2 Commits

Author	SHA1	Message	Date
Maxim Dolgolyov	c1c08be2b0	test: 7 e2e tests for permission boundaries ... Focused suite covering IDOR and privilege-escalation patterns: 1. Student cannot delete another teacher's class (role block) 2. Teacher cannot delete another teacher's class (ownership check) 3. Banned user blocked on all protected routes 4. Token revoked after token_version bump (password change flow) 5. Join class with wrong invite code → 404, no membership created 6. Admin-only route blocks teacher role 7. Protected route without token → 401 All 7 pass. Pre-existing auth.test.js failures (rate-limiter shared state in test server) are unrelated and were present before this PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-06 17:21:05 +03:00
Maxim Dolgolyov	be4d43105e	LearnSpace: full-stack educational whiteboard platform ... Node.js/Express backend + vanilla JS frontend. Features: real-time collaborative whiteboard (SSE), multi-page support, LaTeX formulas, shapes/connectors, coordinate systems, number lines, compass, zoom/pan, Catmull-Rom pencil smoothing, ruler/protractor with rotation & resize controls, minimap navigation overlay, auto-measurements, multi-page thumbnails sidebar, PNG export, page templates. Student/teacher workflows: classes, assignments, library, dashboard. Mobile responsive. SQLite (better-sqlite3). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-12 10:10:37 +03:00