pdf-quiz-generator/docs/quiz-revamp-progress.md

Quiz revamp progress

Milestone 1 — custom tests and categories

Implemented in affd717 plus the follow-up review-fix commit:

• Learner custom-test builder: multiple categories and descendants, exact available counts, 1–200 questions, study/exam modes, unused/incorrect/bookmarked filters, fixed saved membership and optional sharing.
• Existing categories retain IDs/assignments; optional hierarchy, cycle guards, breadcrumbs and educator reparenting support added.
• Central general-quiz visibility and sharing checks across web, attempts and mobile; ownerless-question revocation is NULL-safe and both Hide and Unshare revoke public access.
• Explicit question selection rejects private/course/missing IDs. Peer deletion of private/manual questions is denied.
• Web, mobile and expiry use one grading function. Duplicate/out-of-pool submissions are rejected; skips have recorded incorrect outcomes; reviews use selected questions only, and unfinished attempts do not return answer review.
• Category UI handles validation arrays, refreshes reparented filters and offers relocation even when the visible question count is zero. Private quiz titles are keyboard-accessible links.
• Category migration supports real offline SQL rendering and existing/fresh schemas.

Verification

Initial implementation received two independent read-only reviews (access/correctness and UI/migration). The parent applied the accepted fixes and added behavioral regressions.

• Backend: 14 tests passed inside the exact deployed backend image sha256:77d9af981537a09396fb5a511f27b4efd00794443823db8eb522beb3aa70a5b9 (Python 3.11 and deployed library versions). Disposable SQLite only; network disabled; no production data.
• Frontend: 13 tests passed in four suites with NODE_ENV=test npm test; production build passed with NODE_ENV=production npm run build.
• PostgreSQL 16: actual migration upgrade, FK enforcement, existing-row/question-assignment preservation, repeated upgrade, downgrade and re-upgrade passed in a disposable network-isolated container. Container/data cleaned up automatically.
• Alembic offline SQL: explicit 5f8c1c2a9d40:c82d19e4a601 upgrade and reverse downgrade exercised without mocking inspection.
• Changed Python syntax and git diff --check passed.
• Regression negative-control run against the unfixed affd717 is tracked separately; do not infer its result from the passing fixed-code suite.

The first Docker validation attempt failed before tests because a read-only mountpoint was absent; setup was corrected. One frontend regression initially used an ambiguous Create Quiz selector; the modal was labeled and the test scoped to it, then all tests passed.

Release boundaries

This milestone is source work on the feature branch, not a production deployment or completion of the whole revamp. Apply migrations explicitly before serving updated code against the existing production DB; startup does not automatically upgrade existing tables.

Older tutor-context and question-image delivery authorization gaps identified by review remain a release blocker and have their own tracked privacy task. Already-downloaded offline content cannot be recalled by server revocation. No new AI provider calls or production database/service changes were performed.

Login-only Turnstile removal

User-requested removal covers both /login and the landing-page sign-in modal, the shared login client payload, and the backend password-login handler/schema. Registration and contact Turnstile are unchanged; no keys/configuration were removed.

Verification: 18 backend tests passed in the exact deployed image, including login with a configured Turnstile secret but no challenge token, incorrect-password rejection, email verification, SSO-only mode, the eleventh-request rate limit and retained registration verification. All 17 frontend tests and the production build passed, including both login entry points with a configured site key and retained registration/contact widgets. The first backend run used reserved .test email addresses; only fixtures were corrected to example.com, not validation rules.

This source change is committed/pushed with the feature work; it has not been deployed to production.

Next

Continue with the Orthobullets-inspired runner/results UI, question navigation and study tools; then article/subsection reading, linked flashcards, educator AI authoring and moderated comments. Complete related-content privacy work and end-to-end desktop/mobile validation before deployment.