Apexone11
diff --git a/‎.github/workflows/quality-gates.yml‎
Lines changed: 1 addition & 1 deletion b/‎.github/workflows/quality-gates.yml‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎CHANGELOG.md‎
Lines changed: 44 additions & 0 deletions b/‎CHANGELOG.md‎
Lines changed: 44 additions & 0 deletions
diff --git a/‎CLAUDE.md‎
Lines changed: 1 addition & 0 deletions b/‎CLAUDE.md‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎backend/.env.example‎
Lines changed: 1 addition & 7 deletions b/‎backend/.env.example‎
Lines changed: 1 addition & 7 deletions
diff --git a/‎backend/package.json‎
Lines changed: 1 addition & 0 deletions b/‎backend/package.json‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎backend/prisma/migrations/20260427000001_add_teacher_materials_tables/migration.sql‎
Lines changed: 87 additions & 32 deletions b/‎backend/prisma/migrations/20260427000001_add_teacher_materials_tables/migration.sql‎
Lines changed: 87 additions & 32 deletions
diff --git a/‎backend/prisma/migrations/20260428000001_add_ai_suggestion/migration.sql‎
Lines changed: 8 additions & 3 deletions b/‎backend/prisma/migrations/20260428000001_add_ai_suggestion/migration.sql‎
Lines changed: 8 additions & 3 deletions
@@ -51,7 +51,7 @@ jobs:
       - name: Run Lighthouse CI
         uses: treosh/lighthouse-ci-action@v12
         with:
-          configPath: frontend/studyhub-app/lighthouse.config.js
+          configPath: frontend/studyhub-app/lighthouse.config.cjs
           uploadArtifacts: true
 
   bundle-size:
 
@@ -8,6 +8,50 @@ For internal cycle-by-cycle release notes, see `docs/release-log.md` (tracked) a
 
 ## [Unreleased]
 
+### Security (2026-05-31 — 2nd audit pass, wave-12.24)
+
+- **Study-group discussion replies now require active membership to edit/delete.** A banned or removed member previously kept the ability to edit or delete their own old replies in a private group (the active-membership gate covered the post handlers but had missed the reply handlers). Now both `updateReply` and `deleteReply` require active membership.
+- Explore hardening: an unrecognized `?topic=` returns an empty result instead of all cross-school content; the feature kill switch drops stale cached content when flipped off; cross-school search expansion no longer runs on the private "my sheets" path; the topic fuzzy-match query now uses the trigram index.
+
+### Added (2026-05-31 — cross-school discovery, wave-12.23)
+
+- **Self-learner Explore (`/explore`).** A cross-school discovery page — topic chips, a "Trending this week" shelf, and Sheets / Notes / Study-groups shelves drawn from every school. Read-only, block-filtered, behind `flag_explore_tab` (fail-closed). Backend: `GET /api/explore/{sheets,trending,notes,study-groups,topics}`.
+- **Course aliasing — "Equivalent at other schools."** A curated, CIP-coded topic taxonomy (`CourseAlias` + `TopicCanonical`) maps equivalent courses across schools, so searching "intro programming" surfaces every school's version (Postgres `pg_trgm` fuzzy match), and the Sheets page shows equivalents when you filter to one course. Behind `flag_course_aliasing`. Backend: `GET /api/courses/topics`, `GET /api/courses/:id/equivalents`.
+
+### Security (2026-05-31 — 10-loop adversarial audit fixes, wave-12.22)
+
+- **Private study-group content is now gated on _active_ membership.** Pending (un-approved) and banned members could previously read and post in private-group discussions/resources/sessions; a new `requireActiveGroupMember` guard closes it, and replies/upvotes to hidden (removed / pending-approval) posts are blocked.
+- **Cross-conversation message-content leak closed.** `replyToId` on a new message is now verified to belong to the same conversation, so a participant can no longer pull a stranger's private message content into their own thread.
+- **"Downloads disabled" is enforced on the attachment-preview path (A6).** The preview route streamed the full original file regardless of `allowDownloads`; it now applies the same owner-or-allowed gate as the download routes.
+- **WebAuthn fails closed in production (A9).** `WEBAUTHN_RP_ID`/`WEBAUTHN_ORIGIN` no longer fall back to localhost in prod (which silently broke admin passkey auth); both are now `REQUIRED_IN_PRODUCTION`.
+- **CSRF `originAllowlist()` (A11)** added to the courses, study-status, plagiarism, and hashtags write modules. Socket cookie parser hardened against prototype-pollution keys; socket `conversationId` integer-validated.
+
+### Fixed (2026-05-31 — 10-loop audit)
+
+- **GDPR account deletion no longer aborts** when an optional table is absent — those cleanups moved out of the all-or-nothing transaction.
+- **Note edits made right before closing the tab are saved** — the `sendBeacon` autosave (POST-only) now reaches the update handler instead of 404-ing.
+- **Two migrations made idempotent** (teacher-materials, AiSuggestion) so a partial `migrate deploy` can be safely retried (A5).
+- **Optimistic-UI now reconciles with the server** on study-status, note/sheet/feed reactions, video downloadable toggle, and follow/join — a rejected write rolls back and toasts instead of silently sticking (A4).
+- **A12 integer guards** on sheet-comment react/delete/edit, materials body ids, pinned-sheet delete, study-status PUT.
+- **A11y:** focus traps on the section-picker, topic-picker, and report-group modals; keyboard-accessible announcement image thumbnails; labelled topic-picker inputs.
+- **Perf:** discussion lists count via `_count` instead of loading every reply/upvote row; the all-time leaderboard hydrates only the top-N and bounds its aggregate to a rolling year.
+
+### Security (2026-05-31 — bounded-plan completion batch, wave-12.21)
+
+- **Strict route-id parsing closes the partial-numeric hole.** New `parseRouteId()` (`core/http/validate.js`) rejects ids that `Number.parseInt` would accept partially (`"12abc" → 12`). Applied to `PATCH /api/materials/:id/archive` and `DELETE /api/materials/assignments/:id` (Codex PR-review P2). Digit-only, capped at `MAX_SAFE_INTEGER`.
+- **List-endpoint DoS cap.** New `parseBoundedInt(value, fallback, max)` silently clamps `?limit=` on 4 endpoints (sheets list 100; sheet-comments, feed list, feed reactions 50) — a `?limit=999999` no longer fetches unbounded rows. `parsePositiveInt` deprecated.
+- **Password-reset rejects same-as-current** (NIST 800-63B §5.1.1.2, OWASP ASVS V2.1.1). `POST /api/auth/reset-password` 400s with `PASSWORD_UNCHANGED` when the new password equals the current bcrypt hash; all its raw error envelopes migrated to `sendError()`.
+- **PII value-scrubbing in `redactObject`** (A8 defense-in-depth). Email / phone / IPv4 / SSN patterns are masked inside free-text log string values, not just known sensitive keys.
+- **Stripe idempotency keys** on all 11 state-changing SDK calls (checkout, customer, portal, subscription pause/resume/cancel/reactivate) — a retried call returns the cached response instead of double-charging. Checkout logs Stripe's `request_id`.
+- **`x-request-id` propagation** to the route-level Anthropic calls (sheet generate/edit, note summarize) for log↔dashboard correlation.
+
+### Fixed (2026-05-31)
+
+- **`security.headers` HSTS test** failed in any env whose `.env` lacked `R2_BUCKET_UPLOAD_BACKUP` (promoted to `REQUIRED_IN_PRODUCTION` in wave-12.11 but never added to the test's dummy-secret setup). Added the dummy.
+- **Stale debounce / in-flight fetch after unmount.** `AbortController` + unmount timer-cleanup on 5 effect-driven sites (library data + reader, sheet-lab reads, note-persistence timers, admin user-search) — no more `setState` after navigation.
+- **Duplicate unread-count polling.** Navbar bell + mobile bottom-nav badge now share one `UnreadProvider` poll instead of two independent 30s pollers.
+- **A11y:** focus-trap + Escape + `role="dialog"`/`aria-modal` on 4 more modals (FollowModal, NoteVersionHistory, ModerationAppealModal, AnnouncementMedia lightbox); WAI-ARIA menu keyboard nav on `NavbarUserMenu`; `<main id="main-content">` landmarks on UserProfile + Library so the skip link lands.
+
 ### Added (2026-05-01 rev 2)
 
 - **Settings → Security → Recovery codes UI.** `RecoveryCodesSection.jsx` mounted in the existing SecurityTab. Generates 10 single-use codes via `POST /api/settings/2fa/recovery-codes/regenerate`, displays them in a forced-acknowledgement modal (Escape + backdrop disabled until the user confirms they've saved them), Copy + Download `.txt` actions. Section silently doesn't render if `flag_2fa_recovery_codes` is off (status endpoint 404).
 
@@ -533,6 +533,7 @@ Tables with migrations (safe to query):
 - StudyGroup trust & safety (moderation, mute, strikes, GroupReport, GroupAppeal, GroupAuditLog, GroupBlock) — migration `20260409000002_add_group_trust_and_safety` (rewritten 2026-05-04 with full `IF NOT EXISTS` / `DO $$ EXCEPTION WHEN duplicate_object` guards per CLAUDE.md A5 — closes Bug A "Failed to load groups").
 - Hub AI v2 + library weekly sync — migration `20260504000001_hub_ai_v2_and_library_sync`. Adds `AiAttachment`, `UserAiStorageQuota`, `AiGlobalSpendDay`, `AiUploadIdempotency`, `LibrarySyncState` tables + `AiMessage.attachments` + `AiUsageLog.{documentCount,tokensIn,tokensOut,documentTokens,costUsdCents}`.
 - Scholar v1 + v1.5 — migration `20260504000002_scholar_v15`. Adds `ScholarPaper`, `ScholarPaperSearchCache`, `ScholarAnnotation`, `ScholarDiscussionThread` + `ShelfBook.sourceType` / `paperId`.
+- Course aliasing (G2-4) — migration `20260531000001_course_aliases`. Adds `CourseAlias` + `TopicCanonical` (CIP-coded topic taxonomy) + the `pg_trgm` extension and a GIN trigram index on `TopicCanonical.displayName`. Powers cross-school search expansion + "Equivalent at other schools". (G2-3 Explore is read-only over existing tables — no new tables.)
 
 ## Internal Documentation Layout (added 2026-04-30)
 
 
@@ -68,14 +68,8 @@ ADMIN_EMAIL=abdulrfornah@getstudyhub.org
 ADMIN_USERNAME=
 ADMIN_PASSWORD=
 
-# ── OPTIONAL CONTENT MODERATION (text only) ─────────────────────
-# Used by backend/src/lib/moderation/moderationEngine.js (text scoring).
-# Distinct from ANTHROPIC_API_KEY (Hub AI).
-OPENAI_API_KEY=
-
 # ── ANTHROPIC (Hub AI) ──────────────────────────────────────────
-# Required for /api/ai endpoints. Note: backend uses ANTHROPIC_API_KEY,
-# NOT OPENAI_API_KEY (that var is the moderation engine only).
+# Required for /api/ai endpoints.
 ANTHROPIC_API_KEY=
 
 # ── GOOGLE OAUTH ────────────────────────────────────────────────
 
@@ -17,6 +17,7 @@
     "preview:fixture": "node scripts/ensurePreviewFixture.js",
     "seed:admin": "node scripts/seedAdmin.js",
     "seed:flags": "node scripts/seedFeatureFlags.js",
+    "seed:aliases": "node scripts/seedCourseAliases.js",
     "seed:roles-v2-flags": "node scripts/seedRolesV2Flags.js",
     "seed:notes-hardening-flag": "node scripts/seedNotesHardeningFlag.js",
     "backfill:note-version-bytes": "node scripts/backfillNoteVersionBytes.js",
 
@@ -19,9 +19,14 @@
 --   - MaterialAssignment: CASCADE from both Material and Section
 --
 -- No data backfill required — all four tables are net-new.
+--
+-- Every statement is guarded (CREATE TABLE/INDEX IF NOT EXISTS, FK
+-- constraints wrapped in DO $$ ... EXCEPTION WHEN duplicate_object) so
+-- `prisma migrate deploy` is safe to retry on partial failure and is a
+-- no-op on an already-migrated DB (CLAUDE.md A5).
 
 -- CreateTable: Section — teacher-owned cohort for grouping students.
-CREATE TABLE "Section" (
+CREATE TABLE IF NOT EXISTS "Section" (
     "id" SERIAL NOT NULL,
     "courseId" INTEGER,
     "teacherId" INTEGER NOT NULL,
@@ -36,7 +41,7 @@ CREATE TABLE "Section" (
 );
 
 -- CreateTable: SectionEnrollment — student membership in a section.
-CREATE TABLE "SectionEnrollment" (
+CREATE TABLE IF NOT EXISTS "SectionEnrollment" (
     "id" SERIAL NOT NULL,
     "sectionId" INTEGER NOT NULL,
     "userId" INTEGER NOT NULL,
@@ -47,7 +52,7 @@ CREATE TABLE "SectionEnrollment" (
 );
 
 -- CreateTable: Material — teacher-curated wrapper around a StudySheet or Note.
-CREATE TABLE "Material" (
+CREATE TABLE IF NOT EXISTS "Material" (
     "id" SERIAL NOT NULL,
     "teacherId" INTEGER NOT NULL,
     "sheetId" INTEGER,
@@ -63,7 +68,7 @@ CREATE TABLE "Material" (
 );
 
 -- CreateTable: MaterialAssignment — join between Material and Section with metadata.
-CREATE TABLE "MaterialAssignment" (
+CREATE TABLE IF NOT EXISTS "MaterialAssignment" (
     "id" SERIAL NOT NULL,
     "materialId" INTEGER NOT NULL,
     "sectionId" INTEGER NOT NULL,
@@ -74,41 +79,91 @@ CREATE TABLE "MaterialAssignment" (
 );
 
 -- Uniqueness constraints
-CREATE UNIQUE INDEX "Section_joinCode_key" ON "Section"("joinCode");
-CREATE UNIQUE INDEX "SectionEnrollment_sectionId_userId_key" ON "SectionEnrollment"("sectionId", "userId");
-CREATE UNIQUE INDEX "MaterialAssignment_materialId_sectionId_key" ON "MaterialAssignment"("materialId", "sectionId");
+CREATE UNIQUE INDEX IF NOT EXISTS "Section_joinCode_key" ON "Section"("joinCode");
+CREATE UNIQUE INDEX IF NOT EXISTS "SectionEnrollment_sectionId_userId_key" ON "SectionEnrollment"("sectionId", "userId");
+CREATE UNIQUE INDEX IF NOT EXISTS "MaterialAssignment_materialId_sectionId_key" ON "MaterialAssignment"("materialId", "sectionId");
 
 -- Query indexes
-CREATE INDEX "Section_teacherId_archived_idx" ON "Section"("teacherId", "archived");
-CREATE INDEX "Section_courseId_idx" ON "Section"("courseId");
-CREATE INDEX "SectionEnrollment_userId_idx" ON "SectionEnrollment"("userId");
-CREATE INDEX "Material_teacherId_archived_idx" ON "Material"("teacherId", "archived");
-CREATE INDEX "Material_sheetId_idx" ON "Material"("sheetId");
-CREATE INDEX "Material_noteId_idx" ON "Material"("noteId");
-CREATE INDEX "MaterialAssignment_sectionId_dueAt_idx" ON "MaterialAssignment"("sectionId", "dueAt");
+CREATE INDEX IF NOT EXISTS "Section_teacherId_archived_idx" ON "Section"("teacherId", "archived");
+CREATE INDEX IF NOT EXISTS "Section_courseId_idx" ON "Section"("courseId");
+CREATE INDEX IF NOT EXISTS "SectionEnrollment_userId_idx" ON "SectionEnrollment"("userId");
+CREATE INDEX IF NOT EXISTS "Material_teacherId_archived_idx" ON "Material"("teacherId", "archived");
+CREATE INDEX IF NOT EXISTS "Material_sheetId_idx" ON "Material"("sheetId");
+CREATE INDEX IF NOT EXISTS "Material_noteId_idx" ON "Material"("noteId");
+CREATE INDEX IF NOT EXISTS "MaterialAssignment_sectionId_dueAt_idx" ON "MaterialAssignment"("sectionId", "dueAt");
 
 -- Foreign keys: Section
-ALTER TABLE "Section"
-  ADD CONSTRAINT "Section_courseId_fkey" FOREIGN KEY ("courseId") REFERENCES "Course"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-ALTER TABLE "Section"
-  ADD CONSTRAINT "Section_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+DO $$
+BEGIN
+  ALTER TABLE "Section"
+    ADD CONSTRAINT "Section_courseId_fkey" FOREIGN KEY ("courseId") REFERENCES "Course"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$
+BEGIN
+  ALTER TABLE "Section"
+    ADD CONSTRAINT "Section_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
 
 -- Foreign keys: SectionEnrollment
-ALTER TABLE "SectionEnrollment"
-  ADD CONSTRAINT "SectionEnrollment_sectionId_fkey" FOREIGN KEY ("sectionId") REFERENCES "Section"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "SectionEnrollment"
-  ADD CONSTRAINT "SectionEnrollment_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+DO $$
+BEGIN
+  ALTER TABLE "SectionEnrollment"
+    ADD CONSTRAINT "SectionEnrollment_sectionId_fkey" FOREIGN KEY ("sectionId") REFERENCES "Section"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$
+BEGIN
+  ALTER TABLE "SectionEnrollment"
+    ADD CONSTRAINT "SectionEnrollment_userId_fkey" FOREIGN KEY ("userId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
 
 -- Foreign keys: Material
-ALTER TABLE "Material"
-  ADD CONSTRAINT "Material_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "Material"
-  ADD CONSTRAINT "Material_sheetId_fkey" FOREIGN KEY ("sheetId") REFERENCES "StudySheet"("id") ON DELETE SET NULL ON UPDATE CASCADE;
-ALTER TABLE "Material"
-  ADD CONSTRAINT "Material_noteId_fkey" FOREIGN KEY ("noteId") REFERENCES "Note"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+DO $$
+BEGIN
+  ALTER TABLE "Material"
+    ADD CONSTRAINT "Material_teacherId_fkey" FOREIGN KEY ("teacherId") REFERENCES "User"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$
+BEGIN
+  ALTER TABLE "Material"
+    ADD CONSTRAINT "Material_sheetId_fkey" FOREIGN KEY ("sheetId") REFERENCES "StudySheet"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$
+BEGIN
+  ALTER TABLE "Material"
+    ADD CONSTRAINT "Material_noteId_fkey" FOREIGN KEY ("noteId") REFERENCES "Note"("id") ON DELETE SET NULL ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
 
 -- Foreign keys: MaterialAssignment
-ALTER TABLE "MaterialAssignment"
-  ADD CONSTRAINT "MaterialAssignment_materialId_fkey" FOREIGN KEY ("materialId") REFERENCES "Material"("id") ON DELETE CASCADE ON UPDATE CASCADE;
-ALTER TABLE "MaterialAssignment"
-  ADD CONSTRAINT "MaterialAssignment_sectionId_fkey" FOREIGN KEY ("sectionId") REFERENCES "Section"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+DO $$
+BEGIN
+  ALTER TABLE "MaterialAssignment"
+    ADD CONSTRAINT "MaterialAssignment_materialId_fkey" FOREIGN KEY ("materialId") REFERENCES "Material"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
+
+DO $$
+BEGIN
+  ALTER TABLE "MaterialAssignment"
+    ADD CONSTRAINT "MaterialAssignment_sectionId_fkey" FOREIGN KEY ("sectionId") REFERENCES "Section"("id") ON DELETE CASCADE ON UPDATE CASCADE;
+EXCEPTION
+  WHEN duplicate_object THEN NULL;
+END $$;
@@ -10,8 +10,13 @@
 -- variant if we add a separate listing endpoint later.
 -- ON DELETE CASCADE keeps the table self-cleaning when a user is
 -- removed.
+--
+-- Every statement is guarded with IF NOT EXISTS so `prisma migrate
+-- deploy` is safe to retry on partial failure and is a no-op on an
+-- already-migrated DB (CLAUDE.md A5). The inline FK is created as part
+-- of the guarded CREATE TABLE, so it needs no separate guard.
 
-CREATE TABLE "AiSuggestion" (
+CREATE TABLE IF NOT EXISTS "AiSuggestion" (
   "id"          SERIAL        PRIMARY KEY,
   "userId"      INTEGER       NOT NULL,
   "text"        VARCHAR(280)  NOT NULL,
@@ -24,8 +29,8 @@ CREATE TABLE "AiSuggestion" (
     ON DELETE CASCADE ON UPDATE CASCADE
 );
 
-CREATE INDEX "AiSuggestion_userId_generatedAt_idx"
+CREATE INDEX IF NOT EXISTS "AiSuggestion_userId_generatedAt_idx"
   ON "AiSuggestion"("userId", "generatedAt");
 
-CREATE INDEX "AiSuggestion_userId_dismissedAt_idx"
+CREATE INDEX IF NOT EXISTS "AiSuggestion_userId_dismissedAt_idx"
   ON "AiSuggestion"("userId", "dismissedAt");