0c2a2275ce
security(admin): harden admin API surface — role guard, secret fail-closed, env-based credentials
...
Removes the unauthenticated admin API hole verified live in the 2026-09-26 audit:
- Add require_admin dependency; apply to ALL 17 /api/admin/* endpoints.
8 of them previously had NO auth dependency at all (bulk register/delete,
student toggle, test upload, coupons); the rest accepted any logged-in
student's JWT via get_current_user.
- Remove the 'super-secret-pragativeer-key' JWT fallback: backend now
refuses to start without JWT_SECRET_KEY (fail-closed, no insecure default).
- Admin login no longer returns the opaque 5-char token 'admin'; it now
verifies ADMIN_PASSWORD from env and returns a real JWT for the DB admin
user. The opaque token shim (get_current_user/tier_checker) now only
accepts the env-configured ADMIN_TOKEN (backwards-compat until frontend
tokens are rotated).
- Replace all hardcoded 'Pv9#kL2$mQ8!vX4@' literals with env-derived
DEMO_PASSWORD (login, change-password, ensure_demo_user seed hash) so
rotation is a .env edit, not a code change.
- Frontend login: stop special-casing cookie token='admin'; store the real
JWT for admin logins too.
- Add backend/.env.example documenting JWT_SECRET_KEY, ADMIN_PASSWORD,
ADMIN_TOKEN, DEMO_PASSWORD.
Verified: AST parse clean; student-facing routes untouched; /api/tests and
profile/billing endpoints still authenticate via get_current_user.
Ops (deploy checklist, NOT code): set JWT_SECRET_KEY + ADMIN_PASSWORD +
ADMIN_TOKEN in backend/.env before restarting, or the backend will fail
closed. Old issued JWTs remain valid until the secret is rotated.
2026-09-26 07:19:37 +00:00
8a5ea57feb
fix(cbt): comprehensive overhaul of CBT & DPP test pipelines, JSON schemas, active states, and exam pattern filters
2026-09-25 18:12:06 +05:30
ed1084bd8d
Fix minio localhost public URL by proxying through backend
2026-09-25 17:54:33 +05:30
9dd0601a22
Fix test filtering by exam_pattern, fix Admin UI test upload mapping Mock/DPS
2026-09-25 17:24:05 +05:30
173ce4ca04
UI fixes: Admin UI padding, AI Tutor Chat History, DPP filtering and Premium Gates
2026-09-25 16:01:38 +05:30
8887145260
Fix admin UUID parsing error on test upload
2026-09-25 15:02:02 +05:30
eefcb12ffc
Fix UI bugs, admin bulk upload limits, test ingestion bugs, and reset demo users
2026-09-25 14:21:48 +05:30
b20531b1e3
Fix MinIO DPP upload linking to frontend
2026-09-25 13:37:29 +05:30
3773d0cc51
Admin fixes, minio texts removed, added is_active to User model
2026-09-25 13:01:48 +05:30
46b44b5a14
Fix backend bulk delete, separate password page, remove admin dummy data, swap dashboard rows
2026-09-25 12:53:38 +05:30
21d7cac565
Fix CBT submission, add CBT seeds, update features table, layout AI coach chat and add local memory
2026-09-25 12:15:10 +05:30
ba4ab2049b
Update layout, settings, and bulk upload password forcing
2026-09-25 12:03:01 +05:30
e12c3fb8eb
Fix bulk delete foreign key constraints and bulk upload phone unique constraint
2026-09-25 10:54:18 +05:30
1acbda2f83
Fix animation inconsistencies on pages with loading spinners
2026-09-24 22:41:47 +05:30
ec4849ccce
Fix AI Coach typo, fix bulk register UI, and update exam tiers
2026-09-24 21:59:04 +05:30
6b4a1bb5eb
fix: add missing required user fields in bulk register
2026-09-24 21:13:09 +05:30
4bdeb4f5ef
fix: Enum capitalization in Bulk register endpoint
2026-09-24 21:10:21 +05:30
85974b97f5
feat: Add Bulk Registration, Change Password, and update Auth UI
2026-09-24 20:53:21 +05:30
a294ee8b9e
feat: Add authentic JEE/NEET mock tests and fix CBT frontend filtering
2026-09-24 19:55:12 +05:30
48350bc996
feat: signup flow improvements and CBT exam test visibility for dual targets
2026-09-24 14:56:00 +05:30
1249da54fb
fix: correctly calculate dynamic trial remaining days and fix missing trial_end in admin API
2026-09-24 12:31:03 +05:30
a6db3e7c17
feat: add per-user trial control in admin panel (backend + UI)
2026-09-24 12:12:37 +05:30
1d9cdd3f33
feat: apply various dashboard and auth fixes including demo trials, settings UI, and signup options
2026-09-23 16:38:49 +05:30
86a2749360
fix: resolve infinite loading for demo users due to 401 on missing profile
2026-09-23 12:50:21 +05:30
2488311661
feat: Add demo users and trial logic uniformity
2026-09-23 12:42:07 +05:30
a3e430cb67
feat: Add JWT authentication to backend, configure frontend API client, fix streak layout
2026-09-23 12:11:44 +05:30
857ac320f1
Fix CBT session isolation and backend seed mock data exam pattern
2026-09-21 12:15:13 +05:30
63ab119f7c
Update AI coach calibration, fix streak animation speed, add dashboard features and target filtering
2026-09-21 12:03:37 +05:30
6307a24c4c
fix(demo & streak): fix Neha demo account hang, enhance streak animation for light/dark modes and cries/celebration emojis
2026-09-20 12:37:11 +05:30
896073ea2d
perf: docker + next.js build optimisation - dockerignore exclusions, BuildKit cache mounts, backend image reuse, memory limits, next.js bundle tree-shaking
2026-09-20 12:05:24 +05:30
fee57e154b
prod: hardened deploy config for srv1289857 — prod container names/ports (frontend :3882, backend :8010, db :5440), Dockerfile.prod (uvicorn --workers 1, init_db race fix), next.config.ts BACKEND_INTERNAL_URL build-arg rewrite, celery worker/beat healthchecks (no-HTTP daemons: inspect ping w/ tmp-file output, /proc cmdline grep; pgrep unavailable in image), pgbouncer removed, restart: unless-stopped
2026-09-20 11:22:20 +05:30
5c6ddcaca0
fix: QA report BUG-01 to BUG-12 full resolution - demo switcher, AI tutor stream, timeline alignment, cbt filtering, danger styling, streak celebration
2026-09-19 22:53:58 +05:30
45f2f82eaf
fix: QA report bugs BUG-01 through BUG-11 resolved - streak modal close btn, calculator crash guard, AI chat auto-scroll, leaderboard zero-streak fix, name annotation cleanup everywhere, CBT score display colors, PrepPilot difficulty badge layout
2026-09-19 22:34:45 +05:30
afab06d33c
feat: complete comprehensive zero-state metrics across all dashboard pages for new accounts
2026-09-13 22:17:40 +05:30
d9bd142e6a
feat: add AI options to landing mock sidebar and wire database-backed stats & leaderboard with fresh zero states
2026-09-13 21:57:12 +05:30
a81e53c781
fix: demo name, trial flow, signup profile fields, docker pgbouncer/frontend
...
- page.tsx: hero mock shows 'Neha Verma' + 'AI Coach Plan' (was 'Demo Student')
- backend/main.py: demo login maps to Neha Verma UUID (33333333-...)
- backend/main.py: register endpoint stores exam/class/medium/school + trial_end from admin settings
- backend/main.py: register checks allow_new_registrations setting
- backend/main.py: admin student list includes trial_end field
- useActiveUser.ts: rewrite trial logic using real created_at date
- useActiveUser.ts: add computeTrialInfo(), isDemoUser() helpers + expose trialInfo from hook
- useActiveUser.ts: hasAccessTo() now uses effectiveTier from trial logic
- dashboard/layout.tsx: hide demo switcher for real users (only show for known demo accounts)
- dashboard/layout.tsx: trial badge in top header (Day N/15 Trial · Xd left)
- dashboard/layout.tsx: trial day shown in sidebar user card and dropdown
- signup/page.tsx: wire step 2 selects (exam/class/medium/school) to state + send to backend
- signup/page.tsx: success screen shows 'Day 1 of your Free Trial has started!'
- userlist.txt: was empty directory causing pgbouncer mount failure; replaced with proper file
- pgbouncer.ini: added DB credentials in connection string; fixed admin_users
- Dockerfile: added ARG NEXT_PUBLIC_API_URL baked at build time (needed for standalone)
- docker-compose.yml: frontend build arg http://backend:8000 ; pgbouncer healthcheck; backend waits for pgbouncer
2026-09-13 21:19:35 +05:30
92af3fe49a
chore(cleanup): purge runtime logs, obsolete scripts, and raw PDFs while preserving sample NEET/JEE testing datasets
2026-09-09 12:26:45 +05:30
ec558d52fe
feat: audit and purge legacy backend files, stub Phase 2 AI LLM modules, create comprehensive PAGEWISE_API_DOCUMENTATION.md, and wire DPS test seeding
2026-09-09 11:28:34 +05:30
a28366f0c3
fix: seed FK flush order, DPS path resolution, admin_uploads Docker mount, docker-compose env additions
2026-09-09 09:52:33 +05:30
63c8067216
feat: wire SMTP email service, production CORS domains, Razorpay ENV, MinIO env-vars, and DPS seed from admin_uploads
2026-09-09 09:48:00 +05:30
5951ab5b3f
fix(auth): restrict seeded credentials exclusively to super admin and demo student in backend and api documentation
2026-09-04 12:01:02 +05:30
3ad281aae6
fix(auth): resolve demo login redirect loop, fix backend API bugs, restore clean login UI, and add comprehensive API docs with headers
2026-09-04 11:49:13 +05:30
63bf71a50c
feat: complete auth and gateway agnostic billing implementation
2026-08-13 11:32:35 +05:30
62d15c85f6
fix: smart CBT result/back routing for DPPs and add Test Type selector in Admin panel
2026-07-27 15:55:54 +05:30
053b727725
fix: remove all Expand View links, seed real 15Q JEE/NEET DPP questions per subject
2026-07-27 15:35:14 +05:30
d79671ee73
chore: add mock seeding script for dpps
2026-07-27 15:06:04 +05:30
a5bb2d867c
feat: setup admin JSON generation and pdf viewer for free plan DPPs
2026-07-27 14:56:25 +05:30
ebc552a8ca
Update card width to max-w-2xl and iframe animation height to 360px. Adjust demo streak data in database seed.
2026-07-10 14:40:57 +05:30
89c704c02c
Refactor streak modal into a single card with top border-b iframe animation and bottom greetings, daily check-in Snapchat-like streak update/reset logic
2026-07-10 14:29:34 +05:30
d5199682e3
feat: complete UI tasks, backend optimizations, coupon admin, user kundli
2026-07-10 12:36:56 +05:30
