danvics/pdf-quiz-generator
1
0
Fork 0
Code Issues Pull requests Projects Releases 3 Packages Wiki Activity Actions
pdf-quiz-generator/backend/tests
History
Daniel 18fa1913a4 fix: the contact form's messages were readable by anyone 
`GET /api/contact/submissions` had no authentication. `require_admin` was
imported inside the function body and never used as a dependency, so the import
read as protection and was none: anyone who guessed the path could read every
sender's name, email address and message. `PUT .../read` was open the same way.

Both now depend on `require_admin`, with a test that a learner gets 403 and an
administrator gets the list. A row with a null timestamp no longer takes the
whole listing down with it — which is the only reason the hole showed up as a
500 rather than as data.

Also: the tutor's site switch lives in Redis, which the tests share with the
running site, so turning the tutor off in the interface turned a test red. The
test now sets the flag it depends on and puts it back.

And the tutor button is hidden until the server says it is allowed, rather than
shown and then withdrawn — on a site with it switched off that flicker reads as
a bug rather than a policy.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqXevQJhxFrM7jJg82cgZN
2026-09-12 22:37:28 +02:00
..
__init__.py Initial commit: PDF Quiz Generator app 2026-03-30 20:04:53 +00:00
test_access.py feat: access as one tree — branches, libraries, and an honest "everything" 2026-09-11 12:53:56 +02:00
test_ai_mode.py fix: a greeting does not name the thread 2026-09-12 19:09:55 +02:00
test_ai_mode_matching.py fix: an upload is what its bytes say, not what its name claims 2026-09-12 19:05:12 +02:00
test_ai_practice.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_article_ai.py fix: WebP figures, the openai SDK removed, and a voice a site can add to 2026-09-12 17:13:05 +02:00
test_article_notes.py feat: question folders, per-section notes, and two feedback paths 2026-09-12 18:37:43 +02:00
test_article_search_index.py feat: three answers, chosen by a number rather than by the model 2026-09-12 16:15:05 +02:00
test_articles_cards.py feat: an article follows a topic, rather than copying it once 2026-09-12 19:57:06 +02:00
test_articles_migration.py feat: linked topic articles and card associations 2026-09-07 15:16:48 +02:00
test_bank_cleanup.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_blueprint_plans.py feat: study plans built to the board's content outline 2026-09-11 21:40:17 +02:00
test_captcha.py feat: Cap replaces hCaptcha, self-hosted beside the app 2026-09-12 06:14:14 +02:00
test_category_grants.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_category_migration.py feat: retire the tags, and stop settings from hiding from the page that 2026-09-12 05:06:58 +02:00
test_collections.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_contact_privacy.py fix: the contact form's messages were readable by anyone 2026-09-12 22:37:28 +02:00
test_draft_questions.py fix: the other registration form, our own transcriber first, and a rail 2026-09-12 04:41:27 +02:00
test_exam_admin.py feat: exams are a group you can build, with the board's own blueprint 2026-09-11 20:27:48 +02:00
test_exam_blueprint.py feat: adaptive weighs the paper as well as the learner, and Session 2026-09-12 05:54:09 +02:00
test_exam_scoped_tags.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_exams.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_feedback.py feat: question folders, per-section notes, and two feedback paths 2026-09-12 18:37:43 +02:00
test_file_intake.py fix: an upload is what its bytes say, not what its name claims 2026-09-12 19:05:12 +02:00
test_global_search.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_hybrid_search.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_invites_and_flags.py feat: the tutor is an administrator's to allow, and a handbook explains the rest 2026-09-11 21:13:38 +02:00
test_login_codes.py feat: sign in with a code sent by email 2026-09-12 17:29:28 +02:00
test_login_without_captcha.py feat: Cap replaces hCaptcha, self-hosted beside the app 2026-09-12 06:14:14 +02:00
test_media_library.py feat: real organ systems, symptoms grouped by system, and admin taxonomy CRUD 2026-09-10 10:44:39 +02:00
test_multi_category.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_option_explanations.py feat: key points smart links, difficulty tags, adaptive sessions, educator-only question management 2026-09-09 02:26:45 +02:00
test_prepared_session.py feat: a session prepared for you, and a model that can see when the one on the job cannot 2026-09-12 15:46:04 +02:00
test_question_folders.py feat: question folders, per-section notes, and two feedback paths 2026-09-12 18:37:43 +02:00
test_question_trash.py feat: questions are soft-deleted, and the trash holds them 2026-09-11 20:12:58 +02:00
test_question_versions.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_quiz_builder.py feat: the session moves along the difficulty range, per topic 2026-09-12 21:39:23 +02:00
test_quiz_sessions.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_related_privacy.py fix: the contact form's messages were readable by anyone 2026-09-12 22:37:28 +02:00
test_rerank.py feat: rerank what a learner is shown, with Cohere through the proxy 2026-09-12 18:23:06 +02:00
test_session_lifecycle.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_share_public.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_shared_category.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_study_plan_editing.py feat: study plans you can open, work through, and edit 2026-09-10 12:10:39 +02:00
test_study_plan_sessions.py feat: study-plan blocks as modules, sessions that know their block 2026-09-11 04:31:21 +02:00
test_study_tools.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_study_tools_migration.py fix: preserve saved quiz progress across resume failures 2026-09-07 03:34:55 +02:00
test_tag_hierarchy.py refactor: remove per-question sharing 2026-09-12 08:42:51 +02:00
test_thumbnails.py feat: thumbnails for uploaded images, at two widths and no others 2026-09-12 08:49:20 +02:00
test_vision_fallback.py fix: WebP figures, the openai SDK removed, and a voice a site can add to 2026-09-12 17:13:05 +02:00