSError, ValueError, SyntaxError) as exc:
+        raise PictureError(400, "bad_image") from exc
+    image = ImageOps.exif_transpose(image)
+    if image.mode in ("RGBA", "LA", "P"):                       # flatten transparency onto white
+        rgba = image.convert("RGBA")
+        flat = Image.new("RGB", rgba.size, "white")
+        flat.paste(rgba, mask=rgba.getchannel("A"))
+        image = flat
+    else:
+        image = image.convert("RGB")
+    image.thumbnail((MAX_SIDE, MAX_SIDE))
+    out = io.BytesIO()
+    image.save(out, "JPEG", quality=88)                         # a new file: none of the original's metadata comes along
+    return out.getvalue()
+
+
+def render_pdf(data: bytes) -> list[bytes]:
+    """The pages of a teacher's PDF as stored pictures (JPEG); PictureError 413, 415 or 400 when it is not one we take."""
+    if len(data) > MAX_PDF:
+        raise PictureError(413, "pdf_too_large")
+    if not data.startswith(b"%PDF-"):
+        raise PictureError(415, "not_a_pdf")
+    import pypdfium2 as pdfium
+    try:
+        doc = pdfium.PdfDocument(data)
+    except pdfium.PdfiumError as exc:
+        raise PictureError(400, "bad_pdf") from exc
+    try:
+        if len(doc) == 0:
+            raise PictureError(400, "bad_pdf")
+        if len(doc) > MAX_PAGES:
+            raise PictureError(413, "pdf_too_many_pages")
+        started, pages = time.monotonic(), []
+        for index in range(len(doc)):
+            if time.monotonic() - started > RENDER_BUDGET:
+                raise PictureError(413, "pdf_too_slow")
+            page = doc[index]
+            width = page.get_width() or 1
+            image = page.render(scale=PAGE_WIDTH / width).to_pil().convert("RGB")
+            out = io.BytesIO()
+            image.save(out, "JPEG", quality=85)
+            pages.append(out.getvalue())
+        return pages
+    finally:
+        doc.close()
+
+
+class MemoryPictures:
+    """The bytes of pictures in memory: tests and local development."""
+
+    def __init__(self) -> None:
+        self.files: dict[str, bytes] = {}
+
+    def put(self, path: str, data: bytes, content_type: str = "image/jpeg") -> None:
+        self.files[path] = data
+
+    def get(self, path: str) -> bytes:
+        try:
+            return self.files[path]
+        except KeyError:
+            raise PictureError(404, "picture_missing") from None
+
+    def delete(self, path: str) -> None:
+        self.files.pop(path, None)
+
+
+class SupabasePictures:
+    """The bytes of pictures in a private Supabase Storage bucket, read and written with the secret key. The bucket is made when first needed."""
+
+    def __init__(self, url: str, secret: str, bucket: str = "m2-answers") -> None:
+        self.url, self.secret, self.bucket = url.rstrip("/"), secret, bucket
+        self._ready = False
+
+    def _headers(self, content_type: str | None = None) -> dict:
+        headers = {"apikey": self.secret, "Authorization": f"Bearer {self.secret}", "User-Agent": "mathly2/1.0"}
+        if content_type:
+            headers["Content-Type"] = content_type
+        return headers
+
+    def _object(self, path: str) -> str:
+        return f"{self.url}/storage/v1/object/{self.bucket}/{urllib.parse.quote(path)}"
+
+    def ensure_bucket(self) -> None:
+        """Create the private bucket if it is not there (idempotent)."""
+        if self._ready:
+            return
+        body = json.dumps({"id": self.bucket, "name": self.bucket, "public": False}).encode()
+        try:
+            pooled.request("POST", f"{self.url}/storage/v1/bucket", self._headers("application/json"), body, 15)
+        except urllib.error.HTTPError as exc:
+            if exc.code not in (400, 409):                            # 400/409: it already exists
+                log.error("cannot create the picture bucket: %s", exc.code)
+                raise PictureError(503, "answer_storage_unavailable") from exc
+        except (urllib.error.URLError, TimeoutError) as exc:
+            raise PictureError(503, "answer_storage_unavailable") from exc
+        self._ready = True
+
+    def put(self, path: str, data: bytes, content_type: str = "image/jpeg") -> None:
+        self.ensure_bucket()
+        try:
+            pooled.request("POST", self._object(path), {**self._headers(content_type), "x-upsert": "true"}, data, 30)
+        except (urllib.error.HTTPError, urllib.error.URLError, TimeoutError) as exc:
+            log.error("cannot store a picture: %s", exc)
+            raise PictureError(503, "answer_storage_unavailable") from exc
+
+    def get(self, path: str) -> bytes:
+        try:
+            return pooled.request("GET", self._object(path), self._headers(), None, 30)[1]
+        except urllib.error.HTTPError as exc:
+            if exc.code in (400, 404):
+                raise PictureError(404, "picture_missing") from exc
+            raise PictureError(503, "answer_storage_unavailable") from exc
+        except (urllib.error.URLError, TimeoutError) as exc:
+            raise PictureError(503, "answer_storage_unavailable") from exc
+
+    def delete(self, path: str) -> None:
+        try:
+            pooled.request("DELETE", self._object(path), self._headers(), None, 30)
+        except urllib.error.HTTPError as exc:
+            if exc.code not in (400, 404):                            # already gone is fine
+                raise PictureError(503, "answer_storage_unavailable") from exc
+        except (urllib.error.URLError, TimeoutError) as exc:
+            raise PictureError(503, "answer_storage_unavailable") from exc
+
+
+def store_picture(store, backend, owner_id: str, kind: str, jpeg: bytes, created_at: datetime | None = None) -> dict:
+    """Keep one cleaned picture: its bytes in the bucket, its row in the database. Returns the row."""
+    path = f"{owner_id}/{uuid.uuid4()}.jpg"
+    backend.put(path, jpeg, "image/jpeg")
+    return store.create_picture(owner_id, kind, path, "image/jpeg", len(jpeg), created_at)
+
+
+def remove_picture(store, backend, picture: dict, at: datetime | None = None) -> None:
+    """Delete a picture's bytes and mark its row deleted (the row stays, so what referred to it can say "the pictures were deleted")."""
+    backend.delete(picture["path"])
+    store.mark_picture_deleted(picture["id"], at)

mathly2/push.py

@@ -0,0 +1,133 @@
+"""Push notifications: the student's phone is told when a computer asks for a photo of an answer (PRD PSH-1, PSH-2).
+
+The phone already looks for requests while the app is open; the notification brings the student to the app when it is closed. Only phones
+subscribe, so the computer that asked gets none. A subscription the push service no longer knows (404 or 410) is deleted, and changing the
+server's key (VAPID_PRIVATE_KEY) drops every subscription: each phone turns notifications on again. Without a key, notifications are off and
+everything else works. On an iPhone they work only from the app added to the home screen (iOS 16.4 and later).
+
+Make a key with `python -m mathly2.push` and keep it as a secret."""
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import logging
+from datetime import datetime
+
+log = logging.getLogger("mathly.push")
+MAX_ENDPOINT = 1000
+
+
+class Gone(Exception):
+    """The push service no longer knows this subscription (404 or 410)."""
+
+
+def _b64(raw: bytes) -> str:
+    return base64.urlsafe_b64encode(raw).rstrip(b"=").decode()
+
+
+def new_private_key() -> str:
+    """A new VAPID private key as VAPID_PRIVATE_KEY keeps it: the raw 32 bytes, base64url."""
+    from cryptography.hazmat.primitives.asymmetric import ec
+    return _b64(ec.generate_private_key(ec.SECP256R1()).private_numbers().private_value.to_bytes(32, "big"))
+
+
+def public_key(private: str) -> str:
+    """The browser's applicationServerKey for a private key: the uncompressed point, base64url. ValueError for a key that is not one."""
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import ec
+    try:
+        raw = base64.urlsafe_b64decode(private + "=" * (-len(private) % 4))
+    except ValueError as exc:
+        raise ValueError("not a 32-byte base64url key") from exc
+    if len(raw) != 32 or _b64(raw) != private:
+        raise ValueError("not a 32-byte base64url key")
+    key = ec.derive_private_key(int.from_bytes(raw, "big"), ec.SECP256R1())
+    return _b64(key.public_key().public_bytes(serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint))
+
+
+def request_payload(request: dict, assignment: dict | None) -> dict:
+    """What the service worker shows for a photo request. No question text or name: it may show on a locked screen. The tag is the assignment's,
+    so a newer request for the same answer replaces the older notification."""
+    return {"title": "📷 בקשת צילום מהמחשב", "body": f"קוד {request['code']} · צלמו את התשובה ושלחו למחשב.",
+            "url": f"/#/assignment/{request['assignment_id']}", "tag": f"photo-{request['assignment_id']}"}
+
+
+def seconds_left(request: dict, now: datetime) -> int:
+    """How long the push service should keep trying: until the request expires (a dead request is not worth a ring)."""
+    return max(0, min(900, int((request["expires_at"] - now).total_seconds())))
+
+
+def web_push(subscription: dict, payload: dict, private: str, subject: str, ttl: int) -> None:
+    """The real sender (pywebpush). Raises Gone for a subscription the push service no longer knows."""
+    from pywebpush import WebPushException, webpush
+    try:
+        webpush({"endpoint": subscription["endpoint"], "keys": {"p256dh": subscription["p256dh"], "auth": subscription["auth"]}},
+                json.dumps(payload, ensure_ascii=False), vapid_private_key=private, vapid_claims={"sub": subject}, ttl=ttl, timeout=10,
+                headers={"Urgency": "high"})                        # the student is waiting at the computer
+    except WebPushException as exc:
+        if getattr(exc.response, "status_code", None) in (404, 410):
+            raise Gone() from exc
+        raise
+
+
+class Pusher:
+    """Subscriptions and sending, on the store's table. `sender(subscription, payload, ttl)` is injectable so tests do not touch the network."""
+
+    def __init__(self, store, private: str = "", subject: str = "", sender=None) -> None:
+        self.store, self.private, self.subject = store, private.strip(), subject
+        self.public, self.why, self.key_id = "", "", ""
+        if not self.private:
+            self.why = "VAPID_PRIVATE_KEY is not set"
+        else:
+            try:
+                self.public = public_key(self.private)
+                self.key_id = hashlib.sha256(self.public.encode()).hexdigest()[:16]
+            except ValueError as exc:
+                log.error("VAPID_PRIVATE_KEY is not a valid key: push notifications are off (%s)", exc)
+                self.why = "VAPID_PRIVATE_KEY is not a valid key"
+        self.sender = sender or (lambda sub, payload, ttl: web_push(sub, payload, self.private, self.subject, ttl))
+
+    @property
+    def on(self) -> bool:
+        return not self.why
+
+    def subscribe(self, user_id: str, body: dict) -> None:
+        """Keep a browser's subscription for this account (ValueError when it is not one). Subscriptions made under another key are dropped first."""
+        endpoint, keys = str(body.get("endpoint") or ""), body.get("keys") or {}
+        if not endpoint.startswith("https://") or len(endpoint) > MAX_ENDPOINT or not isinstance(keys, dict):
+            raise ValueError("not a push subscription")
+        p256dh, auth = str(keys.get("p256dh") or ""), str(keys.get("auth") or "")
+        if not (0 < len(p256dh) <= 200 and 0 < len(auth) <= 100):
+            raise ValueError("not a push subscription")
+        self.store.drop_push_subscriptions_not_of(self.key_id)
+        self.store.add_push_subscription(user_id, endpoint, p256dh, auth, self.key_id)
+
+    def notify(self, user_id: str, payload: dict, ttl: int) -> int:
+        """Send to the account's phones; how many went. A dead subscription is deleted, other failures are logged (the phone still finds the
+        request when the app opens)."""
+        if not self.on or ttl <= 0:
+            return 0
+        self.store.drop_push_subscriptions_not_of(self.key_id)
+        sent = 0
+        for sub in self.store.push_subscriptions_of(user_id):
+            try:
+                self.sender(sub, payload, ttl)
+                sent += 1
+            except Gone:
+                self.store.delete_push_subscription(sub["endpoint"])
+            except Exception as exc:
+                log.warning("push failed: %s", exc)
+        return sent
+
+
+def default_subject(settings) -> str:
+    if settings.vapid_subject:
+        return settings.vapid_subject
+    first = sorted(settings.developers)
+    return f"mailto:{first[0]}" if first else "mailto:admin@example.com"
+
+
+if __name__ == "__main__":
+    key = new_private_key()
+    print(f"VAPID_PRIVATE_KEY={key}\n# its public key (the page reads it from the server): {public_key(key)}")

mathly2/quiz.py

@@ -1,8 +1,9 @@
-"""Drawing a lesson quiz: 10 multiple-choice questions from the lesson's skills, spread evenly, new questions first on a retake."""
+"""Drawing a lesson quiz: 15 multiple-choice questions from the lesson's skills, spread evenly, new questions first on a retake."""
 from __future__ import annotations
 
 import random
 
+from . import attempts
 from .attempts import QUIZ_SIZE
 
 
@@ -35,15 +36,15 @@ def draw(bank, lesson_id: str, used: dict[str, int] | None = None, rng: random.R
 def facts(store, bank, user_id: str, now, reads=None) -> dict[str, dict]:
     """Per lesson the student has attempted: {best, attempts, open, last}. Overdue open attempts are settled first, so a quiz abandoned
     past its deadline is graded from the answers given. `best` is None until an attempt is submitted."""
-    from . import attempts
     found: dict[str, dict] = {}
     for row in (reads or store).attempts_of(user_id, "quiz"):
         row = attempts.settle(store, bank, row, now)
-        item = found.setdefault(row["scope"], {"best": None, "attempts": 0, "open": None, "last": None})
+        item = found.setdefault(row["scope"], {"best": None, "attempts": 0, "open": None, "last": None, "passed": False})
         if attempts.is_open(row):
             item["open"] = {"id": row["id"], "due_at": row["due_at"]}
             continue
         item["attempts"] += 1
+        item["passed"] = item["passed"] or row["grade"] >= attempts.PASS_GRADE
         item["best"] = row["grade"] if item["best"] is None else max(item["best"], row["grade"])
         item["last"] = row["submitted_at"]
     return found

mathly2/quizzes.py

@@ -163,4 +163,5 @@ def grades(request: Request, user: dict = Depends(learner)) -> dict:
             simulations.append(item)
     exercise.sort(key=lambda g: (g["test"]["date"], g["test"]["id"], g["number"]))
     simulations.sort(key=lambda g: (g["test"]["date"], g["test"]["id"]))
-    return {"quizzes": lessons, "exercise_tests": exercise, "simulations": simulations}
+    from .assignments import grade_rows
+    return {"quizzes": lessons, "exercise_tests": exercise, "simulations": simulations, "assignments": grade_rows(request, user)}

mathly2/reads.py

@@ -11,7 +11,7 @@ from fastapi import Request
 POOL = ThreadPoolExecutor(max_workers=16, thread_name_prefix="db")
 
 READS = frozenset({"classes_of_student", "classes_taught", "progress_of", "last_answered", "daily_correct", "recent_skills", "attempts_of",
-                   "tests_of_classes", "get_progress", "answers_of", "reward_state", "comets_of", "members", "get_class", "get_test", "roles_of"})
+                   "tests_of_classes", "get_progress", "answers_of", "reward_state", "comets_of", "members", "get_class", "get_test", "roles_of", "assignments_of_classes", "submissions_of_user", "get_assignment", "get_submission", "curriculum"})
 
 
 def _key(name: str, args: tuple) -> tuple:

mathly2/requirements.txt

@@ -3,3 +3,6 @@ uvicorn[standard]>=0.29
 anyio>=4.10,<4.11  # Python 3.10: newer releases can hang Starlette's worker-thread bridge
 python-dotenv>=1.0
 tzdata>=2024.1
+Pillow==12.3.0  # checks and cleans answer pictures (mathly2/pictures.py)
+pypdfium2>=4.30,<6  # a teacher's PDF to page images
+pywebpush>=2.0,<3  # notifications to a student's phone for a photo request

mathly2/retention.py

@@ -0,0 +1,17 @@
+"""How long pictures are kept (PRD ANS-3): answer pictures until the end of the school year (31 August), unreferenced pictures for a day,
+assignment pages until their assignment is removed. Grades and teachers' notes are never touched: only the pictures go."""
+from __future__ import annotations
+
+from datetime import date, timedelta
+
+ORPHAN_AGE = timedelta(hours=24)
+
+
+def expires_on(day: date) -> date:
+    """The last day an answer picture made on `day` is kept: 31 August of its school year (1 September to 31 August)."""
+    return date(day.year + 1 if day.month >= 9 else day.year, 8, 31)
+
+
+def is_expired(created_day: date, today: date) -> bool:
+    """An answer picture is removed from 1 September on."""
+    return today > expires_on(created_day)

mathly2/skills.py

@@ -82,10 +82,12 @@ def _round_view(request: Request, skill_id: str, rows: list[dict], round_start:
 
 
 def visible_lesson_ids(request: Request, user: dict) -> set[str] | None:
-    """The lessons the student can see: those of their classes. None means all (a teacher or a developer)."""
+    """The lessons the student can see: every lesson once they are in a class, none before. None means all (a teacher or a developer)."""
     if set(user["roles"]) - {"student"}:
         return None
-    return {lesson for c in reads.of(request).classes_of_student(user["email"]) for lesson in c["lessons"]}
+    if not reads.of(request).classes_of_student(user["email"]):
+        return set()
+    return {lesson["id"] for lesson in request.app.state.bank.lessons}
 
 
 @router.get("/skills/{skill_id}")
@@ -199,11 +201,11 @@ def _comet_due(request: Request, user_id: str, today_now: dict, state: dict | No
 @router.get("/path")
 def path(request: Request, user: dict = Depends(learner)) -> dict:
     store, here, uid = request.app.state.store, reads.of(request), user["id"]
-    here.prefetch(("progress_of", uid), ("last_answered", uid), ("daily_correct", uid), ("recent_skills", uid, RECENT), ("attempts_of", uid, "quiz"))
+    here.prefetch(("progress_of", uid), ("last_answered", uid), ("daily_correct", uid), ("recent_skills", uid, RECENT), ("attempts_of", uid, "quiz"), ("curriculum",))
     states = {p["skill_id"]: skill_state(p) for p in here.progress_of(uid)}
     last, today = here.last_answered(uid), clock.school_day()
     quizzes_facts = quiz.facts(store, request.app.state.bank, uid, clock.now(), here)
-    shown = visible_lesson_ids(request, user)
+    shown, dates = visible_lesson_ids(request, user), here.curriculum()
     lessons, order = [], []
     for lesson in request.app.state.bank.lessons_with_skills():
         if shown is not None and lesson["id"] not in shown:
@@ -214,11 +216,15 @@ def path(request: Request, user: dict = Depends(learner)) -> dict:
         order += [s["id"] for s in skills]
         mastered = sum(1 for s in skills if s["state"] == MASTERED)
         fact = quizzes_facts.get(lesson["id"], {})
+        passed = bool(fact.get("passed"))
+        completed = passed or (bool(skills) and mastered == len(skills))
+        due = dates.get(lesson["id"])
         lessons.append({"id": lesson["id"], "name": lesson["name"], "skills": skills, "mastered": mastered,
-                        "completed": bool(skills) and mastered == len(skills),
+                        "completed": completed, "passed": passed, "due_date": due.isoformat() if due else None,
+                        "behind": bool(due and due < today and not completed),
                         "quiz": {"best": fact.get("best"), "open": bool(fact.get("open")), "due_at": fact["open"]["due_at"].isoformat() if fact.get("open") else None}})
     daily = here.daily_correct(uid)
-    return {"lessons": lessons, "next": next_skill(order, states, here.recent_skills(uid, RECENT)),
+    return {"lessons": lessons, "behind": sum(1 for l in lessons if l["behind"]), "next": next_skill(order, states, here.recent_skills(uid, RECENT)),
             "today": today_progress(daily, today), "streak": streak(daily, today)}
 
 

mathly2/static/api.js

@@ -1,4 +1,5 @@
-import { token } from "./session.js";
+import { track } from "./busy.js";
+import { onSignOut, token } from "./session.js";
 
 export class ApiError extends Error {
   constructor(status, message) { super(message); this.status = status; }
@@ -6,12 +7,49 @@ export class ApiError extends Error {
 
 const MESSAGES = { 503: "שירות ההתחברות לא זמין כרגע, נסו שוב בעוד רגע", 403: "אין הרשאה לפעולה הזו" };
 
-export async function api(path, { method = "GET", body } = {}) {
+const remembered = new Map();                    // GET path -> the last answer
+let changes = 0;                                 // counts changes, so an answer to a read that began before one is not kept
+onSignOut(() => { remembered.clear(); changes++; });
+
+async function request(path, { method = "GET", body } = {}) {
+  const started = changes;
+  if (method !== "GET") { remembered.clear(); changes++; }      // after a change of theirs, no old answer is ever shown
   const headers = { Authorization: "Bearer " + await token() };
   if (body !== undefined) headers["Content-Type"] = "application/json";
   const response = await fetch(path, { method, headers, body: body === undefined ? undefined : JSON.stringify(body) });
-  if (response.ok) return response.status === 204 ? null : response.json();
+  if (response.ok) {
+    const data = response.status === 204 ? null : await response.json();
+    if (method === "GET") { if (started === changes) remembered.set(path, data); }
+    else { remembered.clear(); changes++; }
+    return data;
+  }
   let detail = "";
   try { detail = (await response.json()).detail; } catch { /* no body */ }
   throw new ApiError(response.status, typeof detail === "string" && detail ? detail : (MESSAGES[response.status] || "משהו השתבש, נסו שוב"));
 }
+
+/** A request to the server. The button that was just pressed shows it is working if the answer takes a moment (busy.js). */
+export const api = (path, options) => track(request(path, options));
+
+/** The last answer for this GET path, or undefined (nothing yet, or something was changed since). */
+export const lastAnswer = path => remembered.get(path);
+
+let screen = 0;
+const busyNow = () => {
+  const here = document.activeElement;
+  return !!(here && here.matches?.("input, textarea, select, [contenteditable]")) || !!document.querySelector("main details[open], .sheet, dialog[open]");
+};
+
+/** Shows a screen: draws `render(data)` at once from the last answer if there is one, then draws again when the fresh answer
+ *  differs, unless the person has moved on, is typing, or has something open. Without a last answer it waits, as before.
+ *  `path` may be a list: then `render` gets the answers as a list. */
+export async function swr(path, render) {
+  const paths = Array.isArray(path) ? path : [path], one = !Array.isArray(path);
+  const give = list => render(one ? list[0] : list);
+  const mine = ++screen, hash = location.hash, before = paths.map(p => remembered.get(p));
+  if (before.some(x => x === undefined)) return give(await Promise.all(paths.map(p => api(p))));
+  give(before);
+  Promise.all(paths.map(p => api(p))).then(fresh => {
+    if (mine === screen && hash === location.hash && JSON.stringify(fresh) !== JSON.stringify(before) && !busyNow()) give(fresh);
+  }).catch(() => { /* the screen already shows what it knew */ });
+}

mathly2/static/app.css

@@ -168,6 +168,11 @@ button.danger { color: var(--danger); border-color: var(--danger); }
 .orbit .hub h3 { margin: 0; font-size: 13px; line-height: 1.25; }
 .orbit .hub .count { display: inline-block; margin-top: 4px; font-size: 11px; border: 1px solid var(--line); border-radius: 999px; padding: 1px 8px; color: var(--muted); }
 .orbit.completed .hub { box-shadow: 0 0 0 3px var(--sky-gold); }
+.orbit.behind .hub { box-shadow: 0 0 0 3px var(--sky-warn, #ff9f6b); }
+.lesson-status { margin: 0 auto 6px; text-align: center; font-size: 13px; font-weight: 600; }
+.lesson-status.late, .behind-note { color: var(--sky-warn, #ff9f6b); }
+.lesson-status.done { color: var(--sky-gold); }
+.behind-note { margin: 8px 0 0; font-weight: 600; }
 .star { position: absolute; left: calc(50% + var(--dx) * var(--R)); top: calc(50% + var(--dy) * var(--R) * 1.1); transform: translate(-50%, -26px);
   width: 84px; display: flex; flex-direction: column; align-items: center; gap: 3px; text-decoration: none; color: var(--text); border-radius: 12px; }
 .star:focus-visible { outline: 3px solid var(--accent); outline-offset: 3px; }
@@ -309,7 +314,7 @@ ul.grades .bar, ul.grades .muted { grid-column: 1 / -1; }
 /* The student's tab bar sits at the bottom of the screen, above the page and below the sheets */
 .tabs { position: fixed; inset-inline: 0; bottom: 0; z-index: 40; margin: 0; gap: 4px; padding: 6px 8px calc(6px + env(safe-area-inset-bottom, 0px));
   background: var(--surface); border-top: 1px solid var(--line); }
-.tabs a { min-height: 44px; display: grid; place-items: center; border: 0; border-radius: 10px; font-weight: 600; }
+.tabs a { min-height: 44px; display: grid; place-items: center; border: 0; border-radius: 10px; font-weight: 600; font-size: 15px; padding-inline: 2px; }
 body:has(.tabs) main { padding-bottom: calc(76px + env(safe-area-inset-bottom, 0px)); }
 
 /* Home */
@@ -370,3 +375,64 @@ ol.plan li.done .mark { color: var(--sky-aurora); }
 .ex-score { margin: 0; font-size: 18px; }
 .ex-score b { font-size: 44px; line-height: 1; color: var(--sky-gold); }
 .ex-missed { padding-inline-start: 22px; display: grid; gap: 12px; }
+
+/* My assignments */
+ul.assignments li { display: grid; grid-template-columns: 1fr auto; gap: 2px 10px; align-items: center; }
+ul.assignments li a { color: var(--text); text-decoration: none; }
+ul.assignments li .tag { grid-column: 2; grid-row: 1 / span 2; white-space: nowrap; }
+ul.assignments li[data-state="returned"] .tag, ul.assignments li[data-state="not_handed"] .tag { border-color: var(--sky-gold); color: var(--text); }
+
+/* An assignment */
+.pages { display: grid; gap: 10px; }
+.pages img { max-width: 100%; height: auto; border-radius: 10px; border: 1px solid var(--line); background: #fff; }
+.qz-written { padding-inline-start: 22px; display: grid; gap: 14px; }
+.drafts { display: flex; flex-wrap: wrap; gap: 10px; }
+.drafts li { position: relative; list-style: none; border: 1px solid var(--line); border-radius: 10px; padding: 4px; max-width: 46%; }
+.drafts img { display: block; max-width: 100%; max-height: 160px; border-radius: 8px; background: #fff; }
+.drafts .remove { position: absolute; inset-block-start: -8px; inset-inline-end: -8px; width: 28px; height: 28px; min-height: 0; padding: 0; border-radius: 50%; }
+.actions { display: flex; flex-wrap: wrap; gap: 8px; }
+.button.file { cursor: pointer; }
+.returned { border: 2px solid var(--sky-gold); border-radius: 12px; padding: 10px 14px; background: color-mix(in srgb, var(--sky-gold) 12%, var(--surface)); }
+.grade-big b { font-size: 40px; color: var(--sky-gold); }
+.teacher-note { margin: 6px 0; }
+
+/* The photo request */
+.photo-request { border: 2px dashed var(--sky-accent); border-radius: 14px; padding: 10px 14px; margin-top: 8px; }
+.code { font-size: 34px; letter-spacing: 6px; color: var(--sky-gold); }
+.old-requests { margin-top: 6px; font-size: 14px; color: var(--muted); }
+.photo-window { position: fixed; inset: 0; z-index: 95; display: grid; place-items: center; padding: 16px; background: rgb(0 0 0 / .7); }
+.photo-window .sheet { width: min(100%, 360px); background: var(--surface); border: 2px solid var(--sky-gold); border-radius: 18px; padding: 16px; display: grid; gap: 6px; text-align: center; }
+.photo-window h3 { margin: 0; }
+
+/* The teacher's work tab */
+.assignment-form { display: grid; gap: 8px; margin-top: 8px; }
+.assignment-form label { display: grid; gap: 4px; }
+.assignment-form label.check, .assignment-form label.file { display: inline-flex; gap: 6px; align-items: center; }
+.assignment-form fieldset { border: 1px solid var(--line); border-radius: 10px; padding: 8px 12px; }
+.tags { display: flex; flex-wrap: wrap; gap: 6px; margin: 4px 0; }
+.tag.waiting { border-color: var(--sky-gold); font-weight: 700; }
+
+.open-submission { width: 100%; min-height: 56px; text-align: start; }
+
+/* A button whose action takes time: a spinner, and a second press does nothing (busy.js). With reduced motion: "…" */
+.busy { pointer-events: none; opacity: .85; }
+.busy::after { content: ""; display: inline-block; width: 14px; height: 14px; margin-inline-start: 8px; vertical-align: -2px; border-radius: 50%;
+  border: 2px solid currentColor; border-top-color: transparent; animation: ex-spin .8s linear infinite; }
+@media (prefers-reduced-motion: reduce) { .busy::after { content: "…"; width: auto; height: auto; border: 0; border-radius: 0; animation: none; vertical-align: baseline; } }
+
+/* The number of items in a teacher's tab */
+.tab-count { display: inline-block; min-width: 22px; padding: 0 6px; margin-inline-start: 4px; border-radius: 999px; font-size: 13px; line-height: 20px; text-align: center;
+  background: color-mix(in srgb, var(--text) 16%, transparent); font-weight: 800; }
+.tab-count:empty { display: none; }
+[aria-pressed="true"] > .tab-count { background: color-mix(in srgb, var(--accent-text) 22%, transparent); }
+
+/* The submissions tab */
+.group { margin-top: 12px; }
+.group h3 { margin: 0 0 6px; font-size: 16px; }
+
+/* A student's row on the teacher's class card: the address, its state and two buttons must wrap on a phone */
+ul.students li { flex-wrap: wrap; }
+ul.students li [dir="ltr"] { overflow-wrap: anywhere; min-width: 0; }
+.curriculum li { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 6px 12px; padding: 6px 0; border-bottom: 1px solid var(--line); }
+.curriculum label { flex: 1 1 200px; }
+.curriculum input[type=date] { flex: 0 0 auto; }

mathly2/static/assignment.js

@@ -0,0 +1,144 @@
+// One assignment: its material (pages or the bank's written quiz), the student's answer as pictures (from the board, the camera, a file or
+// the phone) and handing it in; afterwards its state, and the grade and note or the request to correct.
+import { api } from "./api.js";
+import { loadBoard } from "./exercise.js";
+import { figures } from "./figures.js";
+import { assignmentState } from "./home.js";
+import { withBusy } from "./busy.js";
+import { esc, fmt } from "./math.js";
+import { isTouch, pictureUrl, prepare, sendPicture } from "./media.js";
+import * as phone from "./phone.js";
+import { shortDate, tabs } from "./ui.js";
+
+let draw = null, current = null, draft = [], message = "";
+
+const draftKey = id => `assignment-draft:${id}`;
+const saveDraft = () => { try { sessionStorage.setItem(draftKey(current.id), JSON.stringify(draft)); } catch { /* private window */ } };
+const loadDraft = id => { try { return JSON.parse(sessionStorage.getItem(draftKey(id)) || "null"); } catch { return null; } };
+const q = selector => document.querySelector(selector);
+const editable = a => ["not_handed", "handed_in", "returned"].includes(a.state);
+
+/** Fill an <img> with a private picture (fetched with the sign-in). */
+async function fill(img, id) {
+  try { img.src = await pictureUrl(id); img.hidden = false; } catch (error) { img.replaceWith(Object.assign(document.createElement("span"), { className: "muted", textContent: error.message })); }
+}
+
+function material(a) {
+  if (a.kind === "exercise_test") return `<p><a class="button primary" href="#/exam/${a.test.id}/${a.test.number}">למבחן התרגול</a></p>`;
+  if (a.kind === "quiz" && a.quiz) {
+    return `<h3>הבוחן הכתוב <span class="muted">(${a.quiz.minutes} דקות · ${a.quiz.points} נקודות)</span></h3><ol class="qz-written" id="written-quiz">${a.quiz.questions.map(x =>
+      `<li><p class="ex-text" dir="auto">${fmt(x.question)}</p>${figures(x)}<span class="muted">${x.points} נק׳</span></li>`).join("")}</ol>`;
+  }
+  return a.pages.length ? `<h3>הדף</h3><div class="pages" id="pages">${a.pages.map((id, i) => `<img data-picture="${esc(id)}" alt="עמוד ${i + 1}" hidden>`).join("")}</div>` : "";
+}
+
+function stateBox(a) {
+  const s = assignmentState(a);
+  const note = a.teacher_note ? `<p class="teacher-note" id="teacher-note"><b>הערת המורה:</b> ${fmt(a.teacher_note)}</p>` : "";
+  const head = `<p id="state" role="status"><span class="tag st-${esc(a.state)}"><span aria-hidden="true">${s.symbol}</span> ${s.word}</span></p>`;
+  if (a.state === "returned") return `${head}<div class="returned" id="returned"><b>המורה החזיר/ה את המשימה לתיקון.</b>${note}<p>תקנו והגישו שוב.</p></div>`;
+  if (a.state === "graded") return `${head}<p class="grade-big" id="grade">הציון: <b>${a.grade}</b></p>${note}`;
+  return head;
+}
+
+function draftHtml() {
+  return draft.length ? draft.map(id => `<li data-picture-id="${esc(id)}"><img data-picture="${esc(id)}" alt="תמונה של התשובה" hidden>
+    <button type="button" class="remove" data-remove="${esc(id)}" aria-label="הסרת התמונה">✕</button></li>`).join("") : `<li class="muted" id="draft-empty">עוד לא הוספתם תמונה.</li>`;
+}
+
+function renderDraft() {
+  q("#draft").innerHTML = draftHtml();
+  q("#draft").querySelectorAll("img[data-picture]").forEach(img => fill(img, img.dataset.picture));
+  q("#hand-in").disabled = !draft.length;
+  saveDraft();
+}
+
+function answerBox(a) {
+  if (a.kind === "exercise_test") return "";
+  if (!editable(a)) {
+    return a.pictures.length ? `<section class="card" id="answer"><h3>התשובה שהגשתי</h3><div class="pages" id="submitted">${a.pictures.map(p => p.deleted
+      ? `<p class="muted" data-deleted>התמונות נמחקו</p>` : `<img data-picture="${esc(p.id)}" alt="התשובה שהגשתי" hidden>`).join("")}</div></section>` : "";
+  }
+  return `<section class="card" id="answer"><h3>${a.state === "handed_in" ? "התשובה שהגשתי (אפשר להחליף עד שהמורה בודק/ת)" : "התשובה שלי"}</h3>
+    <ul class="plain drafts" id="draft">${draftHtml()}</ul>
+    <p class="actions" id="add-actions"><button type="button" id="board-btn">✎ כתיבה על הלוח</button>
+      ${isTouch() ? `<label class="button file">📷 צילום<input type="file" accept="image/*" capture="environment" hidden data-file="camera"></label>` : ""}
+      <label class="button file">🖼 העלאת תמונה<input type="file" accept="image/jpeg,image/png,image/webp" multiple hidden data-file="upload"></label>
+      ${!isTouch() ? `<button type="button" id="ask-phone">📱 בקשת צילום מהטלפון</button>` : ""}</p>
+    <div id="phone-panel"></div>
+    <p class="error" id="add-error" role="alert" hidden></p>
+    <p><button type="button" class="primary" id="hand-in" disabled>${a.state === "handed_in" ? "החלפת ההגשה" : "הגשה"}</button></p>
+    <p id="hand-msg" role="status" class="muted">${esc(message)}</p></section>`;
+}
+
+function add(id) {
+  if (!q("#draft")) return;                                         // the page was left while a photo was on its way
+  if (!draft.includes(id)) draft.push(id);
+  renderDraft();
+}
+
+async function addFiles(files) {
+  const error = q("#add-error");
+  error.hidden = true;
+  for (const file of files) {
+    if (draft.length >= 10) { error.textContent = "אפשר להגיש עד 10 תמונות"; error.hidden = false; break; }
+    try {
+      add((await sendPicture("/api/pictures", await prepare(file))).id);
+    } catch (e) { error.textContent = e.message; error.hidden = false; }
+  }
+}
+
+async function openBoard() {
+  await loadBoard();
+  if (!window.MathlyBoard?.openFull) return;
+  const host = Object.assign(document.createElement("div"), { className: "mx-layer" });
+  document.body.append(host);
+  window.MathlyBoard.openFull({
+    host, key: `assignment:${current.id}`, title: "כתיבה על הלוח", sendLabel: "הוספה להגשה",
+    submit: async (page, blob) => {
+      if (draft.length >= 10) return { error: "אפשר להגיש עד 10 תמונות" };
+      try { add((await sendPicture("/api/pictures", blob)).id); return {}; } catch (e) { return { error: e.message }; }
+    },
+    done: () => host.remove(),
+  });
+}
+
+async function handIn() {
+  const button = q("#hand-in");
+  button.disabled = true;
+  q("#hand-msg").textContent = "שולחים…";
+  try {
+    await api(`/api/assignments/${current.id}/submission`, { method: "POST", body: { pictures: draft } });
+    try { sessionStorage.removeItem(draftKey(current.id)); } catch { /* nothing */ }
+    message = "ההגשה נשלחה. המורה יבדוק/תבדוק.";
+    await show(draw, current.id);
+  } catch (error) {
+    button.disabled = false;
+    q("#hand-msg").textContent = "";
+    q("#add-error").textContent = error.message || "משהו השתבש";
+    q("#add-error").hidden = false;
+  }
+}
+
+export async function show(view, id) {
+  draw = view;
+  current = await api(`/api/assignments/${encodeURIComponent(id)}`);
+  const saved = loadDraft(current.id);
+  draft = editable(current) ? (saved ?? current.pictures.filter(p => !p.deleted).map(p => p.id)) : [];
+  view(`${tabs("submissions")}<p><a class="back" href="#/submissions">‹ ההגשות</a></p>
+    <section class="card" id="assignment" data-id="${current.id}" data-state="${esc(current.state)}"><h2>${fmt(current.title)}</h2>
+      <p class="muted">${esc(current.class.name)} · עד ${shortDate(current.due_date)}${current.overdue ? " · באיחור" : ""}</p>
+      ${current.note ? `<p id="assignment-note">${fmt(current.note)}</p>` : ""}${stateBox(current)}</section>
+    <section class="card" id="material">${material(current)}</section>${answerBox(current)}`);
+  document.querySelectorAll("img[data-picture]:not(#draft img)").forEach(img => fill(img, img.dataset.picture));
+  if (!editable(current) || current.kind === "exercise_test") return;
+  renderDraft();
+  q("#board-btn").addEventListener("click", openBoard);
+  q("#hand-in").addEventListener("click", handIn);
+  q("#draft").addEventListener("click", event => {
+    const id = event.target.closest("[data-remove]")?.dataset.remove;
+    if (id) { draft = draft.filter(x => x !== id); renderDraft(); }
+  });
+  document.querySelectorAll("[data-file]").forEach(input => input.addEventListener("change", async () => { const files = [...input.files]; input.value = ""; await withBusy(input.closest("label"), addFiles(files)); }));
+  q("#ask-phone")?.addEventListener("click", () => phone.askFromComputer(current, id => add(id), q("#phone-panel")));
+}

mathly2/static/busy.js

@@ -0,0 +1,54 @@
+// A button whose action takes time shows it. One hook for the whole app: the button (or the form's submit button) that was just pressed is
+// remembered, and every request made right after that marks it busy if the answer takes longer than about a third of a second: a spinner, and
+// a second press does nothing, until the request ends. Quick actions never flash it. Uploads (a file chooser's label) use `withBusy` directly.
+const DELAY = 300;                 // milliseconds before the button shows it is working
+const WINDOW = 600;                // a request counts as the button's when it starts within this time of the press
+const SKIP = ".ex-choice, .qz-choice, .mx-board, [data-board-toggle]";      // these show their own state
+
+let pressed = null, pressedAt = 0;
+const counts = new WeakMap();
+
+function target(event) {
+  const el = event.target?.closest?.("button, .button, [type=submit]");
+  return el && !el.closest(SKIP) ? el : null;
+}
+
+function mark(el) {
+  counts.set(el, (counts.get(el) || 0) + 1);
+  el.classList.add("busy");
+  el.setAttribute("aria-busy", "true");
+}
+
+function unmark(el) {
+  const left = (counts.get(el) || 1) - 1;
+  counts.set(el, left);
+  if (left <= 0) { el.classList.remove("busy"); el.removeAttribute("aria-busy"); }
+}
+
+document.addEventListener("click", event => {
+  const el = target(event);
+  if (!el) return;
+  if (el.classList.contains("busy")) { event.preventDefault(); event.stopImmediatePropagation(); return; }     // a second press while it works
+  pressed = el;
+  pressedAt = performance.now();
+}, true);
+
+document.addEventListener("submit", event => {
+  if (event.submitter?.classList.contains("busy")) { event.preventDefault(); event.stopImmediatePropagation(); return; }
+  if (event.submitter && !event.submitter.closest(SKIP)) { pressed = event.submitter; pressedAt = performance.now(); }
+}, true);
+
+/** Follow a promise for a button: after a third of a second the button shows it is working. Returns the promise. */
+export function withBusy(el, promise) {
+  if (!el) return promise;
+  const timer = setTimeout(() => { if (el.isConnected) { el.dataset.busyOn = "1"; mark(el); } }, DELAY);
+  const done = () => { clearTimeout(timer); if (el.dataset.busyOn) { delete el.dataset.busyOn; unmark(el); } };
+  promise.then(done, done);
+  return promise;
+}
+
+/** Follow a request for the button that was just pressed (if one was pressed a moment ago). Used by `api()`. */
+export function track(promise) {
+  const el = performance.now() - pressedAt < WINDOW && pressed?.isConnected ? pressed : null;
+  return withBusy(el, promise);
+}

mathly2/static/grades.js

@@ -1,6 +1,6 @@
 // The student's grades: each lesson's best quiz grade, and each real test's exercise tests and simulation (best grade, tries, last date).
 // Assignments will add their rows later.
-import { api } from "./api.js";
+import { swr } from "./api.js";
 import { esc, fmt } from "./math.js";
 import { shortDate, tabs } from "./ui.js";
 
@@ -16,15 +16,21 @@ function row({ attrs, href, title, best, attempts, last }) {
 
 const testTitle = (t, suffix) => `מבחן ב־${shortDate(t.date)}: ${suffix}${t.removed ? " (הוסר)" : ""}`;
 
-export async function show(view) {
-  const { quizzes, exercise_tests: exercises = [], simulations = [] } = await api("/api/grades");
-  const none = !quizzes.length && !exercises.length && !simulations.length;
+export const show = view => swr("/api/grades", data => draw(view, data));
+
+function draw(view, { quizzes, exercise_tests: exercises = [], simulations = [], assignments = [] }) {
+  const none = !quizzes.length && !exercises.length && !simulations.length && !assignments.length;
   view(`${tabs("grades")}<section class="card" id="grades"><h2>הציונים שלי</h2>
     ${none ? `<p class="muted" id="no-grades">עוד אין ציונים. הבוחן של כל שיעור מחכה בסוף השיעור במסלול.</p>` : ""}
     ${quizzes.length ? `<h3>בחנים</h3><ul class="plain grades" id="quiz-grades">${quizzes.map(g => row({ attrs: `data-lesson="${esc(g.lesson.id)}"`, href: `#/quiz/${esc(g.lesson.id)}`,
       title: fmt(g.lesson.name), best: g.best, attempts: g.attempts, last: g.last })).join("")}</ul>` : ""}
     ${exercises.length ? `<h3>מבחני תרגול</h3><ul class="plain grades" id="exercise-grades">${exercises.map(g => row({ attrs: `data-test="${g.test.id}" data-number="${g.number}"`,
       href: `#/test/${g.test.id}`, title: testTitle(g.test, `מבחן תרגול ${g.number}`), best: g.best, attempts: g.attempts, last: g.last })).join("")}</ul>` : ""}
+    ${assignments.length ? `<h3>משימות</h3><ul class="plain grades" id="assignment-grades">${assignments.map(g => `<li data-assignment="${g.assignment.id}">
+        <a href="#/assignment/${g.assignment.id}"><b>${fmt(g.assignment.title)}</b>${g.assignment.removed ? " (הוסרה)" : ""}</a>
+        <span class="gr-num" aria-label="הציון ${g.grade}">${g.grade}</span>
+        <span class="bar" role="progressbar" aria-valuemin="0" aria-valuemax="100" aria-valuenow="${g.grade}"><i style="width:${g.grade}%"></i></span>
+        ${g.note ? `<span class="muted gr-note">הערת המורה: ${fmt(g.note)}</span>` : `<span class="muted">${g.assignment.kind === "exercise_test" ? "מבחן תרגול" : "משימה"}</span>`}</li>`).join("")}</ul>` : ""}
     ${simulations.length ? `<h3>מבחני סימולציה</h3><ul class="plain grades" id="simulation-grades">${simulations.map(g => row({ attrs: `data-test="${g.test.id}"`,
       href: `#/test/${g.test.id}`, title: testTitle(g.test, "מבחן סימולציה"), best: g.best, attempts: g.attempts, last: g.last })).join("")}</ul>` : ""}</section>`);
 }

mathly2/static/home.js

@@ -1,6 +1,6 @@
 // The student's home for a subject: the nearest test with its readiness and one task for today, the required simulation,
 // the other tests, and a button that continues the path.
-import { api } from "./api.js";
+import { swr } from "./api.js";
 import { esc, fmt } from "./math.js";
 import { PATH, backToSubjects, daysText, shortDate, tabs } from "./ui.js";
 
@@ -40,16 +40,41 @@ function nearest(test, task, next) {
     <p><a href="#/test/${test.id}">כל התוכנית והמבחנים</a></p></section>`;
 }
 
-export async function show(view) {
-  const data = await api("/api/home");
-  const [first, ...others] = data.tests;
+/** An assignment's state in a symbol and a word (never colour alone). */
+export function assignmentState(a) {
+  if (a.kind === "exercise_test") return a.state === "done" ? { symbol: "✓", word: `ציון ${a.grade}` } : a.overdue ? { symbol: "⚠", word: "באיחור" } : { symbol: "○", word: "עוד לא נעשה" };
+  switch (a.state) {
+    case "handed_in": return { symbol: "◐", word: a.late ? "הוגש באיחור" : "הוגש" };
+    case "graded": return { symbol: "✓", word: `ציון ${a.grade}` };
+    case "returned": return { symbol: "↩", word: "הוחזר לתיקון" };
+    default: return a.overdue ? { symbol: "⚠", word: "באיחור" } : { symbol: "○", word: "לא הוגש" };
+  }
+}
+export const assignmentHref = a => a.kind === "exercise_test" ? `#/exam/${a.test.id}/${a.test.number}` : `#/assignment/${a.id}`;
+
+/** Home shows only the new assignments: those not handed in yet (or an exercise test not taken). The rest are in the "הגשות" tab. */
+const isNew = a => a.state === "not_handed" || a.state === "not_done";
+
+function assignmentsCard(all) {
+  const list = all.filter(isNew);
+  if (!list.length) return "";
+  return `<section class="card" id="assignments"><h3>המשימות שלי</h3><ul class="plain assignments">${list.map(a => {
+    const s = assignmentState(a);
+    return `<li data-assignment="${a.id}" data-state="${esc(a.state)}"><a href="${assignmentHref(a)}"><b>${fmt(a.title)}</b></a>
+      <span class="muted">עד ${shortDate(a.due_date)}</span><span class="tag st-${esc(a.state)}"><span aria-hidden="true">${s.symbol}</span> ${s.word}</span></li>`;
+  }).join("")}</ul></section>`;
+}
+
+export const show = view => swr(["/api/home", "/api/assignments"], ([data, assignments]) => draw(view, data, assignments));
+
+function draw(view, data, assignments) {
+  const [first] = data.tests;
   const required = data.tests.filter(t => t.simulation.required);
   view(`${tabs("home")}${backToSubjects()}
     ${first ? nearest(first, data.task, data.next_skill) : `<section class="card" id="no-test"><h2>הבית</h2>
       <p class="muted">המורה עוד לא קבע מבחן. בינתיים אפשר להמשיך במסלול.</p></section>`}
+    ${assignmentsCard(assignments)}
     ${required.map(t => `<a class="required" href="#/sim/${t.id}" data-required="${t.id}"><b>חובה</b> מבחן סימולציה למבחן ב־${shortDate(t.date)}<span aria-hidden="true">‹</span></a>`).join("")}
     <p>${data.next_skill ? `<a class="primary-link" id="continue-path" href="#/skill/${encodeURIComponent(data.next_skill.id)}">להמשיך במסלול: ${fmt(data.next_skill.name)} <span aria-hidden="true">‹</span></a>`
-      : `<a class="primary-link" id="continue-path" href="${PATH}">למסלול: כל הכוכבים פתוחים לתרגול <span aria-hidden="true">‹</span></a>`}</p>
-    ${others.length ? `<h3>מבחנים נוספים</h3><ul class="plain" id="other-tests">${others.map(t => `<li><a href="#/test/${t.id}">${shortDate(t.date)} · ${lessonsOf(t)}</a>
-      <span class="muted">${daysText(t.days_left)} · מוכנות ${t.readiness.number}</span></li>`).join("")}</ul>` : ""}`);
+      : `<a class="primary-link" id="continue-path" href="${PATH}">למסלול: כל הכוכבים פתוחים לתרגול <span aria-hidden="true">‹</span></a>`}</p>`);
 }

mathly2/static/index.html

@@ -6,6 +6,8 @@
 <meta name="color-scheme" content="dark">
 <title>Mathly</title>
 <link rel="icon" href="/static/icons/icon-192.png">
+<link rel="manifest" href="/static/manifest.webmanifest">
+<meta name="theme-color" content="#060A19">
 <link rel="stylesheet" href="/static/app.css">
 </head>
 <body>

mathly2/static/manager.js

@@ -2,16 +2,16 @@
 import { api } from "./api.js";
 import { esc } from "./math.js";
 
-let draw, lessons = [], tab = "classes", editing = null, draft = null, flash = { message: "", error: "" };
+let draw, tab = "classes", editing = null, draft = null, flash = { message: "", error: "" };
 // draft: what was typed in the editor when a save was refused, so the form keeps it and the person can fix one thing
 
 const note = () => `${flash.error && tab !== "edit" ? `<p class="error" role="alert">${esc(flash.error)}</p>` : ""}${flash.message ? `<p role="status" id="msg">${esc(flash.message)}</p>` : ""}`;
 const tabs = () => `<div class="subtabs" id="mgr-tabs" role="group" aria-label="מנהל כיתות">
-  ${[["classes", "כיתות"], ["edit", editing ? "עריכת כיתה" : "כיתה חדשה"], ["students", "תלמידים"]].map(([id, label]) =>
+  ${[["classes", "כיתות"], ["edit", editing ? "עריכת כיתה" : "כיתה חדשה"], ["students", "תלמידים"], ["curriculum", "תכנית לימודים"]].map(([id, label]) =>
     `<button type="button" data-tab="${id}" aria-pressed="${tab === id}">${label}</button>`).join("")}</div>`;
 
 async function render() {
-  const body = tab === "classes" ? await classesView() : tab === "students" ? await studentsView() : editorView();
+  const body = tab === "classes" ? await classesView() : tab === "students" ? await studentsView() : tab === "curriculum" ? await curriculumView() : editorView();
   draw(`<section id="mgr"><h2>מנהל כיתות</h2>${tabs()}${note()}${body}</section>`);
   document.getElementById("mgr-tabs").addEventListener("click", event => {
     const next = event.target.closest("[data-tab]")?.dataset.tab;
@@ -21,6 +21,7 @@ async function render() {
     go(next);
   });
   if (tab === "classes") wireClasses();
+  if (tab === "curriculum") wireCurriculum();
   if (tab === "edit") wireEditor();
   if (tab === "edit" && flash.error) {   // the form is long: bring the reason into view, next to the buttons that were pressed
     const reason = document.getElementById("form-error");
@@ -30,19 +31,37 @@ async function render() {
   flash = { message: "", error: "" };
 }
 
+/** The curriculum: the date by which each lesson should be completed, one for the whole school. */
+async function curriculumView() {
+  const lessons = await api("/api/curriculum");
+  return `<form class="card" id="curriculum-form"><h3>תכנית לימודים</h3>
+    <p class="muted">התאריך שעד אליו כל שיעור אמור להסתיים. תלמיד שלא סיים שיעור אחרי התאריך רואה אותו מסומן בפיגור. אפשר להשאיר תאריך ריק.</p>
+    <ul class="plain curriculum">${lessons.map(l => `<li><label for="due-${esc(l.id)}">${esc(l.name)} <span class="muted">${esc(l.month)}</span></label>
+      <input id="due-${esc(l.id)}" type="date" data-lesson="${esc(l.id)}" value="${esc(l.due_date || "")}"></li>`).join("")}</ul>
+    <p><button class="primary" type="submit" id="save-curriculum">שמירה</button></p></form>`;
+}
+
+function wireCurriculum() {
+  document.getElementById("curriculum-form").addEventListener("submit", async event => {
+    event.preventDefault();
+    const dates = Object.fromEntries([...document.querySelectorAll("#curriculum-form [data-lesson]")].map(i => [i.dataset.lesson, i.value || null]));
+    try { await api("/api/curriculum", { method: "PUT", body: { dates } }); flash = { message: "התכנית נשמרה.", error: "" }; }
+    catch (e) { flash = { message: "", error: e.message }; }
+    go("curriculum");
+  });
+}
+
 const go = next => { tab = next; return render(); };
 
 async function classesView() {
   const classes = await api("/api/classes");
-  const names = Object.fromEntries(lessons.map(l => [l.id, l.name]));
   return `<div class="hrow" style="margin-bottom:10px"><button class="primary" type="button" id="new-class">+ כיתה חדשה</button>
     <span class="muted">${classes.length} כיתות</span></div>
     ${classes.length ? `<div class="cards" id="classes">${classes.map(c => `<article class="card" data-id="${c.id}">
       <div class="hrow"><h3 class="grow">${esc(c.name)}</h3><button type="button" data-edit="${c.id}">עריכה</button><button type="button" class="danger" data-delete="${c.id}">מחיקה</button></div>
-      <p style="margin:0;font-size:14px">שיעורים: ${esc(c.lessons.map(id => names[id] || id).join(", "))}<br>
-      מורה: <span dir="ltr">${esc(c.teacher_email || "עוד לא נבחר")}</span><br>
+      <p style="margin:0;font-size:14px">מורה: <span dir="ltr">${esc(c.teacher_email || "עוד לא נבחר")}</span><br>
       ${c.students} תלמידים · AI: <b>${c.ai_enabled ? "פועל" : "כבוי"}</b> · ${c.ai_daily_checks} בדיקות ביום</p></article>`).join("")}</div>`
-      : `<section class="card"><p class="muted">עוד אין כיתות. פתחו כיתה ראשונה, בחרו את השיעורים והוסיפו את התלמידים.</p></section>`}`;
+      : `<section class="card"><p class="muted">עוד אין כיתות. פתחו כיתה ראשונה והוסיפו את התלמידים.</p></section>`}`;
 }
 
 function wireClasses() {
@@ -62,12 +81,9 @@ function wireClasses() {
 
 function editorView() {
   const c = editing, d = draft;   // a refused save keeps what was typed
-  const chosen = new Set(d ? d.lessons : c?.lessons || []);
   const value = (typed, saved, fallback = "") => d ? (typed ?? fallback) : (saved ?? fallback);
   return `<form class="card" id="class-form"><h3>${c ? `עריכת ${esc(c.name)}` : "כיתה חדשה"}</h3>
     <label for="c-name">שם הכיתה</label><input id="c-name" required maxlength="80" autocomplete="off" value="${esc(value(d?.name, c?.name))}">
-    <label>השיעורים שהכיתה לומדת</label>
-    <div class="checks" id="c-lessons">${lessons.map(l => `<label><input type="checkbox" name="lesson" value="${esc(l.id)}" ${chosen.has(l.id) ? "checked" : ""}>${esc(l.name)}</label>`).join("")}</div>
     <label for="c-teacher">מורה הכיתה (כתובת אחת; לא אחד התלמידים של הכיתה)</label>
     <input id="c-teacher" type="text" dir="ltr" autocomplete="off" value="${esc(value(d?.teacher_email, c?.teacher_email))}">
     <label for="c-students">תלמידים (כתובת בכל שורה; תלמיד יכול להיות בכמה כיתות)</label>
@@ -85,7 +101,6 @@ function wireEditor() {
     event.preventDefault();
     const body = {
       name: document.getElementById("c-name").value,
-      lessons: [...document.querySelectorAll("#c-lessons input:checked")].map(i => i.value),
       teacher_email: document.getElementById("c-teacher").value.trim() || null,
       students: document.getElementById("c-students").value,
       ai_enabled: document.getElementById("c-ai").checked,
@@ -110,6 +125,5 @@ async function studentsView() {
 export async function show(me, view) {
   draw = view;
   tab = "classes"; editing = null;
-  lessons = await api("/api/classes/lessons");
   await render();
 }

mathly2/static/manifest.webmanifest

@@ -0,0 +1,18 @@
+{
+  "id": "/",
+  "name": "לומדים בכיף",
+  "short_name": "לומדים בכיף",
+  "description": "תרגול ולמידה לכיתה ט׳",
+  "lang": "he",
+  "dir": "rtl",
+  "start_url": "/",
+  "scope": "/",
+  "display": "standalone",
+  "background_color": "#060A19",
+  "theme_color": "#060A19",
+  "icons": [
+    {"src": "/static/icons/icon-192.png", "sizes": "192x192", "type": "image/png"},
+    {"src": "/static/icons/icon-512.png", "sizes": "512x512", "type": "image/png"},
+    {"src": "/static/icons/icon-maskable-512.png", "sizes": "512x512", "type": "image/png", "purpose": "maskable"}
+  ]
+}

mathly2/static/media.js

@@ -0,0 +1,55 @@
+// Pictures in the browser: reading a private picture through the server (a plain <img src> cannot send the sign-in), shrinking a photo before
+// it is sent, uploading it, and telling a phone from a computer.
+import { token } from "./session.js";
+import { ApiError } from "./api.js";
+
+const cache = new Map();
+
+/** A picture's bytes as a blob URL, fetched with the sign-in (the server is the only door to pictures). Rejects with ApiError (410: deleted). */
+export function pictureUrl(id) {
+  if (!cache.has(id)) {
+    cache.set(id, (async () => {
+      const response = await fetch(`/api/pictures/${encodeURIComponent(id)}`, { headers: { Authorization: "Bearer " + await token() } });
+      if (!response.ok) { cache.delete(id); throw new ApiError(response.status, response.status === 410 ? "התמונה נמחקה" : "לא הצלחנו לפתוח את התמונה"); }
+      return URL.createObjectURL(await response.blob());
+    })());
+  }
+  return cache.get(id);
+}
+
+/** A photo shrunk to at most `side` pixels and re-encoded as JPEG (this also drops its metadata). Falls back to the file itself when the browser
+ *  cannot decode it, and the server then decides. */
+export async function prepare(file, side = 2000) {
+  try {
+    const bitmap = await createImageBitmap(file, { imageOrientation: "from-image" });
+    const scale = Math.min(1, side / Math.max(bitmap.width, bitmap.height));
+    const canvas = Object.assign(document.createElement("canvas"), { width: Math.round(bitmap.width * scale), height: Math.round(bitmap.height * scale) });
+    const context = canvas.getContext("2d");
+    context.fillStyle = "#fff";
+    context.fillRect(0, 0, canvas.width, canvas.height);
+    context.drawImage(bitmap, 0, 0, canvas.width, canvas.height);
+    const blob = await new Promise(done => canvas.toBlob(done, "image/jpeg", 0.88));
+    return blob || file;
+  } catch { return file; }
+}
+
+/** Send picture bytes (a Blob or File) to `url`; resolves to the JSON answer. */
+export async function sendPicture(url, blob) {
+  const response = await fetch(url, { method: "POST", headers: { Authorization: "Bearer " + await token(), "Content-Type": blob.type || "image/jpeg" }, body: blob });
+  let data = null;
+  try { data = await response.json(); } catch { /* no body */ }
+  if (!response.ok) throw new ApiError(response.status, (data && typeof data.detail === "string" && data.detail) || "משהו השתבש, נסו שוב");
+  return data;
+}
+
+/** A phone or tablet (a touch screen): where the camera opens directly and notifications are offered. */
+export const isTouch = () => !!window.matchMedia?.("(pointer: coarse)").matches;
+
+/** This browser's own id, so a photo request knows which device asked and the phone does not ask itself. */
+export function deviceId() {
+  try {
+    let id = localStorage.getItem("mathly2.device");
+    if (!id) { id = crypto.randomUUID(); localStorage.setItem("mathly2.device", id); }
+    return id;
+  } catch { return "device-" + Math.random().toString(36).slice(2); }
+}

mathly2/static/notifications.js

@@ -0,0 +1,40 @@
+// Notifications for photo requests, on a phone only: a switch on home. The service worker shows the notification when the app is closed and, on a
+// tap, tells the open app to look for requests. Without a push key on the server the switch is not offered.
+import { api } from "./api.js";
+import { isTouch } from "./media.js";
+
+const bytes = base64 => Uint8Array.from(atob(base64.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - base64.length % 4) % 4)), c => c.charCodeAt(0));
+
+/** Draw the switch into `box` (nothing at all on a computer, without notification support, or when the server has no key). */
+export async function setup(box) {
+  if (!isTouch() || !("serviceWorker" in navigator) || !("PushManager" in window) || !("Notification" in window)) return;
+  let server;
+  try { server = await api("/api/push/key"); } catch { return; }
+  if (!server.enabled) return;
+  let registration;
+  try { registration = await navigator.serviceWorker.register("/service-worker.js", { scope: "/" }); } catch { return; }
+  let subscription = await registration.pushManager.getSubscription();
+  const draw = (note = "") => {
+    box.hidden = false;
+    box.innerHTML = `<h3>התראות</h3><p class="muted">כשהמחשב מבקש תמונה של תשובה, הטלפון יקבל התראה גם כשהאפליקציה סגורה. באייפון זה עובד רק מהאפליקציה שהוספתם למסך הבית.</p>
+      <p>${subscription ? `<span class="tag" id="notif-state"><span aria-hidden="true">✓</span> התראות פועלות</span> <button type="button" id="notif-off">כיבוי</button>`
+        : `<button type="button" class="primary" id="notif-on">הפעלת התראות</button>`}</p><p class="muted" id="notif-note" role="status">${note}</p>`;
+    box.querySelector("#notif-on")?.addEventListener("click", enable);
+    box.querySelector("#notif-off")?.addEventListener("click", disable);
+  };
+  async function enable() {
+    try {
+      if (await Notification.requestPermission() !== "granted") return draw("ההתראות חסומות בדפדפן. אפשר לאשר אותן בהגדרות.");
+      subscription = await registration.pushManager.subscribe({ userVisibleOnly: true, applicationServerKey: bytes(server.key) });
+      await api("/api/push/subscribe", { method: "POST", body: subscription.toJSON() });
+      draw();
+    } catch (error) { subscription = null; draw(error.message || "לא הצלחנו להפעיל התראות."); }
+  }
+  async function disable() {
+    const endpoint = subscription?.endpoint;
+    try { await subscription?.unsubscribe(); if (endpoint) await api("/api/push/unsubscribe", { method: "POST", body: { endpoint } }); } catch { /* it is off here either way */ }
+    subscription = null;
+    draw();
+  }
+  draw();
+}

mathly2/static/path.js

@@ -1,9 +1,9 @@
 // The path: a trail of lessons. Each lesson is a hub with its skills as numbered stars in a ring around it; the owl perches on the
 // suggested next skill. Every star is a link to its exercise screen (#/skill/<id>) and says its state in a symbol and a word.
-import { api } from "./api.js";
+import { api, swr } from "./api.js";
 import { esc, fmt } from "./math.js";
 import { owl, ringSvg, spark } from "./sky.js";
-import { HOME, backToSubjects, goalBar, tabs } from "./ui.js";
+import { HOME, backToSubjects, goalBar, shortDate, tabs } from "./ui.js";
 
 export const STATES = {
   not_started: { symbol: "○", word: "לא התחלת" },
@@ -32,18 +32,27 @@ function quizNode(l) {
       aria-label="בוחן ${esc(plain(l.name))}: ${state}"><span class="qz-icon" aria-hidden="true">${spark()}</span><span><b>בוחן</b><em>${state}</em></span></a>`;
 }
 
+/** "הושלם", or, for a lesson whose date has passed without it being completed, the marker with the date in words. */
+function lessonStatus(l) {
+  if (l.completed) return `<p class="lesson-status done" data-status="completed"><span aria-hidden="true">✓</span> הושלם${l.passed ? " (עברת את הבוחן)" : ""}</p>`;
+  if (l.behind) return `<p class="lesson-status late" data-status="behind"><span aria-hidden="true">⚠</span> היה אמור להסתיים ב־${shortDate(l.due_date)}</p>`;
+  return "";
+}
+
+const behindNote = n => n ? `<p class="behind-note" id="behind-note" role="status"><span aria-hidden="true">⚠</span> ${n === 1 ? "שיעור אחד בפיגור" : `${n} שיעורים בפיגור`} לפי התכנית</p>` : "";
+
 function lesson(l, next) {
   const n = l.skills.length;
-  return `<section class="orbit${l.completed ? " completed" : ""}" id="lesson-${esc(l.id)}" aria-label="${esc(plain(l.name))}">
+  return `<section class="orbit${l.completed ? " completed" : ""}${l.behind ? " behind" : ""}" id="lesson-${esc(l.id)}" aria-label="${esc(plain(l.name))}">
     <div class="stage">${ringSvg(l.skills.map(s => s.state))}
       <div class="hub"><h3>${fmt(l.name)}</h3><span class="count">${l.mastered} מתוך ${n} נשלטו${l.completed ? " ✓" : ""}</span></div>
-      ${l.skills.map((s, i) => star(s, i, n, s.id === next)).join("")}</div></section>${quizNode(l)}`;
+      ${l.skills.map((s, i) => star(s, i, n, s.id === next)).join("")}</div>${lessonStatus(l)}</section>${quizNode(l)}`;
 }
 
 export function pathHtml(path) {
   return `${tabs("path")}${backToSubjects()}
     <section class="card path-top" id="path"><h2>המסלול שלי</h2>
-    <p class="muted">כל השיעורים פתוחים, בכל סדר. הינשוף מציע איפה להמשיך, אבל אפשר ללחוץ על כל כוכב.</p>${goalBar(path.today, path.streak)}</section>
+    <p class="muted">כל השיעורים פתוחים, בכל סדר. הינשוף מציע איפה להמשיך, אבל אפשר ללחוץ על כל כוכב.</p>${goalBar(path.today, path.streak)}${behindNote(path.behind)}</section>
     <div class="trail">
       <div class="mark start">${owl(44)}<b>התחלה</b></div>
       ${path.lessons.map(l => lesson(l, path.next)).join("")}
@@ -51,8 +60,12 @@ export function pathHtml(path) {
 }
 
 /** Draw the path. `scroll`: bring the next skill to the middle of the screen (when the path opens); a refresh keeps the place. */
-export async function show(view, { scroll = true } = {}) {
-  const path = await api("/api/path");
+export const show = (view, { scroll = true } = {}) => {
+  let first = true;                                  // a refresh of the same screen keeps the place
+  return swr("/api/path", path => { const result = drawPath(view, path, scroll && first); first = false; return result; });
+};
+
+function drawPath(view, path, scroll) {
   const place = window.scrollY;
   view(pathHtml(path));
   if (scroll) document.querySelector(".star.next")?.scrollIntoView({ block: "center" });
@@ -67,7 +80,7 @@ export async function showSubjects(view) {
   view(`<section class="subjects" aria-label="מקצועות">
     <h2>במה נתרגל היום?</h2>
     <a class="subject-card" href="${HOME}" data-subject="מתמטיקה"><span class="subject-icon" aria-hidden="true">∑</span>
-      <span class="grow"><b>מתמטיקה</b>
+      <span class="grow"><b>מתמטיקה כיתה ט - מצוינות</b>
         <span class="bar" role="progressbar" aria-label="מיומנויות שהושלמו" aria-valuemin="0" aria-valuemax="${total}" aria-valuenow="${lit}"><i style="width:${total ? Math.round(100 * lit / total) : 0}%"></i></span>
         <small>${lit} מתוך ${total} מיומנויות</small></span><i aria-hidden="true">‹</i></a></section>`);
   return path;

mathly2/static/phone.js

@@ -0,0 +1,117 @@
+// The photo request, both ends. The computer asks for a photo of an answer: it shows a 4-digit code and the request's state in words.
+// The student's phone (any other device signed in to the same account) shows a window with the same code and a camera button.
+import { api, ApiError } from "./api.js";
+import { withBusy } from "./busy.js";
+import { esc, fmt } from "./math.js";
+import { deviceId, prepare, sendPicture } from "./media.js";
+
+export const WORDS = { waiting: "ממתינים לטלפון", uploading: "מעלים את התשובה…", received: "התשובה התקבלה", failed: "ההעלאה נכשלה", expired: "הבקשה פגה. אפשר לבקש שוב.",
+  superseded: "הוחלפה בבקשה חדשה" };
+const DONE = new Set(["received", "failed", "expired", "superseded"]);
+const everyComputer = () => window.__photoPollComputer ?? 2000;       // the computer looks for the phone's answer this often (milliseconds)
+const everyPhone = () => window.__photoPollPhone ?? 5000;             // the phone looks for new requests this often
+
+// ---------- the computer ----------
+
+let runs = 0;       // a newer request (or leaving the page) stops the older one's looking
+
+/** Ask the student's phone for a photo of this assignment's answer. `onPicture(id)` is called when the picture arrives. */
+export async function askFromComputer(assignment, onPicture, panel) {
+  const mine = ++runs;
+  const old = [...panel.querySelectorAll(".photo-request[data-code]")].map(el => `<li data-state="superseded">קוד ${esc(el.dataset.code)}: ${WORDS.superseded}</li>`).join("")
+    + (panel.querySelector(".old-requests")?.innerHTML || "");
+  let request;
+  try {
+    request = await api("/api/photo-requests", { method: "POST", body: { assignment_id: assignment.id, device: deviceId() } });
+  } catch (error) {
+    panel.innerHTML = `<p class="error" role="alert">${esc(error.message || "משהו השתבש")}</p>`;
+    return;
+  }
+  const draw = state => {
+    panel.innerHTML = `<div class="photo-request" id="photo-request" data-code="${esc(request.code)}" data-state="${esc(state)}">
+      <p>הקוד של הבקשה: <b class="code" id="request-code" dir="ltr">${esc(request.code)}</b></p>
+      <p class="muted">פתחו את האפליקציה בטלפון. אם הקוד שם זהה, צלמו את התשובה.</p>
+      <p class="status" id="request-state" role="status"><b>${WORDS[state] || state}</b></p></div>${old ? `<ul class="plain old-requests">${old}</ul>` : ""}`;
+  };
+  draw(request.state);
+  while (mine === runs && !DONE.has(request.state)) {
+    await new Promise(done => setTimeout(done, everyComputer()));
+    if (mine !== runs) return;
+    try { request = await api(`/api/photo-requests/${request.id}`); } catch { return; }
+    draw(request.state);
+  }
+  if (mine === runs && request.state === "received" && request.picture_id) onPicture(request.picture_id);
+}
+
+/** Stop looking for an answer (the page was left). */
+export const stopComputer = () => { runs += 1; };
+
+// ---------- the phone ----------
+
+let watching = null, handled = new Set(), shown = null;
+
+function closeWindow() {
+  document.getElementById("photo-window")?.remove();
+  shown = null;
+}
+
+function windowHtml(request) {
+  return `<div class="photo-window" id="photo-window" role="dialog" aria-modal="true" aria-labelledby="pw-title" data-request="${esc(request.id)}">
+    <div class="sheet"><h3 id="pw-title">📷 בקשת צילום מהמחשב</h3>
+      <p>הקוד שבמחשב: <b class="code" id="phone-code" dir="ltr">${esc(request.code)}</b></p>
+      <p class="muted">אם הקוד זהה למה שרואים במחשב, צלמו את התשובה: ${fmt(request.assignment.title)}</p>
+      <p class="status" id="phone-state" role="status"></p>
+      <p><label class="button primary file" id="phone-camera">📷 צילום<input type="file" accept="image/*" capture="environment" hidden data-photo></label>
+        <button type="button" id="phone-later">לא עכשיו</button></p></div></div>`;
+}
+
+async function takePhoto(request, file) {
+  const status = document.getElementById("phone-state");
+  status.textContent = "מעלים את התשובה…";
+  try {
+    await api(`/api/photo-requests/${request.id}/start`, { method: "POST" });
+    await sendPicture(`/api/photo-requests/${request.id}/picture`, await prepare(file));
+    handled.add(request.id);
+    status.textContent = "התמונה נשלחה למחשב ✓";
+    setTimeout(closeWindow, 1500);
+  } catch (error) {
+    status.textContent = (error instanceof ApiError && error.message) || "ההעלאה נכשלה. נסו שוב.";
+  }
+}
+
+async function look() {
+  let open;
+  try { open = await api(`/api/photo-requests/open?device=${encodeURIComponent(deviceId())}`); } catch { return; }
+  const wanted = open.find(r => !handled.has(r.id));
+  if (!wanted) { if (shown && !document.getElementById("phone-state")?.textContent.includes("נשלחה")) closeWindow(); return; }
+  if (shown === wanted.id) return;
+  closeWindow();
+  shown = wanted.id;
+  document.body.insertAdjacentHTML("beforeend", windowHtml(wanted));
+  const box = document.getElementById("photo-window");
+  box.querySelector("[data-photo]").addEventListener("change", event => { const file = event.target.files[0]; event.target.value = ""; if (file) withBusy(box.querySelector("#phone-camera"), takePhoto(wanted, file)); });
+  box.querySelector("#phone-later").addEventListener("click", () => { handled.add(wanted.id); closeWindow(); });
+  box.querySelector("#phone-camera").focus?.();
+}
+
+/** Start looking for photo requests made by the student's other devices: now, on a timer, when the page comes back, and when a notification was tapped. */
+export function startWatching() {
+  if (watching) return;
+  handled = new Set();
+  const again = () => { look(); };
+  const timer = () => { watching = setTimeout(async () => { await look(); if (watching) timer(); }, everyPhone()); };
+  look();
+  timer();
+  const visible = () => { if (document.visibilityState === "visible") again(); };
+  const message = event => { if (event.data?.type === "notified") again(); };
+  document.addEventListener("visibilitychange", visible);
+  navigator.serviceWorker?.addEventListener("message", message);
+  startWatching.stop = () => {
+    clearTimeout(watching); watching = null; closeWindow();
+    document.removeEventListener("visibilitychange", visible);
+    navigator.serviceWorker?.removeEventListener("message", message);
+  };
+}
+
+export const stopWatching = () => { startWatching.stop?.(); };
+window.addEventListener("mathly:leave", () => { stopComputer(); stopWatching(); });

mathly2/static/service-worker.js

@@ -0,0 +1,30 @@
+/* Mathly's service worker: push notifications only (app/push.py). It has no fetch handler and keeps no cache.
+   An older version served /static/ from its own cache forever; activating this one deletes those caches. */
+self.addEventListener("install", () => self.skipWaiting());
+self.addEventListener("activate", event => event.waitUntil((async () => {
+  await Promise.all((await caches.keys()).map(key => caches.delete(key)));
+  await self.clients.claim();
+})()));
+
+// a photo request from the computer (or any later message): shown even when the app is closed
+self.addEventListener("push", event => {
+  let msg = {};
+  try { msg = event.data ? event.data.json() : {}; } catch { msg = { body: event.data && event.data.text() }; }
+  event.waitUntil(self.registration.showNotification(msg.title || "לומדים בכיף", {
+    body: msg.body || "", tag: msg.tag || "mathly", renotify: true, requireInteraction: false,
+    lang: "he", dir: "rtl",
+    icon: "/static/icons/icon-192.png", badge: "/static/icons/icon-192.png",
+    data: { url: msg.url || "/" }
+  }));
+});
+
+// a tap: the app already open is brought forward and told to look for requests now; otherwise it is opened
+self.addEventListener("notificationclick", event => {
+  event.notification.close();
+  const url = new URL((event.notification.data && event.notification.data.url) || "/", self.location.origin).href;
+  event.waitUntil(self.clients.matchAll({ type: "window", includeUncontrolled: true }).then(wins => {
+    const app = wins.find(w => new URL(w.url).origin === self.location.origin && !new URL(w.url).pathname.startsWith("/static/"));
+    if (app) { app.postMessage({ type: "notified", url }); return app.focus(); }
+    return self.clients.openWindow(url);
+  }));
+});

mathly2/static/session.js

@@ -30,7 +30,12 @@ export function signInDev(email) {
   try { localStorage.setItem(DEV_KEY, email.trim().toLowerCase()); } catch { /* private window: stays signed out */ }
 }
 
+const outListeners = [];
+/** Calls `fn` when the person signs out (so nothing remembered about them is shown to the next one). */
+export const onSignOut = fn => outListeners.push(fn);
+
 export async function signOut() {
+  outListeners.forEach(fn => fn());
   if (client) await client.auth.signOut();
   try { localStorage.removeItem(DEV_KEY); } catch { /* nothing stored */ }
 }

mathly2/static/student.js

@@ -2,6 +2,7 @@
 import { esc } from "./math.js";
 import * as exercise from "./exercise.js";
 import * as home from "./home.js";
+import * as phone from "./phone.js";
 import * as path from "./path.js";
 import * as quiz from "./quiz.js";
 import { route as onRoute } from "./router.js";
@@ -15,6 +16,7 @@ export async function show(me, view) {
   }
   let lastSkill = "";
   async function route() {
+    phone.stopComputer();                                      // a page that was waiting for the phone's photo is left
     const raw = location.hash.replace(/^#/, "");
     const where = raw.startsWith("/") ? raw : "/";          // no address, or the sign-in service's "#access_token=…": the first screen
     try {
@@ -28,6 +30,12 @@ export async function show(me, view) {
         const [lesson, attempt] = where.slice(6).split("/").map(decodeURIComponent);
         if (!document.getElementById("path")) await path.show(view);                  // a link or a reload: the path first, then the sheet
         if (attempt) await quiz.open(attempt); else await quiz.start(lesson);       // the node starts or resumes; the address then names the attempt
+      } else if (where === "/submissions") {
+        exercise.close(); quiz.close();
+        await (await import("./submissions.js")).show(view);
+      } else if (where.startsWith("/assignment/")) {
+        exercise.close(); quiz.close();
+        await (await import("./assignment.js")).show(view, decodeURIComponent(where.slice(12)));
       } else if (where.startsWith("/exam/") || where.startsWith("/sim/")) {
         exercise.close();
         const [kind, ...rest] = where.slice(1).split("/").map(decodeURIComponent);
@@ -65,5 +73,6 @@ export async function show(me, view) {
     if (!where.startsWith("/skill/") && !exercise.isOpen()) { /* the path scrolls itself */ }
   }
   onRoute(route);
+  phone.startWatching();                                       // a photo request from the student's computer shows here when this is the phone
   await route();
 }

mathly2/static/submissions.js

@@ -0,0 +1,33 @@
+// "הגשות": every assignment from the student's teachers, grouped by state, and (on a phone) the switch for notifications.
+import { swr } from "./api.js";
+import { assignmentHref, assignmentState } from "./home.js";
+import { esc, fmt } from "./math.js";
+import * as notifications from "./notifications.js";
+import { shortDate, tabs } from "./ui.js";
+
+/** The groups, in the order a student needs them: what to do first, then what waits, then what is done. */
+const GROUPS = [
+  { id: "new", title: "חדשות: עוד לא הוגשו", states: ["not_handed", "not_done"] },
+  { id: "returned", title: "הוחזרו לתיקון", states: ["returned"] },
+  { id: "waiting", title: "הוגשו וממתינות לבדיקה", states: ["handed_in"] },
+  { id: "checked", title: "נבדקו", states: ["graded", "done"] },
+];
+
+function item(a) {
+  const s = assignmentState(a);
+  const note = a.teacher_note ? `<span class="muted gr-note">הערת המורה: ${fmt(a.teacher_note)}</span>` : "";
+  return `<li data-assignment="${a.id}" data-state="${esc(a.state)}"><a href="${assignmentHref(a)}"><b>${fmt(a.title)}</b></a>
+    <span class="muted">${esc(a.class.name)} · עד ${shortDate(a.due_date)}</span><span class="tag st-${esc(a.state)}"><span aria-hidden="true">${s.symbol}</span> ${s.word}</span>${note}</li>`;
+}
+
+export const show = view => swr("/api/assignments", list => draw(view, list));
+
+function draw(view, list) {
+  const groups = GROUPS.map(g => ({ ...g, items: list.filter(a => g.states.includes(a.state)) })).filter(g => g.items.length);
+  view(`${tabs("submissions")}<section class="card" id="submissions"><h2>הגשות</h2>
+    ${groups.length ? groups.map(g => `<section class="group" id="group-${g.id}" data-group="${g.id}"><h3>${g.title} <span class="tab-count">${g.items.length}</span></h3>
+      <ul class="plain assignments">${g.items.map(item).join("")}</ul></section>`).join("")
+      : `<p class="muted" id="no-assignments">המורים עוד לא נתנו משימות.</p>`}</section>
+    <section class="card" id="notifications" hidden></section>`);
+  notifications.setup(document.getElementById("notifications"));
+}

mathly2/static/teacher.js

@@ -1,16 +1,31 @@
 // The teacher's home: the classes I teach, each with its students; I add (a pasted list) and remove students of my own classes.
-import { api } from "./api.js";
+import { api, lastAnswer, swr } from "./api.js";
 import { esc, fmt } from "./math.js";
 import { daysText, shortDate } from "./ui.js";
 
 let draw;   // the app's view() function
 
 const tabs = active => `<div class="subtabs" id="teacher-tabs" role="group" aria-label="המורה">
-  <button type="button" data-tab="classes" aria-pressed="${active === "classes"}">הכיתות שלי</button>
-  <button type="button" data-tab="tests" aria-pressed="${active === "tests"}">מבחנים</button></div>`;
+  <button type="button" data-tab="classes" aria-pressed="${active === "classes"}">הכיתות שלי <span class="tab-count" data-count="classes"></span></button>
+  <button type="button" data-tab="tests" aria-pressed="${active === "tests"}">מבחנים <span class="tab-count" data-count="tests"></span></button>
+  <button type="button" data-tab="assignments" aria-pressed="${active === "assignments"}">משימות <span class="tab-count" data-count="assignments"></span></button>
+  <button type="button" data-tab="inbox" aria-pressed="${active === "inbox"}">תיבת בדיקה <span class="tab-count" data-count="inbox"></span></button></div>`;
+
+const work = () => import("./teacher_work.js");
+const context = { draw: html => draw(html), tabs: active => tabs(active), wire: () => wireTabs() };
+
+/** The number of items in each tab, from the server, filled in after the screen is drawn (and so refreshed after every action). */
+async function fillCounts() {
+  const show = counts => document.querySelectorAll("#teacher-tabs [data-count]").forEach(el => { el.textContent = counts[el.dataset.count]; });
+  const known = lastAnswer("/api/teaching/counts");
+  if (known) show(known);                                     // the last numbers at once, the fresh ones when they arrive
+  try { show(await api("/api/teaching/counts")); } catch { /* the tabs work without the numbers */ }
+}
 
 function wireTabs() {
-  document.querySelectorAll("#teacher-tabs [data-tab]").forEach(b => b.addEventListener("click", () => (b.dataset.tab === "tests" ? showTests() : showClasses())));
+  fillCounts();
+  const screens = { classes: showClasses, tests: showTests, assignments: () => work().then(m => m.showAssignments(context)), inbox: () => work().then(m => m.showInbox(context)) };
+  document.querySelectorAll("#teacher-tabs [data-tab]").forEach(b => b.addEventListener("click", () => screens[b.dataset.tab]()));
 }
 
 function report(result) {
@@ -22,15 +37,17 @@ function report(result) {
   return lines;
 }
 
-async function showClasses(notes = {}) {
-  const classes = await api("/api/teaching");
+const showClasses = (notes = {}) => swr("/api/teaching", classes => drawClasses(classes, notes));
+
+async function drawClasses(classes, notes) {
   draw(`${tabs("classes")}<section id="teaching"><h2>הכיתות שלי</h2>
     ${classes.length ? `<div class="cards">${classes.map(c => `<article class="card class-card" data-id="${c.id}">
       <div class="hrow"><h3 class="grow">${esc(c.name)}</h3><span class="tag">${c.students.length} תלמידים</span></div>
       <p class="muted" style="margin:0 0 8px">${c.ai_enabled ? "AI פועל" : "AI כבוי: מנהל הכיתות מפעיל"}</p>
       ${c.students.length ? `<ul class="plain students">${c.students.map(s => `<li><span dir="ltr">${esc(s.email)}</span>
         <span class="muted">${s.signed_in ? "נכנס/ה" : "עוד לא נכנס/ה"}</span>
-        <button type="button" data-remove="${esc(s.email)}" aria-label="הסרת ${esc(s.email)}">הסרה</button></li>`).join("")}</ul>`
+        <button type="button" data-remove="${esc(s.email)}" aria-label="הסרת ${esc(s.email)}">הסרה</button>
+        <button type="button" data-wipe="${esc(s.email)}" aria-label="מחיקת התמונות של ${esc(s.email)}">מחיקת תמונות</button></li>`).join("")}</ul>`
         : `<p class="muted">עוד אין תלמידים בכיתה.</p>`}
       <form class="add-students"><label for="emails-${c.id}">הוספת תלמידים (כתובת בכל שורה)</label>
         <textarea id="emails-${c.id}" class="emails" dir="ltr" required></textarea>
@@ -49,6 +66,20 @@ async function showClasses(notes = {}) {
       } catch (e) { await showClasses({ [id]: { error: e.message } }); }
     });
     card.addEventListener("click", async event => {
+      const wipe = event.target.closest("[data-wipe]");
+      if (wipe) {                                                           // the student's answer pictures, on request: two steps (the grades stay)
+        wipe.outerHTML = `<span class="confirm"><button type="button" class="danger" data-confirm-wipe="${wipe.dataset.wipe}">אישור מחיקת התמונות</button> <button type="button" data-cancel-wipe>ביטול</button></span>`;
+        return;
+      }
+      if (event.target.closest("[data-cancel-wipe]")) { await showClasses(); return; }
+      const sure = event.target.closest("[data-confirm-wipe]")?.dataset.confirmWipe;
+      if (sure) {
+        try {
+          const done = await api(`/api/classes/${id}/pictures/${encodeURIComponent(sure)}`, { method: "DELETE" });
+          await showClasses({ [id]: { lines: [`נמחקו ${done.deleted} תמונות של ${esc(sure)}. הציונים וההערות נשארו.`] } });
+        } catch (e) { await showClasses({ [id]: { error: e.message } }); }
+        return;
+      }
       const email = event.target.closest("[data-remove]")?.dataset.remove;
       if (!email) return;
       try {
@@ -90,8 +121,9 @@ function testCard(c, t) {
     <div class="edit-slot" data-slot="${t.id}"></div></article>`;
 }
 
-async function showTests() {
-  const classes = await api("/api/teaching/tests");
+const showTests = () => swr("/api/teaching/tests", drawTests);
+
+async function drawTests(classes) {
   draw(`${tabs("tests")}<section id="tests"><h2>מבחנים</h2>
     ${classes.length ? classes.map(({ class: c, tests }) => `<section class="card class-tests" data-class="${c.id}"><h3>${esc(c.name)}</h3>
       ${tests.length ? tests.map(t => testCard(c, t)).join("") : `<p class="muted">עוד לא נקבע מבחן לכיתה.</p>`}

mathly2/static/teacher_work.js

@@ -0,0 +1,167 @@
+// The teacher's work tab: give an assignment (a file, a photo, the board, one of the bank's written quizzes, or an exercise test) and see
+// how many students handed in. `ctx` is the teacher's screen: { draw(html), tabs(active), wire() }.
+import { api, swr } from "./api.js";
+import { loadBoard } from "./exercise.js";
+import { withBusy } from "./busy.js";
+import { esc, fmt } from "./math.js";
+import { isTouch, pictureUrl, prepare, sendPicture } from "./media.js";
+import { daysText, shortDate } from "./ui.js";
+
+const today = () => new Date().toISOString().slice(0, 10);
+const SOURCES = [["pages", "קובץ, צילום או כתיבה על הלוח"], ["quiz", "בוחן כתוב מהמאגר"], ["exercise_test", "מבחן תרגול"]];
+
+function sourceFields(c) {
+  const quizzes = c.lessons.filter(l => l.has_quiz);
+  return `<div class="source" data-source="pages"><p class="muted">הוסיפו עמודים: קובץ (תמונה או PDF), צילום או כתיבה על הלוח.</p>
+      <ul class="plain drafts" data-pages><li class="muted" data-pages-empty>עוד לא נוספו עמודים.</li></ul>
+      <p class="actions"><label class="button file">🖼 קובץ<input type="file" accept="image/jpeg,image/png,image/webp,application/pdf" multiple hidden data-pages-file></label>
+        ${isTouch() ? `<label class="button file">📷 צילום<input type="file" accept="image/*" capture="environment" hidden data-pages-camera></label>` : ""}
+        <button type="button" data-pages-board>✎ כתיבה על הלוח</button></p></div>
+    <div class="source" data-source="quiz" hidden>${quizzes.length ? `<label>הבוחן הכתוב של השיעור<select name="quiz_lesson">${quizzes.map(l => `<option value="${esc(l.id)}">${fmt(l.name)}</option>`).join("")}</select></label>
+      <p class="muted">ארבע שאלות כתובות, 100 נקודות.</p>` : `<p class="muted">לשיעורים של הכיתה אין בוחן כתוב במאגר.</p>`}</div>
+    <div class="source" data-source="exercise_test" hidden>${c.tests.length ? `<label>המבחן<select name="test">${c.tests.map(t => `<option value="${t.id}">מבחן ב־${shortDate(t.date)}: ${t.lessons.map(fmt).join(", ")}</option>`).join("")}</select></label>
+      <label>איזה מבחן תרגול<select name="exercise_number"><option value="1">מבחן תרגול 1</option><option value="2">מבחן תרגול 2</option></select></label>` : `<p class="muted">עוד לא נקבע מבחן לכיתה (בלשונית מבחנים).</p>`}</div>`;
+}
+
+function newForm(c) {
+  return `<form class="assignment-form" data-class="${c.id}"><label>כותרת<input name="title" required maxlength="200"></label>
+    <label>הערה לתלמידים (לא חובה)<textarea name="note" rows="2" maxlength="1000"></textarea></label>
+    <label>להגיש עד<input name="due_date" type="date" required min="${today()}"></label>
+    <fieldset><legend>התוכן</legend>${SOURCES.map(([v, label], i) => `<label class="check"><input type="radio" name="source" value="${v}"${i === 0 ? " checked" : ""}> ${label}</label>`).join("")}</fieldset>
+    ${sourceFields(c)}<p class="error form-error" role="alert" hidden></p><p><button class="primary" type="submit">שליחה לכיתה</button></p></form>`;
+}
+
+function row(a) {
+  const counts = a.kind === "exercise_test" ? `<span class="tag">${a.done} מתוך ${a.students} עשו</span>`
+    : `<span class="tag counts">${a.handed_in + a.graded + a.returned} מתוך ${a.students} הגישו</span><span class="tag">${a.graded} נבדקו</span>${a.waiting ? `<span class="tag waiting">${a.waiting} מחכות לבדיקה</span>` : ""}`;
+  const what = a.kind === "quiz" ? `בוחן כתוב: ${fmt(a.quiz_lesson.name)}` : a.kind === "exercise_test" ? `מבחן תרגול ${a.test.number}` : `${a.pages.length} עמודים`;
+  return `<article class="card assignment-row" data-assignment="${a.id}"><div class="hrow"><h4 class="grow">${fmt(a.title)}</h4><span class="muted">עד ${shortDate(a.due_date)} (${daysText(a.days_left)})</span></div>
+    <p class="muted">${what}${a.note ? ` · ${fmt(a.note)}` : ""}</p><p class="tags">${counts}</p>
+    <p><button type="button" data-remove-assignment="${a.id}">הסרה</button></p></article>`;
+}
+
+export const showAssignments = ctx => swr("/api/teaching/assignments", classes => drawAssignments(ctx, classes));
+
+async function drawAssignments(ctx, classes) {
+  ctx.draw(`${ctx.tabs("assignments")}<section id="work"><h2>משימות</h2>
+    ${classes.length ? classes.map(({ class: c, assignments }) => `<section class="card class-work" data-class="${c.id}"><h3>${esc(c.name)}</h3>
+      ${assignments.length ? assignments.map(row).join("") : `<p class="muted">עוד לא נתנו משימה לכיתה.</p>`}
+      <details class="new-assignment"><summary>משימה חדשה</summary>${newForm(c)}</details></section>`).join("")
+      : `<section class="card"><p class="muted">עוד לא שייכו אותך ככיתה. מנהל הכיתות קובע מי מל��ד/ת כל כיתה.</p></section>`}</section>`);
+  ctx.wire();
+  const root = document.getElementById("work");
+  root.querySelectorAll(".assignment-form").forEach(form => wireForm(form, ctx));
+  root.addEventListener("click", async event => {
+    const button = event.target.closest("[data-remove-assignment]");
+    if (button) {                                                                        // two steps, so a slip does not remove it
+      button.outerHTML = `<span class="confirm"><button type="button" class="danger" data-confirm-remove-assignment="${button.dataset.removeAssignment}">אישור הסרה</button> <button type="button" data-cancel-remove>ביטול</button></span>`;
+      return;
+    }
+    if (event.target.closest("[data-cancel-remove]")) return showAssignments(ctx);
+    const confirm = event.target.closest("[data-confirm-remove-assignment]")?.dataset.confirmRemoveAssignment;
+    if (confirm) { await api(`/api/assignments/${confirm}`, { method: "DELETE" }); await showAssignments(ctx); }
+  });
+}
+
+function wireForm(form, ctx) {
+  let pages = [];
+  const error = form.querySelector(".form-error");
+  const fail = text => { error.textContent = text; error.hidden = false; error.scrollIntoView({ block: "nearest" }); };
+  const list = form.querySelector("[data-pages]");
+  const drawPages = () => {
+    list.innerHTML = pages.length ? pages.map(id => `<li data-page="${esc(id)}"><img data-picture="${esc(id)}" alt="עמוד של המשימה" hidden>
+      <button type="button" class="remove" data-remove-page="${esc(id)}" aria-label="הסרת העמוד">✕</button></li>`).join("") : `<li class="muted" data-pages-empty>עוד לא נוספו עמודים.</li>`;
+    list.querySelectorAll("img[data-picture]").forEach(async img => { try { img.src = await pictureUrl(img.dataset.picture); img.hidden = false; } catch { img.remove(); } });
+  };
+  const upload = async (blob, type) => {
+    const got = await fetch("/api/assignments/pages", { method: "POST", headers: { Authorization: "Bearer " + await (await import("./session.js")).token(), "Content-Type": type || blob.type }, body: blob });
+    const data = await got.json().catch(() => ({}));
+    if (!got.ok) throw new Error(typeof data.detail === "string" ? data.detail : "משהו השתבש");
+    pages.push(...data.pictures);
+    drawPages();
+  };
+  const addFiles = async files => {
+    error.hidden = true;
+    for (const file of files) {
+      try { await upload(file.type === "application/pdf" ? file : await prepare(file), file.type === "application/pdf" ? file.type : "image/jpeg"); } catch (e) { fail(e.message); }
+    }
+  };
+  form.querySelectorAll("[data-pages-file], [data-pages-camera]").forEach(input => input.addEventListener("change", async () => { const files = [...input.files]; input.value = ""; await withBusy(input.closest("label"), addFiles(files)); }));
+  list.addEventListener("click", event => { const id = event.target.closest("[data-remove-page]")?.dataset.removePage; if (id) { pages = pages.filter(p => p !== id); drawPages(); } });
+  form.querySelector("[data-pages-board]").addEventListener("click", async () => {
+    await loadBoard();
+    if (!window.MathlyBoard?.openFull) return;
+    const host = Object.assign(document.createElement("div"), { className: "mx-layer" });
+    document.body.append(host);
+    window.MathlyBoard.openFull({ host, key: `assignment-new:${form.dataset.class}`, title: "כתיבת משימה על הלוח", sendLabel: "הוספה למשימה",
+      submit: async (page, blob) => { try { await upload(blob, "image/png"); return {}; } catch (e) { return { error: e.message }; } }, done: () => host.remove() });
+  });
+  form.querySelectorAll("[name=source]").forEach(radio => radio.addEventListener("change", () => {
+    form.querySelectorAll(".source").forEach(box => { box.hidden = box.dataset.source !== form.querySelector("[name=source]:checked").value; });
+  }));
+  form.addEventListener("submit", async event => {
+    event.preventDefault();
+    error.hidden = true;
+    const data = new FormData(form), kind = data.get("source");
+    const body = { title: data.get("title"), note: data.get("note") || "", due_date: data.get("due_date"), kind };
+    if (kind === "pages") body.pages = pages;
+    if (kind === "quiz") body.quiz_lesson = data.get("quiz_lesson");
+    if (kind === "exercise_test") { body.test_id = Number(data.get("test")); body.exercise_number = Number(data.get("exercise_number")); }
+    try {
+      await api(`/api/classes/${form.dataset.class}/assignments`, { method: "POST", body });
+      await showAssignments(ctx);
+    } catch (e) { fail(e.message); }                                                       // the form keeps what was typed
+  });
+}
+
+// ---------- the inbox: everything that waits for the teacher, oldest first ----------
+
+const when = iso => new Date(iso).toLocaleString("he-IL", { day: "numeric", month: "numeric", hour: "2-digit", minute: "2-digit" });
+
+export const showInbox = (ctx, notice = "") => swr("/api/teaching/inbox", items => drawInbox(ctx, items, notice));
+
+async function drawInbox(ctx, items, notice) {
+  ctx.draw(`${ctx.tabs("inbox")}<section id="inbox"><h2>תיבת בדיקה</h2>${notice ? `<p class="ex-note" role="status" id="inbox-notice">${esc(notice)}</p>` : ""}
+    ${items.length ? `<ul class="plain inbox-list" id="inbox-list">${items.map(i => `<li data-submission="${i.id}"><button type="button" class="open-submission" data-open="${i.id}">
+      <b>${esc(i.student || "תלמיד/ה")}</b> · ${fmt(i.assignment.title)}<br><span class="muted">${esc(i.assignment.class.name)} · הוגש ${when(i.handed_at)}${i.late ? " · באיחור" : ""}</span></button></li>`).join("")}</ul>`
+      : `<p class="muted" id="inbox-empty">אין מה לבדוק. כל ההגשות נבדקו.</p>`}</section>`);
+  ctx.wire();
+  document.getElementById("inbox").addEventListener("click", event => {
+    const id = event.target.closest("[data-open]")?.dataset.open;
+    if (id) openSubmission(ctx, id);
+  });
+}
+
+async function openSubmission(ctx, id) {
+  const s = await api(`/api/submissions/${id}`);
+  const material = s.quiz ? `<h4>הבוחן הכתוב</h4><ol class="qz-written">${s.quiz.questions.map(x => `<li><p class="ex-text" dir="auto">${fmt(x.question)}</p><span class="muted">${x.points} נק׳</span></li>`).join("")}</ol>`
+    : s.pages.length ? `<h4>הדף שניתן</h4><div class="pages">${s.pages.map(p => `<img data-picture="${esc(p)}" alt="עמוד של המשימה" hidden>`).join("")}</div>` : "";
+  ctx.draw(`${ctx.tabs("inbox")}<section id="check" class="card" data-submission="${s.id}"><p><button type="button" id="back-to-inbox">‹ חזרה לתיבה</button></p>
+    <h2>${esc(s.student)}: ${fmt(s.assignment.title)}</h2><p class="muted">${esc(s.assignment.class.name)} · הוגש ${when(s.handed_at)}${s.late ? " · באיחור" : ""}</p>
+    <h4>התשובה</h4><div class="pages" id="answer-pictures">${s.pictures.map(p => p.deleted ? `<p class="muted">התמונה נמחקה</p>` : `<img data-picture="${esc(p.id)}" alt="תמונה של התשובה" hidden>`).join("")}</div>
+    <details><summary>מה ביקשנו</summary>${material || `<p class="muted">אין תוכן להצגה.</p>`}</details>
+    <form id="check-form"><label>ציון (0 עד 100)<input name="grade" type="number" min="0" max="100" step="1" inputmode="numeric"></label>
+      <label>הערה לתלמיד/ה<textarea name="note" rows="3" maxlength="2000"></textarea></label>
+      <p class="error" id="check-error" role="alert" hidden></p>
+      <p><button type="submit" class="primary" id="give-grade">שמירת הציון</button> <button type="button" id="send-back">החזרה לתיקון</button></p></form></section>`);
+  ctx.wire();
+  document.querySelectorAll("#check img[data-picture]").forEach(async img => { try { img.src = await pictureUrl(img.dataset.picture); img.hidden = false; } catch { img.remove(); } });
+  const form = document.getElementById("check-form"), error = document.getElementById("check-error");
+  const fail = text => { error.textContent = text; error.hidden = false; };
+  document.getElementById("back-to-inbox").addEventListener("click", () => showInbox(ctx));
+  const send = async (path, body, done) => {
+    error.hidden = true;
+    try { await api(`/api/submissions/${id}/${path}`, { method: "POST", body: { ...body, seen: s.seen } }); await showInbox(ctx, done); }
+    catch (e) { fail(e.status === 409 ? `${e.message} ` : e.message); if (e.status === 409) error.insertAdjacentHTML("beforeend", `<button type="button" id="reopen">פתיחה מחדש</button>`); document.getElementById("reopen")?.addEventListener("click", () => showInbox(ctx)); }
+  };
+  form.addEventListener("submit", event => {
+    event.preventDefault();
+    const grade = form.elements.grade.value;
+    if (grade === "" || !Number.isInteger(Number(grade)) || Number(grade) < 0 || Number(grade) > 100) return fail("הציון הוא מספר שלם בין 0 ל־100.");
+    send("grade", { grade: Number(grade), note: form.elements.note.value }, "הציון נשמר.");
+  });
+  document.getElementById("send-back").addEventListener("click", () => {
+    if (!form.elements.note.value.trim()) return fail("צריך לכתוב מה לתקן.");
+    send("return", { note: form.elements.note.value }, "המשימה הוחזרה לתלמיד/ה לתיקון.");
+  });
+}

mathly2/static/testcard.js

@@ -32,7 +32,8 @@ function simulation(test) {
 }
 
 export async function show(view, id) {
-  const test = await api(`/api/tests/${encodeURIComponent(id)}`);
+  const [test, home] = await Promise.all([api(`/api/tests/${encodeURIComponent(id)}`), api("/api/home")]);
+  const others = home.tests.filter(t => t.id !== test.id);
   view(`${tabs("home")}<p><a class="back" href="${HOME}">‹ הבית</a></p>
     <section class="card" id="test-card" data-test="${test.id}"><h2>מבחן ב־${shortDate(test.date)} <span class="muted">(${daysText(test.days_left)})</span></h2>
       <p class="muted">${test.lessons.map(l => fmt(l.name)).join(", ")}${test.note ? ` · ${esc(test.note)}` : ""}<br>${test.questions} שאלות · ${test.minutes} דקות</p>
@@ -41,5 +42,7 @@ export async function show(view, id) {
     <section class="card"><h3>מבחני תרגול</h3>${exercises(test)}
       ${test.practice_first.length ? `<p id="practice-first"><b>כדאי לתרגל קודם:</b> ${test.practice_first.map(s => `<a class="ex-chip link" href="#/skill/${esc(s.id)}">${fmt(s.name)}</a>`).join(" ")}</p>
         <p class="muted">אלה מיומנויות שעוד לא התחלתם, ולכן אין להן שאלות במבחני התרגול.</p>` : ""}</section>
-    <section class="card"><h3>מבחן סימולציה</h3>${simulation(test)}</section>`);
+    <section class="card"><h3>מבחן סימולציה</h3>${simulation(test)}</section>
+    ${others.length ? `<section class="card"><h3>מבחנים נוספים</h3><ul class="plain" id="other-tests">${others.map(t => `<li><a href="#/test/${t.id}">${shortDate(t.date)} · ${t.lessons.map(l => fmt(l.name)).join(", ")}</a>
+      <span class="muted">${daysText(t.days_left)} · מוכנות ${t.readiness.number}</span></li>`).join("")}</ul></section>` : ""}`);
 }

mathly2/static/ui.js

@@ -17,6 +17,7 @@ export const PATH = "#/subject/math/path";
 export const tabs = active => `<nav class="tabs" aria-label="תפריט התלמיד">
   <a href="${HOME}" ${active === "home" ? 'aria-current="page"' : ""}>בית</a>
   <a href="${PATH}" ${active === "path" ? 'aria-current="page"' : ""}>מסלול</a>
+  <a href="#/submissions" ${active === "submissions" ? 'aria-current="page"' : ""}>הגשות</a>
   <a href="#/grades" ${active === "grades" ? 'aria-current="page"' : ""}>ציונים</a>
   <a href="#/collection" ${active === "collection" ? 'aria-current="page"' : ""}>האוסף</a></nav>`;
 

mathly2/store.py

@@ -2,6 +2,7 @@
 InMemoryStore (tests and local development, lost on restart) and SupabaseStore (PostgREST with the secret key)."""
 from __future__ import annotations
 
+import re
 import itertools
 import json
 import threading
@@ -50,7 +51,9 @@ def _copy_attempt(row: dict) -> dict:
 def _when(value):
     if value is None or isinstance(value, datetime):
         return value
-    return datetime.fromisoformat(str(value).replace("Z", "+00:00"))
+    # Python 3.10 reads a fraction of exactly 3 or 6 digits only, and Postgres drops trailing zeros ("...57.63003+00:00")
+    text = re.sub(r"\.(\d+)", lambda m: "." + m.group(1)[:6].ljust(6, "0"), str(value).replace("Z", "+00:00"), count=1)
+    return datetime.fromisoformat(text)
 
 
 def _attempt_row(row: dict) -> dict:
@@ -78,6 +81,25 @@ def _test_row(row: dict) -> dict:
     return {**row, "date": day, "lessons": list(row.get("lessons") or []), "created_at": _when(row["created_at"]), "removed_at": _when(row.get("removed_at"))}
 
 
+PICTURE_KINDS = ("page", "answer")
+SUBMISSION_FIELDS = {"pictures", "state", "late", "handed_at", "grade", "teacher_note", "checked_at", "checked_by"}
+REQUEST_FIELDS = {"state", "picture_id"}
+
+
+def _stamped(row: dict, *names: str) -> dict:
+    """A database row with the named timestamp columns as datetimes (the in-memory store keeps datetimes already)."""
+    return {**row, **{n: _when(row.get(n)) for n in names}}
+
+
+def _assignment_row(row: dict) -> dict:
+    day = row["due_date"] if isinstance(row["due_date"], date) else date.fromisoformat(str(row["due_date"])[:10])
+    return {**_stamped(row, "created_at", "removed_at"), "due_date": day, "pages": [str(x) for x in (row.get("pages") or [])]}
+
+
+def _submission_row(row: dict) -> dict:
+    return {**_stamped(row, "handed_at", "checked_at"), "pictures": [str(x) for x in (row.get("pictures") or [])]}
+
+
 class InMemoryStore:
     def __init__(self) -> None:
         self._lock = threading.Lock()
@@ -91,6 +113,12 @@ class InMemoryStore:
         self._attempts: dict[str, dict] = {}                # attempt id -> row
         self._reward: dict[str, dict] = {}                 # user_id -> {last_comet_day, last_catch_day}
         self._tests: dict[int, dict] = {}                   # test id -> row
+        self._pictures: dict[str, dict] = {}
+        self._curriculum: dict[str, date] = {}              # lesson id -> the date it should be completed by
+        self._assignments: dict[int, dict] = {}
+        self._submissions: dict[int, dict] = {}
+        self._requests: dict[str, dict] = {}
+        self._subs: dict[int, dict] = {}                    # push subscriptions
 
     # --- classes ---
 
@@ -332,6 +360,177 @@ class InMemoryStore:
             rows = [r for r in self._tests.values() if r["class_id"] in wanted and (include_removed or not r["removed_at"])]
             return [dict(r, lessons=list(r["lessons"])) for r in sorted(rows, key=lambda r: (r["date"], r["id"]))]
 
+    # --- pictures, assignments and submissions (written work) ---
+
+    def create_picture(self, owner_id: str, kind: str, path: str, content_type: str, size: int, created_at: datetime | None = None) -> dict:
+        if kind not in PICTURE_KINDS:
+            raise ValueError(f"unknown picture kind {kind!r}")
+        row = {"id": str(uuid.uuid4()), "owner_id": owner_id, "kind": kind, "path": path, "content_type": content_type, "size": size,
+               "created_at": created_at or datetime.now(timezone.utc), "deleted_at": None}
+        with self._lock:
+            self._pictures[row["id"]] = row
+            return dict(row)
+
+    def get_picture(self, picture_id: str) -> dict | None:
+        with self._lock:
+            row = self._pictures.get(str(picture_id))
+            return dict(row) if row else None
+
+    def mark_picture_deleted(self, picture_id: str, at: datetime | None = None) -> bool:
+        with self._lock:
+            row = self._pictures.get(str(picture_id))
+            if row is None or row["deleted_at"]:
+                return False
+            row["deleted_at"] = at or datetime.now(timezone.utc)
+            return True
+
+    def pictures(self, kind: str | None = None, owner_id: str | None = None, include_deleted: bool = False) -> list[dict]:
+        with self._lock:
+            return [dict(r) for r in sorted(self._pictures.values(), key=lambda r: r["created_at"])
+                    if (kind is None or r["kind"] == kind) and (owner_id is None or r["owner_id"] == owner_id) and (include_deleted or not r["deleted_at"])]
+
+    def picture_refs(self, picture_id: str) -> dict:
+        """What refers to a picture: assignments (as a page), submissions (as an answer) and photo requests."""
+        pid = str(picture_id)
+        with self._lock:
+            return {"assignments": sorted(a["id"] for a in self._assignments.values() if pid in a["pages"]),
+                    "submissions": sorted(s["id"] for s in self._submissions.values() if pid in s["pictures"]),
+                    "requests": sorted(r["id"] for r in self._requests.values() if r["picture_id"] == pid)}
+
+    def create_assignment(self, class_id: int, title: str, due_date: date, created_by: str, kind: str, *, note: str = "", pages=(),
+                          quiz_lesson: str | None = None, test_id: int | None = None, exercise_number: int | None = None,
+                          created_at: datetime | None = None) -> dict:
+        ok = {"pages": bool(pages), "quiz": bool(quiz_lesson), "exercise_test": test_id is not None and exercise_number in (1, 2)}
+        if not ok.get(kind) or not 1 <= len(title) <= 200:
+            raise ValueError("an assignment needs a title and its content")
+        with self._lock:
+            row = {"id": next(self._ids), "class_id": class_id, "title": title, "note": note, "due_date": due_date, "kind": kind,
+                   "pages": [str(p) for p in pages], "quiz_lesson": quiz_lesson, "test_id": test_id, "exercise_number": exercise_number,
+                   "created_by": created_by, "created_at": created_at or datetime.now(timezone.utc), "removed_at": None}
+            self._assignments[row["id"]] = row
+            return dict(row, pages=list(row["pages"]))
+
+    def get_assignment(self, assignment_id: int) -> dict | None:
+        with self._lock:
+            row = self._assignments.get(assignment_id)
+            return dict(row, pages=list(row["pages"])) if row else None
+
+    def assignments_of_classes(self, class_ids, include_removed: bool = False) -> list[dict]:
+        """The assignments of these classes, the nearest due date first."""
+        wanted = set(class_ids)
+        with self._lock:
+            rows = [r for r in self._assignments.values() if r["class_id"] in wanted and (include_removed or not r["removed_at"])]
+            return [dict(r, pages=list(r["pages"])) for r in sorted(rows, key=lambda r: (r["due_date"], r["id"]))]
+
+    def remove_assignment(self, assignment_id: int, at: datetime | None = None) -> bool:
+        with self._lock:
+            row = self._assignments.get(assignment_id)
+            if row is None or row["removed_at"]:
+                return False
+            row["removed_at"] = at or datetime.now(timezone.utc)
+            return True
+
+    def get_submission(self, assignment_id: int, user_id: str) -> dict | None:
+        with self._lock:
+            row = next((r for r in self._submissions.values() if r["assignment_id"] == assignment_id and r["user_id"] == user_id), None)
+            return dict(row, pictures=list(row["pictures"])) if row else None
+
+    def get_submission_by_id(self, submission_id: int) -> dict | None:
+        with self._lock:
+            row = self._submissions.get(submission_id)
+            return dict(row, pictures=list(row["pictures"])) if row else None
+
+    def save_submission(self, assignment_id: int, user_id: str, **fields) -> dict:
+        """Create the student's submission or change the given fields of it."""
+        unknown = set(fields) - SUBMISSION_FIELDS
+        if unknown:
+            raise ValueError(f"unknown submission fields {sorted(unknown)}")
+        with self._lock:
+            row = next((r for r in self._submissions.values() if r["assignment_id"] == assignment_id and r["user_id"] == user_id), None)
+            candidate = dict(row) if row else {"id": next(self._ids), "assignment_id": assignment_id, "user_id": user_id, "pictures": [], "state": "handed_in",
+                                               "late": False, "handed_at": datetime.now(timezone.utc), "grade": None, "teacher_note": "", "checked_at": None,
+                                               "checked_by": None}
+            candidate.update({k: ([str(x) for x in v] if k == "pictures" else v) for k, v in fields.items()})
+            if candidate["state"] == "graded" and candidate["grade"] is None:
+                raise ValueError("a graded submission has a grade")                      # refused before anything is stored
+            if candidate["grade"] is not None and not 0 <= candidate["grade"] <= 100:
+                raise ValueError("a grade is 0 to 100")
+            self._submissions[candidate["id"]] = candidate
+            return dict(candidate, pictures=list(candidate["pictures"]))
+
+    def submissions_of_assignments(self, assignment_ids) -> list[dict]:
+        wanted = set(assignment_ids)
+        with self._lock:
+            return [dict(r, pictures=list(r["pictures"])) for r in sorted(self._submissions.values(), key=lambda r: (r["handed_at"], r["id"]))
+                    if r["assignment_id"] in wanted]
+
+    def submissions_of_user(self, user_id: str) -> list[dict]:
+        with self._lock:
+            return [dict(r, pictures=list(r["pictures"])) for r in self._submissions.values() if r["user_id"] == user_id]
+
+    # --- photo requests and push subscriptions ---
+
+    def create_photo_request(self, user_id: str, assignment_id: int, device: str, code: str, created_at: datetime, expires_at: datetime) -> dict:
+        """A new request; the student's earlier waiting request for the same assignment becomes superseded."""
+        with self._lock:
+            for r in self._requests.values():
+                if r["user_id"] == user_id and r["assignment_id"] == assignment_id and r["state"] == "waiting":
+                    r["state"] = "superseded"
+            row = {"id": str(uuid.uuid4()), "user_id": user_id, "assignment_id": assignment_id, "device": device, "code": code, "state": "waiting",
+                   "created_at": created_at, "expires_at": expires_at, "picture_id": None}
+            self._requests[row["id"]] = row
+            return dict(row)
+
+    def get_photo_request(self, request_id: str) -> dict | None:
+        with self._lock:
+            row = self._requests.get(str(request_id))
+            return dict(row) if row else None
+
+    def save_photo_request(self, request_id: str, **fields) -> dict:
+        unknown = set(fields) - REQUEST_FIELDS
+        if unknown:
+            raise ValueError(f"unknown photo request fields {sorted(unknown)}")
+        with self._lock:
+            row = self._requests.get(str(request_id))
+            if row is None:
+                raise KeyError(request_id)
+            row.update(fields)
+            return dict(row)
+
+    def open_photo_requests(self, user_id: str) -> list[dict]:
+        """The student's requests still waiting for or receiving a picture, the newest first (expiry is decided by the caller)."""
+        with self._lock:
+            return [dict(r) for r in sorted(self._requests.values(), key=lambda r: r["created_at"], reverse=True)
+                    if r["user_id"] == user_id and r["state"] in ("waiting", "uploading")]
+
+    def add_push_subscription(self, user_id: str, endpoint: str, p256dh: str, auth: str, key_id: str) -> dict:
+        with self._lock:
+            row = next((r for r in self._subs.values() if r["endpoint"] == endpoint), None)
+            if row is None:
+                row = {"id": next(self._ids), "endpoint": endpoint, "created_at": datetime.now(timezone.utc)}
+                self._subs[row["id"]] = row
+            row.update({"user_id": user_id, "p256dh": p256dh, "auth": auth, "key_id": key_id})
+            return dict(row)
+
+    def push_subscriptions_of(self, user_id: str) -> list[dict]:
+        with self._lock:
+            return [dict(r) for r in self._subs.values() if r["user_id"] == user_id]
+
+    def delete_push_subscription(self, endpoint: str) -> bool:
+        with self._lock:
+            found = [i for i, r in self._subs.items() if r["endpoint"] == endpoint]
+            for i in found:
+                del self._subs[i]
+            return bool(found)
+
+    def drop_push_subscriptions_not_of(self, key_id: str) -> int:
+        """The server's push key changed: subscriptions made under another key are dropped, and each phone turns notifications on again."""
+        with self._lock:
+            gone = [i for i, r in self._subs.items() if r["key_id"] != key_id]
+            for i in gone:
+                del self._subs[i]
+            return len(gone)
+
     # --- timed attempts (quizzes; later exercise tests and the simulation) ---
 
     def create_attempt(self, user_id: str, kind: str, scope: str, started_at: datetime, due_at: datetime, questions: list[dict]) -> dict:
@@ -384,6 +583,21 @@ class InMemoryStore:
             row.update(fields)
             return dict(row)
 
+    # --- the curriculum: the date by which each lesson should be completed ---
+
+    def curriculum(self) -> dict[str, date]:
+        with self._lock:
+            return dict(self._curriculum)
+
+    def set_lesson_dates(self, dates: dict[str, date | None]) -> None:
+        """Set each lesson's date; None clears it."""
+        with self._lock:
+            for lesson, day in dates.items():
+                if day is None:
+                    self._curriculum.pop(lesson, None)
+                else:
+                    self._curriculum[lesson] = day
+
     def last_answered(self, user_id: str) -> dict[str, date]:
         """The day of the student's newest answer on each skill (helped and wrong answers count): what fading reads."""
         with self._lock:
@@ -633,6 +847,146 @@ class SupabaseStore:
             params["removed_at"] = "is.null"
         return [_test_row(r) for r in self._request("GET", "m2_tests", params)]
 
+    # --- pictures, assignments and submissions (written work) ---
+
+    def create_picture(self, owner_id: str, kind: str, path: str, content_type: str, size: int, created_at: datetime | None = None) -> dict:
+        if kind not in PICTURE_KINDS:
+            raise ValueError(f"unknown picture kind {kind!r}")
+        body = {"owner_id": owner_id, "kind": kind, "path": path, "content_type": content_type, "size": size}
+        if created_at:
+            body["created_at"] = created_at.isoformat()
+        return _stamped(self._request("POST", "m2_pictures", body=body, returning=True)[0], "created_at", "deleted_at")
+
+    def get_picture(self, picture_id: str) -> dict | None:
+        try:
+            rows = self._request("GET", "m2_pictures", {"id": self._eq(picture_id), "select": "*"})
+        except urllib.error.HTTPError as exc:
+            if exc.code == 400:                                  # not a valid id
+                return None
+            raise
+        return _stamped(rows[0], "created_at", "deleted_at") if rows else None
+
+    def mark_picture_deleted(self, picture_id: str, at: datetime | None = None) -> bool:
+        stamp = (at or datetime.now(timezone.utc)).isoformat()
+        return bool(self._request("PATCH", "m2_pictures", {"id": self._eq(picture_id), "deleted_at": "is.null"}, {"deleted_at": stamp}, returning=True))
+
+    def pictures(self, kind: str | None = None, owner_id: str | None = None, include_deleted: bool = False) -> list[dict]:
+        params = {"select": "*", "order": "created_at"}
+        if kind:
+            params["kind"] = self._eq(kind)
+        if owner_id:
+            params["owner_id"] = self._eq(owner_id)
+        if not include_deleted:
+            params["deleted_at"] = "is.null"
+        return [_stamped(r, "created_at", "deleted_at") for r in self._request("GET", "m2_pictures", params)]
+
+    def picture_refs(self, picture_id: str) -> dict:
+        pid = str(picture_id)
+        return {"assignments": sorted(r["id"] for r in self._request("GET", "m2_assignments", {"pages": f"cs.{{{pid}}}", "select": "id"})),
+                "submissions": sorted(r["id"] for r in self._request("GET", "m2_submissions", {"pictures": f"cs.{{{pid}}}", "select": "id"})),
+                "requests": sorted(r["id"] for r in self._request("GET", "m2_photo_requests", {"picture_id": self._eq(pid), "select": "id"}))}
+
+    def create_assignment(self, class_id: int, title: str, due_date: date, created_by: str, kind: str, *, note: str = "", pages=(),
+                          quiz_lesson: str | None = None, test_id: int | None = None, exercise_number: int | None = None,
+                          created_at: datetime | None = None) -> dict:
+        ok = {"pages": bool(pages), "quiz": bool(quiz_lesson), "exercise_test": test_id is not None and exercise_number in (1, 2)}
+        if not ok.get(kind) or not 1 <= len(title) <= 200:
+            raise ValueError("an assignment needs a title and its content")
+        body = {"class_id": class_id, "title": title, "note": note, "due_date": due_date.isoformat(), "kind": kind, "pages": [str(p) for p in pages],
+                "quiz_lesson": quiz_lesson, "test_id": test_id, "exercise_number": exercise_number, "created_by": created_by}
+        if created_at:
+            body["created_at"] = created_at.isoformat()
+        return _assignment_row(self._request("POST", "m2_assignments", body=body, returning=True)[0])
+
+    def get_assignment(self, assignment_id: int) -> dict | None:
+        rows = self._request("GET", "m2_assignments", {"id": self._eq(assignment_id), "select": "*"})
+        return _assignment_row(rows[0]) if rows else None
+
+    def assignments_of_classes(self, class_ids, include_removed: bool = False) -> list[dict]:
+        ids = sorted(set(class_ids))
+        if not ids:
+            return []
+        params = {"class_id": f"in.({','.join(str(i) for i in ids)})", "select": "*", "order": "due_date,id"}
+        if not include_removed:
+            params["removed_at"] = "is.null"
+        return [_assignment_row(r) for r in self._request("GET", "m2_assignments", params)]
+
+    def remove_assignment(self, assignment_id: int, at: datetime | None = None) -> bool:
+        stamp = (at or datetime.now(timezone.utc)).isoformat()
+        return bool(self._request("PATCH", "m2_assignments", {"id": self._eq(assignment_id), "removed_at": "is.null"}, {"removed_at": stamp}, returning=True))
+
+    def get_submission(self, assignment_id: int, user_id: str) -> dict | None:
+        rows = self._request("GET", "m2_submissions", {"assignment_id": self._eq(assignment_id), "user_id": self._eq(user_id), "select": "*"})
+        return _submission_row(rows[0]) if rows else None
+
+    def get_submission_by_id(self, submission_id: int) -> dict | None:
+        rows = self._request("GET", "m2_submissions", {"id": self._eq(submission_id), "select": "*"})
+        return _submission_row(rows[0]) if rows else None
+
+    def save_submission(self, assignment_id: int, user_id: str, **fields) -> dict:
+        unknown = set(fields) - SUBMISSION_FIELDS
+        if unknown:
+            raise ValueError(f"unknown submission fields {sorted(unknown)}")
+        body = {k: (v.isoformat() if isinstance(v, datetime) else ([str(x) for x in v] if k == "pictures" else v)) for k, v in fields.items()}
+        rows = self._request("POST", "m2_submissions", {"on_conflict": "assignment_id,user_id"},
+                             {"assignment_id": assignment_id, "user_id": user_id, **body}, returning=True, upsert=True)
+        return _submission_row(rows[0])
+
+    def submissions_of_assignments(self, assignment_ids) -> list[dict]:
+        ids = sorted(set(assignment_ids))
+        if not ids:
+            return []
+        rows = self._request("GET", "m2_submissions", {"assignment_id": f"in.({','.join(str(i) for i in ids)})", "select": "*", "order": "handed_at,id"})
+        return [_submission_row(r) for r in rows]
+
+    def submissions_of_user(self, user_id: str) -> list[dict]:
+        return [_submission_row(r) for r in self._request("GET", "m2_submissions", {"user_id": self._eq(user_id), "select": "*"})]
+
+    # --- photo requests and push subscriptions ---
+
+    def create_photo_request(self, user_id: str, assignment_id: int, device: str, code: str, created_at: datetime, expires_at: datetime) -> dict:
+        self._request("PATCH", "m2_photo_requests", {"user_id": self._eq(user_id), "assignment_id": self._eq(assignment_id), "state": "eq.waiting"},
+                      {"state": "superseded"})
+        rows = self._request("POST", "m2_photo_requests", body={"user_id": user_id, "assignment_id": assignment_id, "device": device, "code": code,
+                                                                "created_at": created_at.isoformat(), "expires_at": expires_at.isoformat()}, returning=True)
+        return _stamped(rows[0], "created_at", "expires_at")
+
+    def get_photo_request(self, request_id: str) -> dict | None:
+        try:
+            rows = self._request("GET", "m2_photo_requests", {"id": self._eq(request_id), "select": "*"})
+        except urllib.error.HTTPError as exc:
+            if exc.code == 400:
+                return None
+            raise
+        return _stamped(rows[0], "created_at", "expires_at") if rows else None
+
+    def save_photo_request(self, request_id: str, **fields) -> dict:
+        unknown = set(fields) - REQUEST_FIELDS
+        if unknown:
+            raise ValueError(f"unknown photo request fields {sorted(unknown)}")
+        rows = self._request("PATCH", "m2_photo_requests", {"id": self._eq(request_id)}, fields, returning=True)
+        if not rows:
+            raise KeyError(request_id)
+        return _stamped(rows[0], "created_at", "expires_at")
+
+    def open_photo_requests(self, user_id: str) -> list[dict]:
+        rows = self._request("GET", "m2_photo_requests", {"user_id": self._eq(user_id), "state": "in.(waiting,uploading)", "select": "*", "order": "created_at.desc"})
+        return [_stamped(r, "created_at", "expires_at") for r in rows]
+
+    def add_push_subscription(self, user_id: str, endpoint: str, p256dh: str, auth: str, key_id: str) -> dict:
+        rows = self._request("POST", "m2_push_subscriptions", {"on_conflict": "endpoint"},
+                             {"user_id": user_id, "endpoint": endpoint, "p256dh": p256dh, "auth": auth, "key_id": key_id}, returning=True, upsert=True)
+        return _stamped(rows[0], "created_at")
+
+    def push_subscriptions_of(self, user_id: str) -> list[dict]:
+        return [_stamped(r, "created_at") for r in self._request("GET", "m2_push_subscriptions", {"user_id": self._eq(user_id), "select": "*"})]
+
+    def delete_push_subscription(self, endpoint: str) -> bool:
+        return bool(self._request("DELETE", "m2_push_subscriptions", {"endpoint": self._eq(endpoint)}, returning=True))
+
+    def drop_push_subscriptions_not_of(self, key_id: str) -> int:
+        return len(self._request("DELETE", "m2_push_subscriptions", {"key_id": f"neq.{key_id}"}, returning=True) or [])
+
     # --- timed attempts ---
 
     def create_attempt(self, user_id: str, kind: str, scope: str, started_at: datetime, due_at: datetime, questions: list[dict]) -> dict:
@@ -687,6 +1041,19 @@ class SupabaseStore:
     def reward_state_row(row: dict) -> dict:
         return {**row, **{k: date.fromisoformat(row[k]) if row.get(k) else None for k in ("last_comet_day", "last_catch_day")}}
 
+    # --- the curriculum ---
+
+    def curriculum(self) -> dict[str, date]:
+        return {r["lesson_id"]: date.fromisoformat(str(r["due_date"])[:10]) for r in self._request("GET", "m2_curriculum", {"select": "lesson_id,due_date"})}
+
+    def set_lesson_dates(self, dates: dict[str, date | None]) -> None:
+        cleared = [lesson for lesson, day in dates.items() if day is None]
+        if cleared:
+            self._request("DELETE", "m2_curriculum", {"lesson_id": "in.(" + ",".join(f'"{x}"' for x in cleared) + ")"})
+        rows = [{"lesson_id": lesson, "due_date": day.isoformat()} for lesson, day in dates.items() if day is not None]
+        if rows:
+            self._request("POST", "m2_curriculum", {"on_conflict": "lesson_id"}, rows, upsert=True)
+
     def last_answered(self, user_id: str) -> dict[str, date]:
         rows = self._request("GET", "m2_last_answered", {"user_id": self._eq(user_id), "select": "skill_id,day"})
         return {r["skill_id"]: date.fromisoformat(r["day"]) for r in rows}

mathly2/supabase/migrations/20261112090000_m2_written_work.sql

@@ -0,0 +1,94 @@
+-- Mathly 2: written work. Additive (new objects only). Read and written only by the server with the secret key: row-level security is on,
+-- there are no policies, and the browser roles get no grants (as in m2_classes).
+-- Pictures are not stored here: m2_pictures holds their rows, the bytes are in the private Storage bucket (MATHLY_M2_ANSWER_BUCKET, default m2-answers),
+-- which the server creates on first use.
+-- Rollback: drop table m2_push_subscriptions, m2_photo_requests, m2_submissions, m2_assignments, m2_pictures;
+begin;
+
+-- A picture: a page of an assignment (kind 'page') or a student's answer ('answer'). `deleted_at` is set when its bytes are removed.
+create table public.m2_pictures (
+  id uuid primary key default gen_random_uuid(),
+  owner_id uuid not null,
+  kind text not null check (kind in ('page', 'answer')),
+  path text not null unique,
+  content_type text not null,
+  size integer not null check (size between 1 and 10000000),
+  created_at timestamptz not null default now(),
+  deleted_at timestamptz
+);
+create index m2_pictures_owner on public.m2_pictures (owner_id);
+
+-- Work a teacher gives a class: pages (pictures), one of the bank's written quizzes, or an exercise test of a real test.
+create table public.m2_assignments (
+  id bigint generated always as identity primary key,
+  class_id bigint not null references public.m2_classes(id) on delete cascade,
+  title text not null check (char_length(title) between 1 and 200),
+  note text not null default '',
+  due_date date not null,
+  kind text not null check (kind in ('pages', 'quiz', 'exercise_test')),
+  pages uuid[] not null default '{}',
+  quiz_lesson text,
+  test_id bigint references public.m2_tests(id) on delete cascade,
+  exercise_number integer check (exercise_number in (1, 2)),
+  created_by text not null,
+  created_at timestamptz not null default now(),
+  removed_at timestamptz,
+  check (case kind when 'pages' then cardinality(pages) > 0
+                   when 'quiz' then quiz_lesson is not null
+                   else test_id is not null and exercise_number is not null end)
+);
+create index m2_assignments_class on public.m2_assignments (class_id) where removed_at is null;
+
+-- What a student handed in: one row per student and assignment, rewritten when they hand in again after a return.
+create table public.m2_submissions (
+  id bigint generated always as identity primary key,
+  assignment_id bigint not null references public.m2_assignments(id) on delete cascade,
+  user_id uuid not null,
+  pictures uuid[] not null default '{}',
+  state text not null default 'handed_in' check (state in ('handed_in', 'graded', 'returned')),
+  late boolean not null default false,
+  handed_at timestamptz not null default now(),
+  grade integer check (grade between 0 and 100),
+  teacher_note text not null default '',
+  checked_at timestamptz,
+  checked_by text,
+  unique (assignment_id, user_id),
+  check (state <> 'graded' or grade is not null)
+);
+
+-- A computer asking the student's phone for a photo of one answer.
+create table public.m2_photo_requests (
+  id uuid primary key default gen_random_uuid(),
+  user_id uuid not null,
+  assignment_id bigint not null references public.m2_assignments(id) on delete cascade,
+  device text not null,
+  code text not null check (code ~ '^[0-9]{4}$'),
+  state text not null default 'waiting' check (state in ('waiting', 'uploading', 'received', 'failed', 'expired', 'superseded')),
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  picture_id uuid references public.m2_pictures(id) on delete set null,
+  check (expires_at > created_at)
+);
+create index m2_photo_requests_user on public.m2_photo_requests (user_id, created_at);
+
+-- A phone that turned notifications on. `key_id` is a fingerprint of the server's push key: a subscription made under another key is dropped.
+create table public.m2_push_subscriptions (
+  id bigint generated always as identity primary key,
+  user_id uuid not null,
+  endpoint text not null unique,
+  p256dh text not null,
+  auth text not null,
+  key_id text not null,
+  created_at timestamptz not null default now()
+);
+create index m2_push_subscriptions_user on public.m2_push_subscriptions (user_id);
+
+alter table public.m2_pictures enable row level security;
+alter table public.m2_assignments enable row level security;
+alter table public.m2_submissions enable row level security;
+alter table public.m2_photo_requests enable row level security;
+alter table public.m2_push_subscriptions enable row level security;
+revoke all on public.m2_pictures, public.m2_assignments, public.m2_submissions, public.m2_photo_requests, public.m2_push_subscriptions from public, anon, authenticated;
+grant all on public.m2_pictures, public.m2_assignments, public.m2_submissions, public.m2_photo_requests, public.m2_push_subscriptions to service_role;
+grant usage, select on sequence public.m2_assignments_id_seq, public.m2_submissions_id_seq, public.m2_push_subscriptions_id_seq to service_role;
+commit;

mathly2/supabase/migrations/20261113090000_m2_curriculum.sql

@@ -0,0 +1,12 @@
+-- Mathly 2: the curriculum. One date per lesson for the whole school: the day by which the lesson should be completed.
+-- A lesson without a row has no date. Lesson ids are the exercise bank's ids (text), as in m2_classes.lessons.
+-- Additive (one new table). Rollback: drop table public.m2_curriculum;
+begin;
+create table public.m2_curriculum (
+  lesson_id text primary key,
+  due_date date not null
+);
+alter table public.m2_curriculum enable row level security;
+revoke all on public.m2_curriculum from public, anon, authenticated;
+grant all on public.m2_curriculum to service_role;
+commit;

mathly2/tests/serve.py

@@ -32,3 +32,10 @@ def offline_formulas(page):
     """For tests that show no formulas: do not wait for the formula library from the network (a slow CDN made them time out)."""
     page.route("**/mathjax@*/**", lambda route: route.abort())
     return page
+
+
+def only(bank, lessons):
+    """A bank with just these lessons (and their skills), for tests that want a short path: every class now studies the whole bank."""
+    from mathly2.bank import Bank
+    keep = set(lessons)
+    return Bank({**bank.data, "units": [u for u in bank.lessons if u["id"] in keep], "skills": [s for s in bank.skills if s["unit"] in keep]})

mathly2/tests/test_assignments_api.py

@@ -0,0 +1,502 @@
+"""Assignments through the API: the teacher's side (add-written-work 2.2); the student's and the inbox are below."""
+import io
+import uuid
+from datetime import date, datetime, timedelta, timezone
+
+import pytest
+from fastapi.testclient import TestClient
+from PIL import Image
+
+from mathly2 import clock
+from mathly2.bank import load_bank
+from mathly2.config import Settings
+from mathly2.main import create_app
+from mathly2.store import InMemoryStore
+
+TEACHER, OTHER_TEACHER, KID, KID2, OUTSIDER, MGR, DEV = ("t@school.test", "t2@school.test", "kid@school.test", "kid2@school.test", "out@school.test",
+                                                           "mgr@school.test", "dev@school.test")
+MON = datetime(2026, 11, 9, 9, 0, tzinfo=timezone.utc)
+DAY = timedelta(days=1)
+
+
+def uid(email):
+    return str(uuid.uuid5(uuid.NAMESPACE_DNS, email))
+
+
+def auth(email):
+    return {"Authorization": f"Bearer dev:{email}"}
+
+
+def image(fmt="JPEG", color="red"):
+    out = io.BytesIO()
+    Image.new("RGB", (80, 50), color).save(out, fmt)
+    return out.getvalue()
+
+
+def make_pdf(pages):
+    import pypdfium2 as pdfium
+    doc = pdfium.PdfDocument.new()
+    for _ in range(pages):
+        doc.new_page(200, 300)
+    out = io.BytesIO()
+    doc.save(out)
+    return out.getvalue()
+
+
+@pytest.fixture(scope="module")
+def bank():
+    return load_bank()
+
+
+@pytest.fixture
+def world(bank, monkeypatch):
+    """Class A (teacher T; students KID, KID2) studies a lesson with an authored written quiz and one without; class B (teacher T2; OUTSIDER)."""
+    with_quiz = [u["id"] for u in bank.data["units"] if u.get("quiz")]
+    without = next(u["id"] for u in bank.data["units"] if not u.get("quiz"))
+    store = InMemoryStore()
+    store.give_role(MGR, "manager", "setup")
+    a = store.create_class("setup", "A", lessons=[with_quiz[0], without], teacher_email=TEACHER)
+    b = store.create_class("setup", "B", lessons=[with_quiz[1]], teacher_email=OTHER_TEACHER)
+    for email in (KID, KID2):
+        store.add_member(a["id"], email)
+        store.link_user(email, uid(email))
+    store.add_member(b["id"], OUTSIDER)
+    client = TestClient(create_app(Settings(developers=frozenset({DEV})), bank=bank, store=store))
+    moment = {"now": MON}
+    monkeypatch.setattr(clock, "now", lambda: moment["now"])
+    client.set_time = lambda value: moment.update(now=value)
+    client.store, client.a, client.b, client.quiz_lesson, client.plain_lesson, client.other_quiz = store, a, b, with_quiz[0], without, with_quiz[1]
+    return client
+
+
+def upload_pages(client, data, kind="image/jpeg", who=TEACHER):
+    return client.post("/api/assignments/pages", content=data, headers={**auth(who), "Content-Type": kind})
+
+
+def give(client, who=TEACHER, class_id=None, **body):
+    due = (clock.now() + 7 * DAY).date().isoformat()
+    return client.post(f"/api/classes/{class_id or client.a['id']}/assignments", json={"title": "משימה", "due_date": due, **body}, headers=auth(who))
+
+
+# --- 2.2 giving: the five sources ---
+
+def test_from_an_uploaded_image_the_board_or_a_photo_the_pages_become_the_assignments_pages(world):
+    first = upload_pages(world, image("JPEG")).json()["pictures"]
+    second = upload_pages(world, image("PNG", "blue"), "image/png").json()["pictures"]         # what the board sends: a PNG page
+    assert len(first) == 1 and len(second) == 1
+    got = give(world, kind="pages", pages=first + second, note="לפתור עד יום ד׳")
+    assert got.status_code == 201
+    body = got.json()
+    assert body["kind"] == "pages" and body["pages"] == first + second and body["note"] == "לפתור עד יום ד׳" and body["days_left"] == 7
+    assert body["students"] == 2 and body["handed_in"] == 0 and body["graded"] == 0 and body["class"]["name"] == "A"
+    assert all(world.store.get_picture(p)["kind"] == "page" and world.store.get_picture(p)["owner_id"] == uid(TEACHER) for p in first + second)
+
+
+def test_a_pdf_becomes_one_page_picture_per_sheet(world):
+    ids = upload_pages(world, make_pdf(3), "application/pdf").json()["pictures"]
+    assert len(ids) == 3 and len(set(ids)) == 3
+    assert upload_pages(world, b"hello", "application/pdf").status_code == 415
+    assert upload_pages(world, b"nonsense", "image/jpeg").status_code == 400
+    assert give(world, kind="pages", pages=ids).json()["pages"] == ids
+
+
+def test_from_the_banks_written_quiz_only_for_a_class_lesson_that_has_one(world, bank):
+    got = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="בוחן כתוב")
+    assert got.status_code == 201 and got.json()["quiz_lesson"]["id"] == world.quiz_lesson and got.json()["quiz_lesson"]["name"]
+    assert give(world, kind="quiz", quiz_lesson=world.plain_lesson).status_code == 422          # a class lesson with no written quiz
+    assert give(world, kind="quiz", quiz_lesson=world.other_quiz).status_code == 422            # a quiz of a lesson the class does not study
+    assert give(world, kind="quiz").status_code == 422
+
+
+def test_an_exercise_test_of_a_test_of_the_class_can_be_sent_as_an_assignment(world):
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    other = world.store.create_test(world.b["id"], clock.school_day() + 10 * DAY, [world.other_quiz], OTHER_TEACHER, created_at=clock.now())
+    got = give(world, kind="exercise_test", test_id=test["id"], exercise_number=2)
+    assert got.status_code == 201 and got.json()["test"] == {"id": test["id"], "number": 2, "date": test["date"].isoformat()} and got.json()["done"] == 0
+    assert give(world, kind="exercise_test", test_id=other["id"], exercise_number=1).status_code == 422        # another class's test
+    assert give(world, kind="exercise_test", test_id=test["id"], exercise_number=3).status_code == 422
+    assert give(world, kind="exercise_test", test_id=999, exercise_number=1).status_code == 422
+    world.store.remove_test(test["id"])
+    assert give(world, kind="exercise_test", test_id=test["id"], exercise_number=1).status_code == 422
+
+
+def test_giving_needs_a_class_the_teacher_teaches_a_future_date_and_pages_that_are_their_own(world):
+    assert give(world, who=OTHER_TEACHER, kind="quiz", quiz_lesson=world.quiz_lesson).status_code == 404
+    assert give(world, who=KID, kind="quiz", quiz_lesson=world.quiz_lesson).status_code == 403
+    assert give(world, who=MGR, kind="quiz", quiz_lesson=world.quiz_lesson).status_code == 403
+    past = world.post(f"/api/classes/{world.a['id']}/assignments", json={"title": "x", "due_date": (clock.now() - DAY).date().isoformat(), "kind": "quiz",
+                                                                       "quiz_lesson": world.quiz_lesson}, headers=auth(TEACHER))
+    assert past.status_code == 422
+    assert give(world, kind="pages", pages=[]).status_code == 422
+    mine = upload_pages(world, image()).json()["pictures"]
+    theirs = upload_pages(world, image(), who=OTHER_TEACHER).json()["pictures"]
+    assert give(world, kind="pages", pages=theirs).status_code == 422                          # a page someone else uploaded
+    answer = world.post("/api/pictures", content=image(), headers={**auth(KID), "Content-Type": "image/jpeg"}).json()["id"]
+    assert give(world, kind="pages", pages=[answer]).status_code == 422                        # an answer picture is not a page
+    assert give(world, kind="pages", pages=[str(uuid.uuid4())]).status_code == 422
+    assert give(world, kind="pages", pages=mine, title="").status_code == 422
+    assert give(world, who=DEV, kind="quiz", quiz_lesson=world.quiz_lesson).status_code == 201     # a developer may give to any class
+
+
+def test_the_list_has_counts_and_a_developer_sees_every_class(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    world.store.save_submission(quiz["id"], uid(KID), pictures=["p1"])
+    world.store.save_submission(quiz["id"], uid(KID2), pictures=["p2"], state="graded", grade=80)
+    listed = world.get("/api/teaching/assignments", headers=auth(TEACHER)).json()
+    assert [c["class"]["name"] for c in listed] == ["A"]
+    one = listed[0]["assignments"][0]
+    assert (one["handed_in"], one["graded"], one["returned"], one["waiting"], one["students"]) == (1, 1, 0, 1, 2)
+    assert listed[0]["class"]["lessons"]
+    assert [c["class"]["name"] for c in world.get("/api/teaching/assignments", headers=auth(DEV)).json()] == ["A", "B"]
+    assert world.get("/api/teaching/assignments", headers=auth(OTHER_TEACHER)).json()[0]["assignments"] == []
+
+
+def test_removing_an_assignment_hides_it_and_keeps_the_grades_already_given(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    world.store.save_submission(quiz["id"], uid(KID), pictures=["p1"], state="graded", grade=90, teacher_note="יפה")
+    assert world.delete(f"/api/assignments/{quiz['id']}", headers=auth(OTHER_TEACHER)).status_code == 404
+    assert world.delete(f"/api/assignments/{quiz['id']}", headers=auth(KID)).status_code == 403
+    assert world.delete(f"/api/assignments/{quiz['id']}", headers=auth(TEACHER)).status_code == 204
+    assert world.get("/api/teaching/assignments", headers=auth(TEACHER)).json()[0]["assignments"] == []
+    assert world.delete(f"/api/assignments/{quiz['id']}", headers=auth(TEACHER)).status_code == 404
+    kept = world.store.get_submission(quiz["id"], uid(KID))
+    assert (kept["grade"], kept["teacher_note"]) == (90, "יפה") and world.store.get_assignment(quiz["id"])["removed_at"] is not None
+
+
+# --- 2.3 the student's side ---
+
+def answer_picture(client, who=KID):
+    got = client.post("/api/pictures", content=image(), headers={**auth(who), "Content-Type": "image/jpeg"})
+    assert got.status_code == 201, got.text
+    return got.json()["id"]
+
+
+def hand(client, assignment_id, pictures, who=KID):
+    return client.post(f"/api/assignments/{assignment_id}/submission", json={"pictures": pictures}, headers=auth(who))
+
+
+def mine(client, who=KID):
+    return client.get("/api/assignments", headers=auth(who)).json()
+
+
+def test_a_student_sees_only_their_classes_assignments_with_state_and_due_date(world):
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="בוחן כתוב").json()
+    listed = mine(world)
+    assert [x["id"] for x in listed] == [a["id"]] and listed[0]["state"] == "not_handed" and listed[0]["days_left"] == 7 and listed[0]["class"]["name"] == "A"
+    assert mine(world, KID2)[0]["id"] == a["id"] and mine(world, OUTSIDER) == []                      # another class sees nothing
+    assert world.get(f"/api/assignments/{a['id']}", headers=auth(OUTSIDER)).status_code == 404
+
+
+def test_a_written_quiz_shows_its_questions_with_points_and_a_pages_assignment_its_pages(world, bank):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    detail = world.get(f"/api/assignments/{quiz['id']}", headers=auth(KID)).json()
+    questions = detail["quiz"]["questions"]
+    assert len(questions) == 4 and sum(q["points"] for q in questions) == 100 == detail["quiz"]["points"] and detail["quiz"]["minutes"] == 45
+    assert all(q["question"] for q in questions)
+    pages = upload_pages(world, image()).json()["pictures"]
+    sheet = give(world, kind="pages", pages=pages).json()
+    assert world.get(f"/api/assignments/{sheet['id']}", headers=auth(KID)).json()["pages"] == pages
+    assert world.get(f"/api/pictures/{pages[0]}", headers=auth(KID)).status_code == 200            # the class's students read the pages
+
+
+def test_handing_in_one_to_ten_of_the_students_own_answer_pictures(world):
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    pics = [answer_picture(world) for _ in range(3)]
+    got = hand(world, a["id"], pics)
+    assert got.status_code == 200 and got.json()["state"] == "handed_in" and got.json()["late"] is False
+    detail = world.get(f"/api/assignments/{a['id']}", headers=auth(KID)).json()
+    assert [p["id"] for p in detail["pictures"]] == pics and detail["state"] == "handed_in"
+    assert hand(world, a["id"], []).status_code == 422 and hand(world, a["id"], [answer_picture(world) for _ in range(11)]).status_code == 422
+    assert hand(world, a["id"], [answer_picture(world, KID2)]).status_code == 422                    # someone else's picture
+    page = upload_pages(world, image()).json()["pictures"][0]
+    assert hand(world, a["id"], [page]).status_code == 422                                           # a page is not an answer
+    assert hand(world, a["id"], [str(uuid.uuid4())]).status_code == 422
+    gone = answer_picture(world)
+    world.store.mark_picture_deleted(gone)
+    assert hand(world, a["id"], [gone]).status_code == 422
+    assert world.get(f"/api/assignments/{a['id']}", headers=auth(KID)).json()["pictures"] == detail["pictures"]    # refused tries changed nothing
+    assert hand(world, a["id"], pics, who=OUTSIDER).status_code == 404
+
+
+def test_a_handed_in_submission_can_be_replaced_a_returned_one_handed_in_again_and_a_graded_one_not_changed(world):
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    first = answer_picture(world)
+    hand(world, a["id"], [first])
+    second = answer_picture(world)
+    assert hand(world, a["id"], [second]).json()["state"] == "handed_in"                              # replaced while handed in
+    assert [p["id"] for p in world.get(f"/api/assignments/{a['id']}", headers=auth(KID)).json()["pictures"]] == [second]
+    sub = world.store.get_submission(a["id"], uid(KID))
+    world.store.save_submission(a["id"], uid(KID), state="returned", teacher_note="חסר נימוק בסעיף 2", checked_by=TEACHER)
+    shown = world.get(f"/api/assignments/{a['id']}", headers=auth(KID)).json()
+    assert shown["state"] == "returned" and shown["teacher_note"] == "חסר נימוק בסעיף 2" and mine(world)[0]["state"] == "returned"
+    third = answer_picture(world)
+    assert hand(world, a["id"], [third]).json()["state"] == "handed_in"                               # handed in again
+    world.store.save_submission(a["id"], uid(KID), state="graded", grade=88, teacher_note="יפה")
+    assert hand(world, a["id"], [answer_picture(world)]).status_code == 409                          # graded: no more changes
+    done = world.get(f"/api/assignments/{a['id']}", headers=auth(KID)).json()
+    assert (done["state"], done["grade"], done["teacher_note"]) == ("graded", 88, "יפה") and sub["id"] == world.store.get_submission(a["id"], uid(KID))["id"]
+
+
+def test_a_late_hand_in_is_accepted_and_marked_late(world):
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    world.set_time(MON + 9 * DAY)                                                                     # two days after the due date
+    assert mine(world)[0]["overdue"] is True and mine(world)[0]["days_left"] == -2
+    got = hand(world, a["id"], [answer_picture(world)])
+    assert got.status_code == 200 and got.json()["late"] is True and got.json()["overdue"] is False
+
+
+def test_an_exercise_test_assignment_is_done_after_the_student_took_it_with_the_best_grade_and_cannot_be_handed_in(world):
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    a = give(world, kind="exercise_test", test_id=test["id"], exercise_number=1).json()
+    assert mine(world)[0]["state"] == "not_done" and mine(world)[0]["test"] == {"id": test["id"], "number": 1}
+    assert hand(world, a["id"], [answer_picture(world)]).status_code == 422
+    for grade in (60, 85):
+        row = world.store.create_attempt(uid(KID), "exercise_test", f"{test['id']}:1", MON, MON + timedelta(minutes=45), [])
+        world.store.save_attempt(row["id"], submitted_at=MON + timedelta(minutes=5), grade=grade)
+    other = world.store.create_attempt(uid(KID), "exercise_test", f"{test['id']}:2", MON, MON + timedelta(minutes=45), [])
+    world.store.save_attempt(other["id"], submitted_at=MON, grade=99)                                  # a different exercise test
+    done = mine(world)[0]
+    assert done["state"] == "done" and done["grade"] == 85
+    assert mine(world, KID2)[0]["state"] == "not_done"
+    teacher_view = world.get("/api/teaching/assignments", headers=auth(TEACHER)).json()[0]["assignments"][0]
+    assert teacher_view["done"] == 1 and "waiting" not in teacher_view                                 # nothing waits in an inbox for it
+
+
+def test_open_assignments_come_first_by_due_date_and_removed_ones_are_gone(world):
+    far = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="רחוק").json()
+    near = world.post(f"/api/classes/{world.a['id']}/assignments", json={"title": "קרוב", "due_date": (clock.now() + 2 * DAY).date().isoformat(), "kind": "quiz",
+                                                                        "quiz_lesson": world.quiz_lesson}, headers=auth(TEACHER)).json()
+    done = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="הוגש").json()
+    hand(world, done["id"], [answer_picture(world)])
+    world.store.save_submission(done["id"], uid(KID), state="graded", grade=70)
+    assert [x["title"] for x in mine(world)] == ["קרוב", "רחוק", "הוגש"]
+    world.delete(f"/api/assignments/{near['id']}", headers=auth(TEACHER))
+    assert [x["title"] for x in mine(world)] == ["רחוק", "הוגש"] and world.get(f"/api/assignments/{near['id']}", headers=auth(KID)).status_code == 404
+    assert far["id"] != done["id"]
+
+
+# --- 2.4 the inbox and checking ---
+
+def inbox(client, who=TEACHER):
+    return client.get("/api/teaching/inbox", headers=auth(who)).json()
+
+
+def submit(client, assignment, who, day_offset=0):
+    """A student hands in at a given time; returns the submission row."""
+    client.set_time(MON + day_offset * DAY)
+    got = hand(client, assignment, [answer_picture(client, who)], who)
+    assert got.status_code == 200
+    return client.store.get_submission(assignment, uid(who))
+
+
+def test_the_inbox_lists_what_waits_oldest_first_and_a_returned_one_is_not_in_it(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    tuesday = submit(world, quiz["id"], KID2, 1)                                                      # KID2 hands in on Tuesday
+    monday = submit(world, quiz["id"], KID, 0)                                                        # KID's was Monday: first in the inbox even though made second
+    items = inbox(world)
+    assert [i["id"] for i in items] == [monday["id"], tuesday["id"]] and [i["student"] for i in items] == [KID, KID2]
+    assert items[0]["kind"] == "submission" and items[0]["assignment"]["title"] == "משימה" and items[0]["assignment"]["class"]["name"] == "A" and items[0]["pictures"]
+    world.store.save_submission(quiz["id"], uid(KID), state="returned", teacher_note="תקנו")
+    assert [i["id"] for i in inbox(world)] == [tuesday["id"]]
+    assert inbox(world, OTHER_TEACHER) == [] and [i["id"] for i in inbox(world, DEV)] == [tuesday["id"]]
+
+
+def test_the_teacher_opens_a_submission_and_grades_it_and_the_student_sees_grade_and_note(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    sub = submit(world, quiz["id"], KID)
+    opened = world.get(f"/api/submissions/{sub['id']}", headers=auth(TEACHER)).json()
+    assert opened["state"] == "handed_in" and len(opened["quiz"]["questions"]) == 4 and opened["pictures"] == [{"id": sub["pictures"][0], "deleted": False}]
+    assert world.get(f"/api/pictures/{sub['pictures'][0]}", headers=auth(TEACHER)).status_code == 200      # the teacher reads the answer
+    graded = world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 85, "note": "נימוק יפה", "seen": opened["seen"]}, headers=auth(TEACHER))
+    assert graded.status_code == 200 and graded.json() == {"id": sub["id"], "state": "graded", "grade": 85}
+    assert inbox(world) == []
+    mine_now = mine(world)[0]
+    assert (mine_now["state"], mine_now["grade"], mine_now["teacher_note"]) == ("graded", 85, "נימוק יפה")
+    row = world.store.get_submission(quiz["id"], uid(KID))
+    assert row["checked_by"] == TEACHER and row["checked_at"] is not None
+
+
+def test_a_grade_is_a_whole_number_from_0_to_100(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    sub = submit(world, quiz["id"], KID)
+    seen = sub["handed_at"].isoformat()
+    for bad in (101, -1, 85.5, "גבוה"):
+        assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": bad, "seen": seen}, headers=auth(TEACHER)).status_code == 422
+    assert world.store.get_submission(quiz["id"], uid(KID))["state"] == "handed_in"
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 0, "seen": seen}, headers=auth(TEACHER)).status_code == 200          # the edges
+    other = submit(world, quiz["id"], KID2)
+    assert world.post(f"/api/submissions/{other['id']}/grade", json={"grade": 100, "seen": other["handed_at"].isoformat()}, headers=auth(TEACHER)).status_code == 200
+
+
+def test_sending_back_needs_a_note_and_the_student_then_hands_in_again(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    sub = submit(world, quiz["id"], KID)
+    seen = sub["handed_at"].isoformat()
+    assert world.post(f"/api/submissions/{sub['id']}/return", json={"note": "", "seen": seen}, headers=auth(TEACHER)).status_code == 422
+    assert world.post(f"/api/submissions/{sub['id']}/return", json={"note": "   ", "seen": seen}, headers=auth(TEACHER)).status_code == 422
+    sent = world.post(f"/api/submissions/{sub['id']}/return", json={"note": "חסר נימוק בסעיף 2", "seen": seen}, headers=auth(TEACHER))
+    assert sent.status_code == 200 and sent.json()["state"] == "returned" and inbox(world) == []
+    shown = mine(world)[0]
+    assert shown["state"] == "returned" and shown["teacher_note"] == "חסר נימוק בסעיף 2"
+    submit(world, quiz["id"], KID, 1)                                                                  # handed in again: back in the inbox
+    assert [i["id"] for i in inbox(world)] == [sub["id"]]
+
+
+def test_a_stale_view_a_second_check_and_another_classs_teacher_are_refused(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    sub = submit(world, quiz["id"], KID)
+    seen = sub["handed_at"].isoformat()
+    submit(world, quiz["id"], KID, 1)                                                                  # the student replaced it after the teacher opened it
+    stale = world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 70, "seen": seen}, headers=auth(TEACHER))
+    assert stale.status_code == 409 and "השתנתה" in stale.json()["detail"]
+    fresh = world.store.get_submission(quiz["id"], uid(KID))["handed_at"].isoformat()
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 70, "seen": fresh}, headers=auth(OTHER_TEACHER)).status_code == 404
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 70, "seen": fresh}, headers=auth(KID)).status_code == 403
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 70, "seen": "not a time"}, headers=auth(TEACHER)).status_code == 422
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 70, "seen": fresh}, headers=auth(TEACHER)).status_code == 200
+    assert world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 90, "seen": fresh}, headers=auth(TEACHER)).status_code == 409     # already checked
+    assert world.get("/api/submissions/999", headers=auth(TEACHER)).status_code == 404
+
+
+def test_exercise_test_assignments_never_reach_the_inbox_and_removed_assignments_leave_it(world):
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    give(world, kind="exercise_test", test_id=test["id"], exercise_number=1)
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    sub = submit(world, quiz["id"], KID)
+    assert [i["id"] for i in inbox(world)] == [sub["id"]]
+    world.delete(f"/api/assignments/{quiz['id']}", headers=auth(TEACHER))
+    assert inbox(world) == []
+
+
+def test_the_grades_list_has_graded_assignments_and_done_exercise_tests_and_a_removed_one_keeps_its_grade(world):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="בוחן כתוב").json()
+    waiting = give(world, kind="quiz", quiz_lesson=world.quiz_lesson, title="עוד לא נבדק").json()
+    sub = submit(world, quiz["id"], KID)
+    submit(world, waiting["id"], KID)
+    assert world.get("/api/grades", headers=auth(KID)).json()["assignments"] == []                      # nothing graded yet
+    world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 92, "note": "יפה מאוד", "seen": sub["handed_at"].isoformat()}, headers=auth(TEACHER))
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    exam = give(world, kind="exercise_test", test_id=test["id"], exercise_number=1, title="תרגול").json()
+    row = world.store.create_attempt(uid(KID), "exercise_test", f"{test['id']}:1", MON, MON + timedelta(minutes=45), [])
+    world.store.save_attempt(row["id"], submitted_at=MON, grade=77)
+    got = world.get("/api/grades", headers=auth(KID)).json()["assignments"]
+    assert {(g["assignment"]["title"], g["grade"], g["note"]) for g in got} == {("בוחן כתוב", 92, "יפה מאוד"), ("תרגול", 77, "")}
+    world.delete(f"/api/assignments/{quiz['id']}", headers=auth(TEACHER))
+    kept = [g for g in world.get("/api/grades", headers=auth(KID)).json()["assignments"] if g["assignment"]["title"] == "בוחן כתוב"]
+    assert kept[0]["grade"] == 92 and kept[0]["assignment"]["removed"] is True and exam["id"]
+    assert world.get("/api/grades", headers=auth(KID2)).json()["assignments"] == []
+
+
+# --- 2.7 deleting a student's pictures on request, and the hourly cleanup ---
+
+def handed_in_with_pictures(world, who=KID):
+    quiz = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    pics = [answer_picture(world, who), answer_picture(world, who)]
+    hand(world, quiz["id"], pics, who)
+    world.store.save_submission(quiz["id"], uid(who), state="graded", grade=88, teacher_note="יפה")
+    return quiz, pics
+
+
+def delete_pictures(world, who, email=KID, class_id=None):
+    return world.delete(f"/api/classes/{class_id or world.a['id']}/pictures/{email}", headers=auth(who))
+
+
+def test_the_classs_teacher_a_manager_and_a_developer_can_delete_a_students_pictures_and_the_grade_stays(world):
+    for who in (TEACHER, MGR, DEV):
+        quiz, pics = handed_in_with_pictures(world)
+        got = delete_pictures(world, who)
+        assert got.status_code == 200 and got.json() == {"deleted": 2}, who
+        assert all(world.store.get_picture(p)["deleted_at"] for p in pics)
+        assert world.get(f"/api/pictures/{pics[0]}", headers=auth(KID)).status_code == 410           # gone for the student too
+        sub = world.store.get_submission(quiz["id"], uid(KID))
+        assert (sub["state"], sub["grade"], sub["teacher_note"]) == ("graded", 88, "יפה")             # the grade and note stay
+        shown = world.get(f"/api/assignments/{quiz['id']}", headers=auth(KID)).json()
+        assert shown["grade"] == 88 and all(p["deleted"] for p in shown["pictures"])
+        world.delete(f"/api/assignments/{quiz['id']}", headers=auth(TEACHER))
+
+
+def test_another_classs_teacher_a_student_and_a_missing_student_cannot(world):
+    handed_in_with_pictures(world)
+    assert delete_pictures(world, OTHER_TEACHER).status_code == 404
+    assert delete_pictures(world, KID2).status_code == 403
+    assert delete_pictures(world, KID).status_code == 403
+    assert delete_pictures(world, TEACHER, email="nobody@school.test").status_code == 404
+    assert delete_pictures(world, TEACHER, class_id=999).status_code == 404
+    assert len(world.store.pictures()) >= 2 and all(not p["deleted_at"] for p in world.store.pictures())
+
+
+def test_only_that_students_pictures_for_that_class_go(world):
+    quiz, mine_pics = handed_in_with_pictures(world, KID)
+    other_quiz, theirs = handed_in_with_pictures(world, KID2)
+    assert delete_pictures(world, TEACHER, KID).json() == {"deleted": 2}
+    assert all(not world.store.get_picture(p)["deleted_at"] for p in theirs) and other_quiz["id"] != quiz["id"]
+    assert delete_pictures(world, TEACHER, KID).json() == {"deleted": 0}                              # twice is fine
+    never = world.store.add_member(world.a["id"], "newkid@school.test")
+    assert delete_pictures(world, TEACHER, "newkid@school.test").json() == {"deleted": 0} and never is None      # never signed in: nothing handed in
+
+
+def test_the_hourly_cleanup_starts_with_the_real_database_and_not_without(world, monkeypatch):
+    from mathly2 import cleanup
+    started = []
+
+    def fake_start(store, backend, every=3600.0):
+        import threading
+        started.append((store, backend))
+        return threading.Event()
+    monkeypatch.setattr(cleanup, "start_hourly", fake_start)
+    with TestClient(world.app):                                                                     # no Supabase: nothing starts
+        pass
+    assert started == []
+    live = create_app(Settings(supabase_url="https://p.test", supabase_key="pub", supabase_secret="sec"), store=InMemoryStore(), authenticator=object())
+    with TestClient(live):
+        pass
+    assert len(started) == 1 and started[0][0] is live.state.store and started[0][1] is live.state.pictures
+
+
+def test_the_teachers_list_says_which_lessons_have_a_written_quiz_and_lists_the_classs_tests(world):
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    got = world.get("/api/teaching/assignments", headers=auth(TEACHER)).json()[0]["class"]
+    assert {l["id"]: l["has_quiz"] for l in got["lessons"]} == {world.quiz_lesson: True, world.plain_lesson: False}
+    assert got["tests"] == [{"id": test["id"], "date": test["date"].isoformat(), "lessons": got["tests"][0]["lessons"]}] and got["tests"][0]["lessons"]
+
+
+# --- work-tabs-and-hints 2.1: the numbers on the teacher's tabs ---
+
+def counts(client, who=TEACHER):
+    return client.get("/api/teaching/counts", headers=auth(who)).json()
+
+
+def test_the_counts_are_classes_tests_assignments_and_submissions_waiting(world):
+    assert counts(world) == {"classes": 1, "tests": 0, "assignments": 0, "inbox": 0}
+    for _ in range(3):
+        world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    b = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    give(world, kind="quiz", quiz_lesson=world.quiz_lesson)
+    exam = world.store.create_test(world.a["id"], clock.school_day() + 5 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    give(world, kind="exercise_test", test_id=exam["id"], exercise_number=1)
+    submit(world, a["id"], KID)
+    submit(world, a["id"], KID2)
+    submit(world, b["id"], KID)
+    assert counts(world) == {"classes": 1, "tests": 4, "assignments": 4, "inbox": 3}
+
+
+def test_checking_a_submission_lowers_the_inbox_and_removed_items_are_not_counted(world):
+    a = give(world, kind="quiz", quiz_lesson=world.quiz_lesson).json()
+    test = world.store.create_test(world.a["id"], clock.school_day() + 10 * DAY, [world.quiz_lesson], TEACHER, created_at=clock.now())
+    sub = submit(world, a["id"], KID)
+    assert counts(world)["inbox"] == 1
+    world.post(f"/api/submissions/{sub['id']}/grade", json={"grade": 80, "seen": sub["handed_at"].isoformat()}, headers=auth(TEACHER))
+    assert counts(world)["inbox"] == 0
+    world.store.remove_test(test["id"])
+    world.delete(f"/api/assignments/{a['id']}", headers=auth(TEACHER))
+    assert counts(world) == {"classes": 1, "tests": 0, "assignments": 0, "inbox": 0}
+
+
+def test_another_teachers_items_are_not_counted_and_a_developer_counts_everything(world):
+    give(world, kind="quiz", quiz_lesson=world.quiz_lesson)
+    world.store.create_test(world.b["id"], clock.school_day() + 10 * DAY, [world.other_quiz], OTHER_TEACHER, created_at=clock.now())
+    assert counts(world, OTHER_TEACHER) == {"classes": 1, "tests": 1, "assignments": 0, "inbox": 0}
+    assert counts(world) == {"classes": 1, "tests": 0, "assignments": 1, "inbox": 0}
+    assert counts(world, DEV) == {"classes": 2, "tests": 1, "assignments": 1, "inbox": 0}
+    assert world.get("/api/teaching/counts", headers=auth(KID)).status_code == 403

mathly2/tests/test_busy_browser.py

@@ -0,0 +1,110 @@
+"""A button whose action takes time shows it (work-tabs-and-hints 1.1), in a real browser."""
+import pytest
+
+playwright = pytest.importorskip("playwright.sync_api")
+
+from mathly2.tests.serve import offline_formulas, running
+from mathly2.tests.test_written_browser import (DESKTOP, KID, PHONE, TEACHER, bank, browser, day, jpeg, one_assignment, sign_in, teacher_work, world)  # noqa: F401
+
+OBSERVER = """
+window.__everBusy = false;
+new MutationObserver(() => { if (document.querySelector('.busy')) window.__everBusy = true; }).observe(document, { subtree: true, attributes: true, attributeFilter: ['class'] });
+"""
+
+
+def hold(page, pattern):
+    """Hold every request that matches until `release()`; returns (held list, release function)."""
+    held = []
+    page.route(pattern, lambda route: held.append(route))
+    return held, lambda: [r.continue_() for r in list(held)] and held.clear()
+
+
+def test_a_plain_button_shows_a_spinner_after_a_moment_ignores_a_second_press_and_clears_after_success(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = sign_in(browser, url, where=f"#/assignment/{row['id']}")
+        page.wait_for_selector("#answer")
+        page.set_input_files("[data-file=upload]", files=[{"name": "a.jpg", "mimeType": "image/jpeg", "buffer": jpeg()}])
+        page.wait_for_selector("#draft li[data-picture-id]")
+        held, release = hold(page, "**/api/assignments/*/submission")
+        page.click("#hand-in")
+        page.wait_for_selector("#hand-in.busy")                                                # after about a third of a second
+        assert page.get_attribute("#hand-in", "aria-busy") == "true"
+        page.click("#hand-in", force=True)                                                     # a second press does nothing
+        page.wait_for_timeout(300)
+        assert len(held) == 1
+        release()
+        page.wait_for_selector("#assignment[data-state='handed_in']")
+        assert page.locator(".busy").count() == 0
+
+
+def test_a_forms_submit_button_shows_it_too_and_a_quick_action_never_does(browser, bank):
+    app, store, klass, lessons = world(bank)
+    with running(app) as url:
+        page = offline_formulas(browser.new_page(viewport=DESKTOP))
+        page.add_init_script(OBSERVER)
+        page.goto(url)
+        page.fill("#email", TEACHER)
+        page.click("#dev button")
+        page.wait_for_selector("#teaching")
+        page.click("#teacher-tabs [data-tab='tests']")
+        page.wait_for_selector("#tests")
+        page.click(".set-test summary")
+        page.fill("[name=date]", day(10).isoformat())
+        held, release = hold(page, "**/api/classes/*/tests")
+        page.click(".set-test button[type=submit]")
+        page.wait_for_selector(".set-test button[type=submit].busy")
+        release()
+        page.wait_for_selector(".test-row")
+        assert page.locator(".busy").count() == 0
+        page.evaluate("window.__everBusy = false")                                              # a quick action: the button never turns busy
+        page.click("#teacher-tabs [data-tab='classes']")
+        page.wait_for_selector("#teaching")
+        page.click("#teacher-tabs [data-tab='tests']")
+        page.wait_for_selector("#tests")
+        assert page.evaluate("window.__everBusy") is False
+
+
+def test_a_picture_upload_from_a_file_chooser_marks_its_button(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = sign_in(browser, url, where=f"#/assignment/{row['id']}")
+        page.wait_for_selector("#answer")
+        held, release = hold(page, "**/api/pictures")
+        page.set_input_files("[data-file=upload]", files=[{"name": "a.jpg", "mimeType": "image/jpeg", "buffer": jpeg()}])
+        page.wait_for_selector("label.file.busy")
+        release()
+        page.wait_for_selector("#draft li[data-picture-id]")
+        assert page.locator("label.file.busy").count() == 0
+
+
+def test_with_reduced_motion_the_button_shows_dots_and_nothing_turns(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = sign_in(browser, url, where=f"#/assignment/{row['id']}", reduced_motion="reduce")
+        page.wait_for_selector("#answer")
+        page.set_input_files("[data-file=upload]", files=[{"name": "a.jpg", "mimeType": "image/jpeg", "buffer": jpeg()}])
+        page.wait_for_selector("#draft li[data-picture-id]")
+        held, release = hold(page, "**/api/assignments/*/submission")
+        page.click("#hand-in")
+        page.wait_for_selector("#hand-in.busy")
+        assert page.evaluate("getComputedStyle(document.querySelector('#hand-in'), '::after').content") == '"…"'
+        assert page.evaluate("document.getAnimations().filter(a => a.animationName === 'ex-spin').length") == 0
+        release()
+        page.wait_for_selector("#assignment[data-state='handed_in']")
+
+
+def test_the_state_clears_after_an_error_and_the_exercise_choices_keep_their_own_indicator(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = sign_in(browser, url, where=f"#/assignment/{row['id']}")
+        page.wait_for_selector("#answer")
+        page.set_input_files("[data-file=upload]", files=[{"name": "a.jpg", "mimeType": "image/jpeg", "buffer": jpeg()}])
+        page.wait_for_selector("#draft li[data-picture-id]")
+        held = []
+        page.route("**/api/assignments/*/submission", lambda route: held.append(route))
+        page.click("#hand-in")
+        page.wait_for_selector("#hand-in.busy")
+        held[0].fulfill(status=500, body='{"detail": "x"}', content_type="application/json")
+        page.wait_for_selector("#add-error:not([hidden])")
+        assert page.locator(".busy").count() == 0 and not page.is_disabled("#hand-in")

mathly2/tests/test_cached_store.py

@@ -0,0 +1,97 @@
+from datetime import date
+
+from mathly2.cached import CachedStore
+from mathly2.store import InMemoryStore
+
+
+class Counting(InMemoryStore):
+    def __init__(self):
+        super().__init__()
+        self.calls = 0
+
+    def classes_taught(self, email):
+        self.calls += 1
+        return super().classes_taught(email)
+
+
+def make(seconds=30, now=None):
+    base = Counting()
+    clock = now or (lambda: 0.0)
+    return base, CachedStore(base, seconds, clock=clock)
+
+
+def test_repeat_read_is_remembered():
+    base, store = make()
+    store.classes_taught("t@x.com"); store.classes_taught("t@x.com")
+    assert base.calls == 1
+
+
+def test_time_passing_asks_again():
+    t = [0.0]
+    base, store = make(now=lambda: t[0])
+    store.classes_taught("t@x.com"); t[0] = 31
+    store.classes_taught("t@x.com")
+    assert base.calls == 2
+
+
+def test_changes_forget():
+    base, store = make()
+    assert store.classes_taught("t@x.com") == []
+    store.create_class("t@x.com", "A", teacher_email="t@x.com")
+    assert len(store.classes_taught("t@x.com")) == 1
+    cid = store.classes_taught("t@x.com")[0]["id"]
+    store.add_member(cid, "s@x.com")
+    assert [m["email"] for m in store.members(cid)] == ["s@x.com"]
+    store.remove_member(cid, "s@x.com")
+    assert store.members(cid) == []
+    store.give_role("a@x.com", "teacher", "root")
+    assert "teacher" in store.roles_of("a@x.com")
+    a = store.create_assignment(cid, "T", date(2030, 1, 1), "t@x.com", "pages", pages=["p1"])
+    assert len(store.assignments_of_classes([cid])) == 1
+    store.remove_assignment(a["id"])
+    assert store.assignments_of_classes([cid]) == []
+    store.delete_class(cid)
+    assert store.classes_taught("t@x.com") == []
+
+
+def test_read_started_before_a_change_is_not_kept():
+    base, store = make()
+    real = base.classes_taught
+
+    def slow(email):
+        rows = real(email)
+        store.create_class("t@x.com", "B", teacher_email="t@x.com")   # a change lands while this read is running
+        return rows
+    base.classes_taught = slow
+    store.classes_taught("t@x.com")
+    base.classes_taught = real
+    assert len(store.classes_taught("t@x.com")) == 1
+
+
+def test_returned_rows_are_copies():
+    base, store = make()
+    store.create_class("t@x.com", "A", teacher_email="t@x.com")
+    store.classes_taught("t@x.com")[0]["name"] = "changed"
+    assert store.classes_taught("t@x.com")[0]["name"] == "A"
+
+
+def test_zero_turns_it_off():
+    base, store = make(seconds=0)
+    store.classes_taught("t@x.com"); store.classes_taught("t@x.com")
+    assert base.calls == 2
+
+
+def test_progress_writes_do_not_forget():
+    base, store = make()
+    store.classes_taught("t@x.com")
+    store.add_comet("u", "c")
+    store.classes_taught("t@x.com")
+    assert base.calls == 1
+
+
+def test_database_times_with_any_number_of_fraction_digits_are_read():
+    from datetime import datetime, timezone
+    from mathly2.store import _when
+    for text in ("2026-11-09T10:10:57.63003+00:00", "2026-11-09T10:10:57.6+00:00", "2026-11-09T10:10:57+00:00", "2026-11-09T10:10:57.630031Z", "2026-11-09T10:10:57.1234567+00:00"):
+        assert _when(text).tzinfo is not None
+    assert _when("2026-11-09T10:10:57.63003+00:00") == datetime(2026, 11, 9, 10, 10, 57, 630030, tzinfo=timezone.utc)

mathly2/tests/test_cached_waits.py

@@ -0,0 +1,48 @@
+"""Slow-changing facts are remembered (cache-and-instant-screens 1.2): with every store call made to wait, the second opening is quicker,
+and a change shows at once."""
+import time
+from datetime import timedelta
+
+from fastapi.testclient import TestClient
+
+from mathly2 import clock
+from mathly2.bank import load_bank
+from mathly2.cached import CachedStore
+from mathly2.config import Settings
+from mathly2.main import create_app
+from mathly2.tests.test_database_waits import DELAY, SlowStore
+
+TEACHER = "t@school.test"
+H = {"Authorization": f"Bearer dev:{TEACHER}"}
+
+
+def test_second_opening_is_quicker_and_a_change_shows_at_once():
+    bank = load_bank()
+    slow = SlowStore()
+    lessons = [l["id"] for l in bank.lessons][:3]
+    klass = slow.create_class("setup", "A", lessons=lessons, teacher_email=TEACHER)
+    slow.add_member(klass["id"], "kid@school.test")
+    cached = CachedStore(slow, 30)
+    client = TestClient(create_app(Settings(), bank=bank, store=cached))
+    client.get("/api/me", headers=H)
+    slow.slow = True
+
+    def took(path):
+        start = time.perf_counter()
+        r = client.get(path, headers=H)
+        assert r.status_code == 200, r.text
+        return time.perf_counter() - start, r.json()
+
+    for path in ("/api/teaching/counts", "/api/teaching/assignments", "/api/teaching/tests"):
+        cached.forget()
+        first, _ = took(path)
+        second, _ = took(path)
+        assert second < first - DELAY / 2, (path, first, second)
+
+    _, before = took("/api/teaching/assignments")
+    assert before[0]["assignments"] == []
+    r = client.post(f"/api/classes/{klass['id']}/assignments", headers=H,
+                    json={"title": "חדש", "kind": "quiz", "quiz_lesson": lessons[0], "due_date": str(clock.school_day() + timedelta(days=5))})
+    assert r.status_code in (200, 201), r.text
+    _, after = took("/api/teaching/assignments")
+    assert len(after[0]["assignments"]) == 1

mathly2/tests/test_classes.py

@@ -36,12 +36,12 @@ def test_parse_emails_handles_pasted_lists():
 
 # ---- the manager makes classes (spec: Manager creates classes)
 
-def test_a_manager_creates_a_class_with_lessons_teacher_and_students(world):
+def test_a_manager_creates_a_class_with_teacher_and_students_and_it_studies_every_lesson(world):
     client, _ = world
     created = make(client, teacher_email=T1, students="s1@school.test\ns2@school.test not-an-email")
     assert created.status_code == 201
     row = created.json()
-    assert row["name"] == "ט'3" and row["lessons"] == ["t", "t2"] and row["teacher_email"] == T1
+    assert row["name"] == "ט'3" and len(row["lessons"]) == 24 and row["teacher_email"] == T1
     assert row["ai_enabled"] is False and row["ai_daily_checks"] == 150
     assert row["students"] == 2 and row["student_emails"] == ["s1@school.test", "s2@school.test"] and row["invalid"] == ["not-an-email"]
     assert [c["name"] for c in client.get("/api/classes", headers=auth(MGR)).json()] == ["ט'3"]
@@ -69,12 +69,10 @@ def test_class_name_is_trimmed_checked_and_unique_ignoring_case(world):
     assert make(client, name="x" * 80).status_code == 201
 
 
-def test_a_class_needs_at_least_one_known_lesson(world):
+def test_lessons_in_a_request_are_ignored_every_class_studies_every_lesson(world):
     client, _ = world
-    assert make(client, lessons=[]).status_code == 422
-    assert make(client, lessons=["nope"]).status_code == 422
-    assert make(client, lessons=["t", "nope"]).status_code == 422
-    assert make(client, name="B", lessons=["t", "t"]).json()["lessons"] == ["t"]      # repeats collapse
+    assert len(make(client, lessons=[]).json()["lessons"]) == 24
+    assert len(make(client, name="B", lessons=["nope"]).json()["lessons"]) == 24
 
 
 def test_the_teacher_must_be_an_email_and_not_also_a_student(world):
@@ -92,11 +90,9 @@ def test_the_ai_budget_is_limited(world):
     assert make(client, name="C", ai_daily_checks=40, ai_enabled=True).json()["ai_enabled"] is True
 
 
-def test_the_manager_can_list_the_lessons_to_choose_from(world):
+def test_there_is_no_lesson_list_to_choose_from(world):
     client, _ = world
-    lessons = client.get("/api/classes/lessons", headers=auth(MGR)).json()
-    assert len(lessons) == 24 and set(lessons[0]) == {"id", "name", "skills"} and lessons[0]["skills"] > 0
-    assert client.get("/api/classes/lessons", headers=auth(T1)).status_code == 403
+    assert client.get("/api/classes/lessons", headers=auth(MGR)).status_code in (404, 405, 422)
 
 
 # ---- editing and deleting (spec: Editing and deleting a class)
@@ -104,9 +100,9 @@ def test_the_manager_can_list_the_lessons_to_choose_from(world):
 def test_a_manager_edits_everything_and_the_roster_follows(world):
     client, store = world
     cid = make(client, teacher_email=T1, students="a@school.test b@school.test").json()["id"]
-    edited = client.put(f"/api/classes/{cid}", json=body("ט'4", lessons=["k"], teacher_email=T2, students="b@school.test c@school.test",
+    edited = client.put(f"/api/classes/{cid}", json=body("ט'4", teacher_email=T2, students="b@school.test c@school.test",
                                                           ai_enabled=True, ai_daily_checks=60), headers=auth(MGR)).json()
-    assert (edited["name"], edited["lessons"], edited["teacher_email"], edited["ai_enabled"], edited["ai_daily_checks"]) == ("ט'4", ["k"], T2, True, 60)
+    assert (edited["name"], edited["lessons"], edited["teacher_email"], edited["ai_enabled"], edited["ai_daily_checks"]) == ("ט'4", edited["lessons"], T2, True, 60)
     assert edited["student_emails"] == ["b@school.test", "c@school.test"]
 
 

mathly2/tests/test_curriculum_api.py

@@ -0,0 +1,54 @@
+"""The curriculum (add-lesson-schedule 2.1, 3.1): a date per lesson, who sets it, and what the path says about it."""
+from datetime import timedelta
+
+from mathly2 import clock
+from mathly2.tests.test_skills_api import KID, KID_ID, MGR, MON, OTHER, TEACHER, auth, raw, world  # noqa: F401
+
+
+def rows(client, who=KID):
+    return {l["id"]: l for l in client.get("/api/path", headers=auth(who)).json()["lessons"]}
+
+
+def put(client, dates, who=MGR):
+    return client.put("/api/curriculum", json={"dates": dates}, headers=auth(who))
+
+
+def test_a_manager_sets_changes_and_clears_a_date(world):
+    client, _, bank = world
+    first, second = bank.lessons[0]["id"], bank.lessons[1]["id"]
+    got = client.get("/api/curriculum", headers=auth(MGR)).json()
+    assert [r["id"] for r in got] == [l["id"] for l in bank.lessons] and all(r["due_date"] is None for r in got) and got[0]["month"]
+    assert put(client, {first: "2026-11-03", second: "2026-12-01"}).json()[0]["due_date"] == "2026-11-03"
+    assert put(client, {first: "2026-11-05", second: None}).status_code == 200
+    now = {r["id"]: r["due_date"] for r in client.get("/api/curriculum", headers=auth(MGR)).json()}
+    assert now[first] == "2026-11-05" and now[second] is None
+
+
+def test_only_managers_change_it_and_bad_input_is_refused(world):
+    client, _, bank = world
+    first = bank.lessons[0]["id"]
+    for who in (TEACHER, KID, OTHER):
+        assert put(client, {first: "2026-11-03"}, who).status_code in (401, 403)
+        assert client.get("/api/curriculum", headers=auth(who)).status_code in (401, 403)
+    assert put(client, {"no-such-lesson": "2026-11-03"}).status_code == 422
+    assert put(client, {first: "3.11"}).status_code == 422
+    assert client.get("/api/curriculum", headers=auth(MGR)).json()[0]["due_date"] is None        # nothing changed
+
+
+def test_a_lesson_is_behind_only_when_dated_past_and_not_completed(world):
+    client, store, bank = world
+    ids = [l["id"] for l in bank.lessons_with_skills()][:5]
+    today = clock.school_day()
+    yesterday, tomorrow = (today - timedelta(days=1)).isoformat(), (today + timedelta(days=7)).isoformat()
+    put(client, {ids[0]: yesterday, ids[1]: tomorrow, ids[2]: yesterday, ids[3]: yesterday})   # ids[4]: no date
+    path = client.get("/api/path", headers=auth()).json()
+    by = {l["id"]: l for l in path["lessons"]}
+    assert by[ids[0]]["behind"] is True and by[ids[0]]["due_date"] == yesterday
+    assert by[ids[1]]["behind"] is False and by[ids[4]]["behind"] is False and by[ids[4]]["due_date"] is None
+    # a completed lesson (all skills mastered) is not behind, and neither is one whose quiz was passed
+    for skill in by[ids[2]]["skills"]:
+        store.save_progress(KID_ID, skill["id"], started_at=MON, mastered_at=MON)
+    assert rows(client)[ids[2]]["completed"] is True and rows(client)[ids[2]]["behind"] is False
+    assert path["behind"] == 3                                                                  # before the third was completed
+    after = client.get("/api/path", headers=auth()).json()
+    assert after["behind"] == 2 and {l["id"] for l in after["lessons"] if l["behind"]} == {ids[0], ids[3]}

mathly2/tests/test_foundation_screens_browser.py

@@ -158,8 +158,7 @@ def test_a_person_with_one_role_sees_no_chips_and_a_developer_sees_all_five(brow
 
 def fill_class(page, name, lessons, teacher, students):
     page.fill("#c-name", name)
-    for lesson in lessons:
-        page.check(f"#c-lessons input[value='{lesson}']")
+    assert page.locator("#c-lessons, input[name=lesson]").count() == 0            # a class has no chosen lessons
     page.fill("#c-teacher", teacher)
     page.fill("#c-students", students)
 
@@ -189,9 +188,8 @@ def test_a_manager_creates_edits_and_deletes_classes_without_scrolling_sideways(
             assert columns >= 2                                                 # the wide screen is used
         page.click("#classes article >> nth=0 >> [data-edit]")
         page.wait_for_selector("#class-form")
-        assert page.input_value("#c-name") == "ט'3" and page.is_checked("#c-lessons input[value='t2']")
+        assert page.input_value("#c-name") == "ט'3"
         page.fill("#c-name", "ט'3 חדשה")
-        page.uncheck("#c-lessons input[value='t2']")
         page.check("#c-ai")
         page.click("#c-save")
         page.wait_for_selector("#classes article")

mathly2/tests/test_home_browser.py

@@ -12,7 +12,7 @@ from mathly2.bank import load_bank
 from mathly2.config import Settings
 from mathly2.main import create_app
 from mathly2.store import InMemoryStore
-from mathly2.tests.serve import offline_formulas, running
+from mathly2.tests.serve import offline_formulas, only, running
 
 KID, TEACHER = "kid@school.test", "t@school.test"
 KID_ID = str(uuid.uuid5(uuid.NAMESPACE_DNS, KID))
@@ -39,7 +39,7 @@ def world(bank):
     store = InMemoryStore()
     klass = store.create_class("setup", "A", lessons=lessons, teacher_email=TEACHER)
     store.add_member(klass["id"], KID)
-    return create_app(Settings(), bank=bank, store=store), store, klass, lessons
+    return create_app(Settings(), bank=only(bank, lessons), store=store), store, klass, lessons
 
 
 def add_test(store, klass, lessons, days_ahead, set_days_ago=20, **kw):
@@ -81,8 +81,8 @@ def test_the_card_opens_home_and_each_tab_opens_its_screen(browser, bank):
         page = sign_in(browser, url)
         to_home(page)
         assert page.evaluate("location.hash") == "#/subject/math" and page.locator(".tabs a[aria-current='page']").inner_text() == "בית"
-        assert page.locator(".tabs a").all_inner_texts() == ["בית", "מסלול", "ציונים", "האוסף"]
-        for href, marker in (("#/subject/math/path", ".orbit"), ("#/grades", "#grades"), ("#/collection", "#collection"), ("#/subject/math", "#no-test")):
+        assert page.locator(".tabs a").all_inner_texts() == ["בית", "מסלול", "הגשות", "ציונים", "האוסף"]
+        for href, marker in (("#/subject/math/path", ".orbit"), ("#/submissions", "#submissions"), ("#/grades", "#grades"), ("#/collection", "#collection"), ("#/subject/math", "#no-test")):
             page.click(f".tabs a[href='{href}']")
             page.wait_for_selector(marker)
         assert page.errors == []
@@ -178,15 +178,18 @@ def test_the_readiness_bar_shows_every_part_and_loses_the_cap_after_the_simulati
         assert page.locator(".required").count() == 0                                                     # the simulation is taken
 
 
-def test_other_tests_are_listed_small_and_the_closest_one_gives_the_task(browser, bank):
+def test_home_shows_only_the_closest_test_and_the_other_tests_are_on_its_card(browser, bank):
     app, store, klass, lessons = world(bank)
     far = add_test(store, klass, lessons, 20)
     near = add_test(store, klass, lessons, 9)
     with running(app) as url:
         page = sign_in(browser, url)
         to_home(page)
-        assert page.get_attribute("#nearest-test", "data-test") == str(near["id"])
-        assert page.locator("#other-tests li").count() == 1 and page.get_attribute("#other-tests a", "href") == f"#/test/{far['id']}"
+        assert page.get_attribute("#nearest-test", "data-test") == str(near["id"]) and page.get_attribute("#today-task", "href") == f"#/exam/{near['id']}/1"
+        assert page.locator("#other-tests").count() == 0 and page.locator("#notifications").count() == 0                       # only what is critical
+        page.click("#nearest-test a[href^='#/test/']")
+        page.wait_for_selector("#other-tests")
+        assert page.get_attribute("#other-tests a", "href") == f"#/test/{far['id']}"
 
 
 # --- 3.3 a test's card ---

mathly2/tests/test_instant_browser.py

@@ -0,0 +1,67 @@
+"""A screen opened again shows what it last knew (cache-and-instant-screens 2.1), in a real browser."""
+import pytest
+
+playwright = pytest.importorskip("playwright.sync_api")
+
+from mathly2.tests.serve import running
+from mathly2.tests.test_busy_browser import hold
+from mathly2.tests.test_written_browser import (DESKTOP, KID, PHONE, TEACHER, bank, browser, day, jpeg, one_assignment, sign_in, teacher_work, world)  # noqa: F401
+
+
+def counts(page):
+    return page.eval_on_selector_all("#teacher-tabs [data-count]", "els => els.map(e => e.textContent)")
+
+
+def test_going_back_to_a_tab_shows_its_content_and_numbers_at_once_then_the_fresh_ones(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = teacher_work(browser, url, tab="assignments")
+        page.wait_for_function("[...document.querySelectorAll('#teacher-tabs [data-count]')].every(e => e.textContent)")
+        known = counts(page)
+        page.click("#teacher-tabs [data-tab='classes']")
+        page.wait_for_selector("#teaching")
+        held, release = hold(page, "**/api/teaching/**")
+        page.click("#teacher-tabs [data-tab='assignments']")
+        page.wait_for_selector("#work")                                      # drawn from memory while the server is still being asked
+        assert held and counts(page) == known
+        # something changes on the server meanwhile; once the answer arrives the fresh content replaces the remembered one
+        other = store.create_assignment(row["class_id"], "משימה אחרת", day(7), TEACHER, "quiz", quiz_lesson=row["quiz_lesson"])
+        release()
+        page.wait_for_function("document.querySelectorAll('#work .assignment, #work article').length >= 2")
+        assert not page.errors
+
+
+def test_after_the_teachers_own_change_no_old_inbox_is_shown(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = teacher_work(browser, url, tab="assignments")
+        page.click("#work [data-remove-assignment]")
+        page.click("[data-confirm-remove-assignment]")
+        page.wait_for_selector("#work")
+        held, release = hold(page, "**/api/teaching/assignments")
+        page.click("#teacher-tabs [data-tab='inbox']")
+        page.click("#teacher-tabs [data-tab='assignments']")
+        page.wait_for_timeout(300)
+        assert not page.query_selector("#work .assignment[data-id], #work [data-remove-assignment]")   # nothing remembered of the removed one
+        release()
+
+
+def test_a_refresh_does_not_redraw_over_what_is_being_typed(browser, bank):
+    app, store, row = one_assignment(bank)
+    with running(app) as url:
+        page = teacher_work(browser, url, tab="assignments")
+        page.click("#teacher-tabs [data-tab='classes']")
+        page.wait_for_selector("#teaching")
+        page.click("#teacher-tabs [data-tab='assignments']")
+        page.wait_for_selector("#work")
+        page.wait_for_timeout(500)
+        held, release = hold(page, "**/api/teaching/**")
+        page.click("#teacher-tabs [data-tab='classes']")
+        page.click("#teacher-tabs [data-tab='assignments']")
+        page.wait_for_selector("#work")
+        store.create_assignment(row["class_id"], "משימה אחרת", day(7), TEACHER, "quiz", quiz_lesson=row["quiz_lesson"])
+        page.click("#work summary")
+        page.fill("#work .assignment-form input", "טיוטה")
+        release()
+        page.wait_for_timeout(500)
+        assert page.input_value("#work .assignment-form input") == "טיוטה"