6 Commits

Include renames

Author	SHA1	Message	Date
nmemmertandClaude Sonnet 5.5	09177f47ed	Notes: multiple notes per section with last-edited dates, delete, sort by recently edited; Word export now readable; shared note-format module + tests; v2.43.0 ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-15 08:14:45 -04:00
nmemmertandClaude Sonnet 5.5	0ab94bfcd4	Discussion stays open for finished studies; only planned studies are closed; v2.11.2 ... A finished study is just no longer the main study, so students who take it later still need discussion. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-09 11:52:56 -04:00
nmemmertandClaude Sonnet 5.5	f1d4909acb	Discussion only open while a study is active; v2.11.1 ... - Community posts, replies, likes and lesson comments are refused (403) for finished and planned studies - Reading a closed study's community/comments returns an empty list with closed:true - Discussion hub lists only active studies; community page shows a closed notice - Lesson page hides Lesson Discussion, 'Discuss this lesson' and 'Go to Community' for inactive studies; Community buttons hidden on study/dashboard pages - Tests for isStudyDiscussionOpen Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-09 11:49:03 -04:00
nmemmertandClaude Sonnet 5.5	bb83f3e8c5	Completed studies: finishing a study keeps access after leaving; certificates always shown; no reminders for finished studies; v2.11.0 ... - Completion is stored on the user (completedStudySlugs, sticky) when every lesson is done; backfilled at startup - Lessons, notes, progress, quiz, community and certificate stay open for completed studies after leaving the enrollment - Dashboard/My Account list completed studies with Review Lessons and certificate access - Study page shows a completed banner - Lesson-release reminders, weekly digest and re-engagement emails skip finished studies - Fix: streak fields (current/longest/last studied) and firstCompletionAt were dropped on every restart when users were loaded - Tests for completion/access/re-engagement Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-09 11:42:58 -04:00
nmemmertandClaude Sonnet 5.5	2a64f29a00	Second hardening pass: atomic data writes, bible-passage limits, webhook SSRF guard, note sanitizing, CI gates; v2.10.1 ... - Atomic temp-file + rename for all JSON data writes (no truncated files on crash) - /api/bible-passage: rate limit, range caps (60 verses), bounded cache - Admin webhooks: https-only, block private/internal/Tailscale addresses (checked at registration and delivery), no redirects - Resend webhook token compare is timing-safe - DOMPurify on rendered study notes and broadcast preview - CI runs lint + tests before build - Permissions-Policy and HSTS (production) headers; JSON error handler for /api - Tests for URL safety and atomic writes Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-09 09:00:28 -04:00
nmemmertandClaude Sonnet 5.5	8a796964b9	Security & hardening pass: scrypt password hashing, persisted admin sessions, upvote/analytics rate limits, dependency fixes, healthcheck, lint cleanup; v2.10.0 ... - Study passwords: salted scrypt; legacy SHA-256 hashes verified and upgraded on login - Admin sessions persisted (hashed tokens) so deploys no longer log the admin out - Upvotes: rate limit + one per client per question, approved questions only; rate limit on analytics play/event - npm audit: 46 -> 4 vulnerabilities (tiptap bumped to 3.31.4) - Untrack per-user data (study users/notes/progress/etc.) from git - Dockerfile HEALTHCHECK; node --test suite for password hashing - Fix email template cards remounting (lost input focus) on each keystroke - Lint: 34 errors -> 0 Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-09 08:45:39 -04:00