CooperandGoodman/homeschool
1
0 Fork 0
Code Issues Pull Requests Activity
72 Commits 1 Branch 2 Tags
f74bc1a1ff444724ffe1a3d7cd1ddb930036fc80
Commit Graph
6 Commits
Author SHA1 Message Date
derekcandClaude Opus 5.5 5a2510059d Fix timer action 500s after FastAPI upgrade 
FastAPI 0.141 raises when response serialization hits a lazy-load
(current_block.subject.options) in async context, where 0.115 silently
skipped it. Eager-load Subject.options in session get/timer and the TV
dashboard queries. Pin pydantic 2.13.5.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-09-24 23:51:10 -07:00
derekcandClaude Opus 5.5 3170c7f4eb Fix HIGH findings from 2026-09-24 maintenance review 
- nginx: resolve real client IP through Cloudflare -> NPM so rate limits
  are per client instead of shared across all users
- Bump vulnerable Python deps (PyJWT auth bypass, anyio, starlette via
  fastapi 0.141.1, cryptography, python-multipart, Mako); pin PyMySQL
  1.1.2 since 1.2.x breaks SQLAlchemy 2.0.35's aiomysql ping
- Backend: python 3.12.14-slim, apt-get upgrade, drop unneeded build deps
- Frontend: nginx 1.30.5-alpine (stable) + apk upgrade
- MySQL 8.0.40 (EOL) -> 8.4.11 LTS; add healthcheck start_period so
  slow startups (e.g. data upgrades) don't abort dependent services
- Add maintenance review report

Co-Authored-By: Claude Opus 5.5 <[email protected]>
 2026-09-24 23:38:16 -07:00
derekcandClaude Sonnet 4.6 090ebc109e Add Ntfy push notifications for super admin events 
Sends alerts to a configurable Ntfy topic on: new user registration,
account lockout after 5 failed login attempts, and login attempts on an
already-locked account. Fire-and-forget — never raises if Ntfy is down.

Configure via NTFY_URL and NTFY_TOKEN in .env.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-03-22 01:04:12 -07:00
derekcandClaude Sonnet 4.6 3022bc328b Security hardening: go-live review fixes 
- TV tokens upgraded from 4 to 6 digits; Regen Token button in Admin
- Nginx rate limiting on TV dashboard and WebSocket endpoints
- Login lockout after 5 failed attempts (15 min); clears on admin password reset
- HSTS header added; CSP unsafe-inline removed from script-src; CORS restricted to explicit methods/headers
- Dependency CVE fixes: PyJWT 2.12.0, aiomysql 0.3.0, cryptography 46.0.5, python-multipart 0.0.22
- datetime.utcnow() replaced with datetime.now(timezone.utc) throughout
- SQL identifier whitelist for startup migration queries
- README updated: security notes section, lockout docs, token regen, NPM proxy guidance

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-03-22 00:00:14 -07:00
derekcandClaude Sonnet 4.6 781e179090 Fix backend deps and apply theme to all Cancel buttons 
- Pin bcrypt==3.2.2 to fix passlib bcrypt backend detection error
- Add email-validator==2.2.0 required by Pydantic EmailStr
- Add btn-sm class to Cancel buttons in Admin, Dashboard, Log, Schedule views

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-02-27 23:24:39 -08:00
derekcandClaude Sonnet 4.6 417b3adfe8 Initial project scaffold 
Full-stack homeschool web app with FastAPI backend, Vue 3 frontend,
MySQL database, and Docker Compose orchestration. Includes JWT auth,
WebSocket real-time TV dashboard, schedule builder, activity logging,
and multi-child support.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>
 2026-02-27 22:56:56 -08:00