5140958305
Projects were previously global to anyone who could reach the server. Adds email/password accounts with httpOnly cookie sessions, scopes every project (both SQLite and localStorage) to the signed-in user, and auto-claims pre-existing unowned projects for whoever registers first. Also adds optional TOTP two-factor auth with backup codes, managed from a new Account Settings page, since there's no password-reset flow to fall back on otherwise. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
5.7 KiB
5.7 KiB
Study App Improvement Suggestions
Refreshed 2026-07-06 — the previous version of this file predated ~40 commits of feature work (OT support, tagging, DOCX import/export, split-view, commentary, cross-ref suggestions, and the full Bible Reader with audio/bookmarks/interlinear/search). Items already shipped have been removed; this reflects what's actually still open.
Features
Study Tools
- Bible comparison mode — show two translations side-by-side.
availableTranslationsis already fetched and a translation is already selectable per project (App.jsx:904), but only one renders at a time — no split/parallel view - Verse-level notes — annotations are still chunk-level only (OIA fields); no way to attach a note to a single verse within a chunk
- Progress tracking — no "in progress"/"complete" marker per chunk and no progress bar on the home project card
- Study templates — no guiding prompts pre-filled for new users starting their first OIA entry
- Word/character count on the OIA and Final Script textareas — encourages note depth, useful for episode-length planning
Export / Sharing
- PDF export / print stylesheet — still no
window.print()CSS or PDF button anywhere in the app - Share link — no read-only shareable URL for a project (useful for co-teachers reviewing an episode)
- Markdown export — HTML/DOCX/Claude-prompt exports exist; no plain Markdown output for Obsidian-style tools
- Episode length estimate — Final Script field exists per chunk; a word-count-based "~X minutes read aloud" estimate would help podcast planning
Chunk Builder (Setup Page)
- Drag-to-select verses — still click-then-shift-click; no click-and-drag range selection
- Auto-chunk — no "split by paragraph/section" button; every chunk boundary is manual or typed
UX / UI
Navigation
- Breadcrumb in header — study page header only shows the project title (
App.jsx:4172); no persistent "Genesis 1:1–5" reference next to it so users can tell at a glance where they are without checking the scripture panel
Study Page
- Word/char counters — see above
- Sticky bottom nav — top Prev/Next chunk nav shipped (commit
103e20c); a matching sticky bottom bar for long chunks would avoid scroll-back
Home Page
- Search/filter/sort/rename are all implemented — nothing open here currently
Code Architecture
State Management
App.jsxis now ~5,100 lines (up from ~2,250 when this doc was last written) — still one component from line 903–5044. Splitting intopages/HomePage.jsx,pages/SetupPage.jsx,pages/StudyPage.jsx,pages/BibleReaderPage.jsx, plus extracted hooks (useProject,useGreekLookup,useAutosave) is more valuable now than it was before, given the size increasecommentarySourcedoesn't persist — resets to'matthew-henry'every session (App.jsx:1107), unlikestudyLayout/activeStudyTabwhich do persist to localStorage via the same pattern
Sync / Persistence
No auth on the backend— fixed; email/password accounts with httpOnly cookie sessions (server/auth.js,server/sessionStore.js), projects scoped per-user in both SQLite (server/db.js) and localStorage (App.jsxswitchStorageUser/namespaced keys), and pre-existing local projects auto-claimed by the first registered account- No rate-limiting on
/api/auth/*— a determined attacker could brute-force a weak password; worth adding if this is ever reachable beyond a small trusted group - Conflict resolution is still last-write-wins — only
lastEditedtimestamps are compared; no "which version do you want to keep?" UI - "Restore"/"Pull latest from server" don't open the project (
App.jsx:2997-3017) — they refresh the local index but leave the user on the Home page instead of jumping into the study - Offline-first — still no service worker; app requires a live connection to
bible.helloao.orgfor chapter/audio/commentary loads with no cached fallback if that API is down
Security (OWASP)
XSS via— fixed;dangerouslySetInnerHTMLDOMPurify.sanitize()now wraps both render paths (App.jsx:4784,App.jsx:5020)- No input validation on server — still no max-length/character validation on
id/titleinserver/index.js - CORS — still no CORS headers configured
Performance
- Verse data stored in project JSON — still true; full verse text is saved per chapter in both localStorage and SQLite
- Reader bookmark icon is unclear — shows a 🏷️ tag emoji before bookmarking and only switches to 🔖 after (
App.jsx:3641), but the help text says "bookmark icon to save" — a plain outline bookmark icon would read more clearly from the start - No audio playback speed control — chapter/reader audio only has play/pause/stop (
App.jsx:1037); a 0.75x/1x/1.5x toggle would help slow, careful study listening - Hardcoded external API, no fallback — audio and commentary both call
bible.helloao.orgdirectly (App.jsx:985,App.jsx:1129) with no retry UI if the free API is briefly down
Testing
- Migration and prompt-building tests now exist (
migrateChunk,migrateProject,buildClaudePrompt,parseBibleChapterare all covered insrc/utils.test.js) — this section is essentially done - Still missing: autosave debounce behavior, and coverage for the newer features (DOCX episode import, cross-ref auto-suggest, commentary loading)
Developer Experience
- No ESLint config — still true; no
.eslintrc*oreslint.config.*in the repo - No TypeScript — still true
- No
docker-compose.yml— still true; Dockerfile exists but no one-command local dev with server + SQLite volume