Repository navigation
Conversation
Clearing the GitHub API cache and exporting the local database only checked that someone was signed in, so a student session got 200 from both. The export handed out analytics_history.db (analysis runs plus the full audit_log: login failures, invite events) and labelled it gsad_users.db. Both endpoints now use a new _require_staff_api() helper (same contract as _require_admin_api): 401 anonymous, 403 anyone who is not admin/faculty, 200 for staff. The download is named analytics_history.db, the Settings copy says it is the analysis & audit database, and the Data Actions panel is hidden for students so no control is rendered that would 403. New tests/test_auth.py::TestSettingsDataActionsRBAC (6 tests). Suite: 749 passed / 10 skipped (was 743/10).
summarize_team_events capped Team_Active_Dates with sorted(active_dates)[:90], i.e. the OLDEST 90 days - the opposite of every sibling cap (sorted(days)[-cap:] in sync.py). views._recent_activity takes the streak from max(active_days), so any truncation would collapse every streak to 0. Both app/services.py and the frozen legacy services.py now slice [-90:] to stay in step for the parity harness. New test: tests/test_services.py::TestTeamActivity::test_active_dates_keep_the_newest_90_days (100 push days -> 90 dates, day 11..day 100), green in default and MODULE_UNDER_TEST=app.services modes.
POST /certificates/queue read request.state.user_row, but that attribute is only assigned inside _base_context (page renders), so a POST handler never has it - every queued certificate was stored with student_id='' and PRN-keyed lookups silently missed the row. The handler now resolves the account row itself when the attribute is missing (_memo(f'user:{email}', auth.get_account)); a token-only session with no users row still queues with an empty PRN instead of failing.
New tests: tests/test_certificates.py::TestQueuedCertificateStoresPrn (2 tests).
GET /api/certificates authorised only student_email while certificates.list_certificates_for_student matches student_email OR student_id, so a student could pass their own address plus another student's PRN and read that student's rejected certificate (admin_notes, verified_by, skills). Non-staff callers are now force-scoped to their own identity: both query parameters are ignored, student_email becomes the session email and student_id comes from the caller's own account row. Admin/faculty lookups are unchanged. New tests: tests/test_certificates.py::TestCertificateApiScoping (4 tests). Docs cover this batch: Bug Tracker rows for BUG-148/151/155 -> Fixed with proof (123 fixed / 16 open, audit 2026-10-28) and a 'Correctness fixes (2026-10-28)' log in Taskflow. Suite: 756 passed / 10 skipped (was 749/10).
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
new bugs